An open-source toolchain for audit evidence — collect it from real systems, seal it tamper-evident, map it to SOC 2, ISO 27001 & NIST controls, and measure how much of a framework you actually cover. Built for the auditor on the other side.
Each tool does one job and hands off to the next — run a single step or the whole chain, from collecting evidence to measuring control coverage.
Ready-to-run scripts for common audit procedures: pseudo-random sampling, GITC extraction, database user access, Linux OS reports, and more. Gathers raw evidence into CSV packages — use as-is or adapt to your environment.
Tamper-evident seals and chain of custody for evidence packages. SHA-256 Merkle manifests catch any change to any file; sequential seals chain into a verifiable history; optional ed25519 signing and RFC 3161 timestamping prove who sealed it and when.
Turns an audit-tools evidence package into a control-mapped, auditor-ready report — Markdown, self-contained HTML, or JSON. Declarative rulesets map findings to SOC 2, ISO 27001, and NIST 800-53, with diff and trend modes for tracking drift over time.
Control-first coverage analysis. Scores an evidence corpus against the complete catalog of a framework's controls — SOC 2, ISO 27001, NIST 800-53 — to report a true coverage percentage, the blind spots no finding touches, and a Statement of Applicability. Reads audit-report JSON.
A read-only GitHub App that collects continuously — turning your GitHub security configuration into compliance evidence. Captures branch protection, scanning alerts, and org access over time, maps them to SOC 2 and ISO 27001 controls, and exports CSV and PDF evidence packages.
Step-by-step guides on building your own audit automation using Python, the CLI, and APIs. Good starting point if you're new to scripting or want to extend any of the tools above.
Step one of the pipeline — the collectors that pull raw evidence from the systems auditors most commonly deal with. New systems are added over time.
IAM users, password policy, and public S3 buckets — the cloud identity and configuration evidence auditors ask for first.
Administrators, members, branch protection settings, and audit-log events — SDLC and change-management evidence.
User access, privilege levels, password rotation checks — for PostgreSQL, MySQL, and others.
Shell scripts to generate system reports: users, groups, sudoers, login history, and more.
Reproducible pseudo-random sampling with a fixed seed — a core procedure for most audits.
Tracking and visualization utilities for audit project data and findings.
Scripts targeting specific application-layer controls across common enterprise software.
Fork, add a script for your stack, and open a PR. All audit-relevant tools considered.
