Features

Compliance automation with the methodology published and the gaps labeled.

PLProofLane · Evidence record

Sample record

Record detail — sample

gh-2fa-enforced · CC6.1

One record, shown the way an auditor sees it: source, collection time, status, and its place in the hash chain. Nothing about this record is a conclusion — it is evidence, with its limits printed on it.

Source

GitHub API — organisation two-factor requirement, read-only scope

Live collector

Collected

Oct 14, 2026 · 06:00 UTC — cadence every 6 hours

PASS

prev_hash

41be…09d3 — the record chained immediately before this one

record_hash

SHA-256 a3f9…c21e — SHA-256(prev_hash + canonical record)

Chain verifies

Freshness

expires_at set from the check’s freshness window — expired evidence counts as not passing

Fresh

Printed on every record

What it proves. What it can’t.

Proves

Every org member authenticated with two-factor at collection time.

Cannot prove

That 2FA was enforced for the whole audit period, or anything about non-SSO personal access tokens.

The auditor decides

Operating effectiveness over time is what your independent auditor tests. We organise evidence; auditors issue opinions.

DRAFT mappings: control mappings are drafts pending independent compliance-advisor review — labeled DRAFT in the product, in exports, and on this site.

Sample record. Format demonstration — fictional workspace, no real customer data.Export pack: methodology README, evidence manifest with hashes, control-mapping CSV, readiness report, policy drafts.

Real evidence collectors

GitHub (2FA enforcement, outside collaborators), Google Workspace (2SV, stale licenses), AWS (root MFA, and more) — each check declares what a PASS proves and what it cannot prove.

Continuous monitoring

Cadence-based collection with PASS→FAIL drift alerts. The second run respects cadence; nothing re-runs pointlessly.

Honest readiness math

readiness = passing / applicable, denominator always shown. UNVERIFIED and ERROR count as not-passing.

Fixture labeling

Any mock-mode artifact carries artifact_source: fixture — it can never be mistaken for live data.

Policy drafts

Seven templates (info-sec, incident response, access control, and more), generated with your company details, bannered DRAFT.

Auditor export pack

Zip with methodology README, evidence manifest (hashes), control-mapping CSV, readiness report, and policy drafts.

Failure honesty

Unreachable integrations produce ERROR evidence with the reason — the platform never guesses, never fills gaps.

Fixed-price auditor marketplace

$7–12K booked in-platform. Licensed independent firms only, vetted per a published procedure.

Dashboard API

Readiness, evidence, policies, and the disclaimer over a key-authenticated HTTP API.

Honest scope: what's real today

We'd rather tell you what's roadmap than let you discover it after signup.

Area	v1 reality
Control mappings	DRAFT — pending independent compliance-advisor review (required pre-launch gap, flagged openly).
Integrations	3 live in v1 (GitHub, Google Workspace, AWS); ~30 on the roadmap.
What automation covers	Technical evidence (configs, access logs, policy artifacts). Not judgment calls, interviews, or operating-effectiveness testing.
Audit opinions	Only a licensed independent auditor can issue a SOC 2 report. We are software, not a certification body.
Auditor marketplace	Vetting procedure published; no firms vetted yet (pre-launch).