SOC 2, PCI DSS, and ISO 27001 readiness without the $12,000/year price tag.

Watch the overview

Is your compliance platform inside your audit scope?

A 90-second walkthrough of why self-hosting keeps your compliance tooling out of your audit scope, and what one deployment covers across SOC 2, PCI DSS 4.0.1, and ISO/IEC 27001:2022.

See it before you buy

Every screen your team will actually use

Live screenshots from a running instance, not mockups. What you see is what ships on day one. Or skip the screenshots and click through the live demo yourself.

Command Center

Know your posture before your auditor does

The dashboard shows your live compliance posture score, a trend chart across every check run, and a precise count of what's passing and failing right now. The drift detection banner surfaces exactly what changed since your last run, what broke, what you fixed. When your auditor asks how controls performed across the observation window, you show them this chart. No spreadsheet. No manual assembly.

Automated Evidence

54 live checks. Mapped to SOC 2, PCI DSS, and ISO 27001. Results in minutes.

Every check is dual-mapped: a SOC 2 Trust Services Criterion and the matching PCI DSS 4.0.1 requirement, side by side on the same row. AWS, GCP, Azure, and GitHub checks all run against your live accounts and return results in minutes. Each failing check shows both the SOC 2 criterion and the PCI requirement plus severity, so you know exactly which gaps to close first. Your auditor and your QSA each see labels they already recognize. No translation required between what you've built and what they need to certify.

The gap in the market

Vanta and Drata start at $10,000–$15,000/year and are built for Series B+ companies with dedicated security teams. Below that, teams either pay for tools they barely use or manage SOC 2 readiness through spreadsheets and manual screenshots.

Controls targets the $0–$7,500/year bracket: the team that just landed their first enterprise customer asking for a SOC 2, and needs a real tool, not a spreadsheet.

What it checks automatically

54 checks run against your live cloud accounts, each mapped to specific AICPA Trust Services Criteria 2017 points of focus and PCI DSS 4.0.1 requirements.

Beyond automated checks

• 36 manual controls with evidence tracking

  Non-automatable controls across Governance, HR, Access Management, Risk, Change Management, Incident Response, Business Continuity, and Vendor Management, plus 8 PCI-specific controls for SAQ A / A-EP merchants (cardholder data flow diagram, payment-page script inventory, TPSP agreements, and more). Each has a named owner, next review date, overdue alerts, and file evidence upload (PDF, DOCX, PNG, XLSX up to 10 MB).

• Posture score trend chart

  Every check run is stored and grouped. A 30-run line chart shows your posture score over time, useful for demonstrating to auditors that controls operated effectively across the observation window, not just on the day of the audit.

• Drift detection and Slack alerts

  After every check run, results are compared against the previous run. New failures trigger a Slack notification. The dashboard surfaces "New failures since last run" and "Fixed since last run" banners so you always know what changed.

• Audit period tracking

  SOC 2 Type II requires a defined observation window (typically 6–12 months). Create a named audit period with start and end dates. The dashboard shows days elapsed, total days, and a progress bar so you always know where you stand.

• Cryptographic attestation timestamps

  Every manual attestation, adopted policy, and completed check run is sealed with an RFC 3161 timestamp from DigiCert or Sectigo. Evidence file contents are hashed into the attestation envelope, so replacing a file after attestation invalidates the stamp. Auditors verify offline with OpenSSL, no Scorifya account required. See the full trust model →

• Auditor read-only portal

  Generate a time-limited shareable link (30, 60, or 90 days) and send it directly to your CPA firm. They see live check history, all manual controls with evidence files, and per-attestation DigiCert timestamp verification, no login required, no PDF filtering, nothing to install.

Your data stays on your server

Controls ships as a Docker image. You run it on your own infrastructure, your own VPS, cloud account, or internal server. AWS credentials, GitHub tokens, check results, evidence files, and attestation records never leave your environment. There is no external telemetry.

Compare that to SaaS compliance platforms: Vanta and Drata connect to your AWS and GitHub accounts and store your compliance data on their servers. For teams with data residency requirements or customers who ask where your audit evidence lives, Controls gives you a clean answer: on your server.

Three self-serve tiers, monthly or annual, plus an enterprise agreement for larger deployments. No per-seat pricing, no per-check pricing, no additional charges as your team grows.

Up in three commands

The primary deployment artifact is a docker-compose.yml. On first boot, the database is pre-seeded with all 54 automated checks and 28 manual controls, no additional setup required.

The image is published to ghcr.io/scorifya/controls:latest. Pin a specific version by replacing :latest with a semver tag (e.g., :1.2.0).

Requirements

• Docker

  Any machine that runs Docker. The image includes Node.js and Python, no separate installs needed.

• AWS IAM credentials (for AWS checks)

  An IAM user or role with the SecurityAudit managed policy attached. Read-only, no write permissions used.

• GitHub personal access token (for GitHub checks)

  Token with repo, admin:org, and security_events scopes. Works with GitHub personal accounts and organizations.

• GCP service account JSON (for GCP checks)

  A service account with the Security Reviewer role. Download the JSON key from IAM → Service Accounts → Keys. Optionally configure domain-wide delegation for MFA enforcement checks.

• Azure service principal (for Azure checks)

  An app registration in Azure AD with Reader and Security Reader roles on the subscription. Requires Tenant ID, Client ID, Client Secret, and Subscription ID.

• License key

  Issued at scorifya.com. Without a key, the dashboard is read-only (existing data is visible, new runs and attestations are paused).

Common questions

Is this a replacement for a SOC 2 audit?▾

No. Controls is a readiness and monitoring tool, it helps you build and demonstrate controls before and during your audit. A licensed CPA firm conducts the actual SOC 2 examination. Controls reduces the prep work and gives auditors a continuous evidence trail.

Does Controls support PCI DSS?▾

Yes. Every automated check and most manual controls map to both SOC 2 (AICPA TSC 2017) and PCI DSS 4.0.1 in one deployment, with no per-framework add-on. A framework filter lets you view SOC 2 only, PCI DSS only, ISO 27001 only, or all three. PCI coverage is scoped to SAQ A and A-EP merchants, teams that outsource card capture to a hosted payment page. Controls is a readiness and evidence tool; it does not replace a Qualified Security Assessor, an approved scanning vendor, or the SAQ itself.

What AWS permissions are needed?▾

The SecurityAudit managed IAM policy covers all 19 AWS checks. It's read-only, no resources are created, modified, or deleted. You can attach it directly to an IAM user or assume it via an IAM role.

Where is my data stored?▾

Entirely on your own infrastructure. Controls runs as a Docker container with a SQLite database on a persistent volume. AWS credentials, GitHub tokens, check results, and evidence files never leave your server. There's no external telemetry.