Read-only, always
Collectors request the narrowest scopes that can prove a control. Eddystone looks at your AWS, GitHub and Okta. It never changes them, and an auditor’s portal can’t change anything either.
principle 01 · least privilege
SPEC 00 · about eddystone
Compliance is a log, not a project.
We think nobody should have to “prepare for” an audit. If your systems already know what happened, the evidence already exists. Eddystone is the part that writes it down, files it and hands it over.
status: documentedFIG. 01 · the problem
The scramble was always avoidable.
Every audit cycle, the same thing happens. Someone exports a user list from Okta, screenshots an AWS console, pastes branch rules from GitHub into a doc and renames the file “final_v3”. Weeks later the evidence is stale and the person who gathered it has moved on.
The facts were never hidden. They sat in systems that already log everything, waiting for a human to copy them out on a deadline. Eddystone was built to remove the copying, and with it the dread.
- Week 1Request list landsSpreadsheet of evidence asks, owners unclear.
- Week 2Screenshot seasonConsoles captured by hand, dates squinted at.
- Week 3The gap nobody sawA policy loosened in the summer. Found now.
- Week 4Zip file, sentAuditor asks a follow-up. Repeat.
SPEC 02 · principles
Four rules we won’t trade away.
They decide what ships, what doesn’t, and what we say no to when a feature request looks tempting.
Continuous beats periodic
A control that passed in March says little about November. We test on a schedule, not on request.
principle 02
Collect once
One MFA export should answer SOC 2, ISO 27001 and HIPAA. Adding a framework should never restart the work.
principle 03
Show the receipts
Every status on screen traces back to a timestamped item and the system it came from. If we can’t show where a green check came from, it doesn’t get to be green. Auditors trust a trail they can click through, so that is the product.
principle 04 · evidence or it didn’t happen
FIG. 03 · how it’s built
FIG. 03 · collectors + ledger
An append-only ledger under every control
Collectors pull configs, logs and access lists on a schedule and write each result to an append-only evidence ledger with its source and timestamp. Nothing is overwritten, so last quarter’s state stays provable after this quarter’s fix.
Support is the same. Questions go to contact@eddystoneworks.com and are answered by the people who maintain the collectors, so a broken sync gets read by the person who can repair it.
SPEC 04 · where it’s going
What we’re working on, in the order we’ll do it.
Directions, not promises with dates. Each one comes from a gap that auditors and security teams keep describing to us.
- Shipping now
Deeper AWS and Okta checks
More controls tested straight from the source configuration, so fewer items need a human to attest.
- Next
Vendor evidence intake
A place for third-party reports to land beside your own evidence, mapped to the same controls.
- After that
More frameworks on the same ledger
New frameworks as toggles over evidence you already collect, in line with the collect-once rule.
- Always
Fewer things to configure
Every release, we look for a setting that could be a sensible default and remove it.
Ready when your next auditor is
Let the systems write the evidence.
Pick a plan sized to the frameworks you owe this year. Your auditor gets a read-only link, and your team gets the weeks back.
Get access