Get access

SPEC 00 · feature index

Evidence should never be a project.

A control is either healthy right now or it isn’t. Eddystone is built around that one opinion: seven capabilities that keep the answer current, attributed and ready for whoever asks, auditor included.

Get access Read the spec

SPEC 01 · capabilities

FIG. 01 · evidence-collectors

Collectors that read, timestamp and file.

Read-only collectors pull IAM credential reports, branch rules, MFA policies and ticket histories from AWS, GitHub, Okta and Jira on a schedule. Each item is stamped with the moment it was read and stored against the control it proves.

The benefit: the answer to “show me this was true in August” is already on file, in August’s version.

Fits your weekConnect a source on Monday; by Tuesday the first controls turn green without a single export.

FIG. 02 · drift-alerts

Drift alerts with a name attached.

Controls are re-tested continuously, not once a quarter. When an Okta policy loosens or a bucket opens up, the owner receives the control, the before-and-after diff and who made the change, in Teams or as a Jira ticket.

The benefit: a failure is a five-minute fix on the day it happens, not a finding in fieldwork.

Fits your weekAlerts post to the channel your security team already watches, and acknowledgements are logged as evidence.

FIG. 03 · cross-map

Collect once, answer three frameworks.

One MFA policy export satisfies SOC 2 CC6.1, ISO 27001 A.8.5 and HIPAA 164.312(d). Eddystone keeps the map between evidence and requirements, so a second framework reuses what you already collected.

The benefit: adding ISO 27001 next year is a toggle, not a restart.

Fits your weekTurn on a framework, review the gaps it reveals, and assign owners the same afternoon.

FIG. 04 · control-health

A live number for “are we okay?”

The overview rolls every control into healthy, drifting and failing, per framework, with thirty days of evidence volume underneath. Totals reconcile: 214 healthy, 11 drifting and 6 failing add up to 231.

The benefit: security leads answer the board with a dashboard, not a week of chasing owners.

Fits your weekOpen it Monday, sort by severity, and walk the failing list in standup.

FIG. 05 · access-review

Quarterly access reviews in one sitting.

Every account and entitlement from Okta, AWS and GitHub lands in one review, with last sign-in beside each name. Reviewers keep or revoke per person, then certify. The signed review is filed as evidence automatically.

The benefit: the spreadsheet round of “is Dana still on AWS?” is gone, and the stale contractor is caught by the data.

Fits your weekOpen a review on the first of the quarter; certify before lunch.

FIG. 06 · auditor-portal

A read-only room for your auditor.

Invite the audit firm to a scoped portal: they see the request list, status and evidence, and comment on the exact item. Nothing to email or zip, and nothing they are able to change.

The benefit: fieldwork questions arrive attached to the evidence they’re about, so the back-and-forth shrinks to a comment thread.

Fits your weekShare one link on kickoff day; watch the delivered count climb.

FIG. 07 · command-palette

⌘K goes straight to the control.

Search any control, evidence item, person or request from the keyboard. Jump to CC6.1, open the owner’s open items, or start an access review without touching the sidebar.

The benefit: the people who live in the tool all day spend their time fixing controls, not finding them.

Fits your weekMid-call with an auditor, find the item in two keystrokes and paste the link.

SPEC 02 · where it sits in the year

One audit cycle, start to sign-off.

Here is how the seven capabilities line up against a normal twelve months. Most of the work happens on weeks nobody circled on a calendar.

  1. Week 1

    Connect

    Read-only scopes for AWS, GitHub, Okta and Jira. Collectors start filing.

  2. Weeks 2–3

    Map and assign

    Pick frameworks, see gaps, give every control an owner.

  3. All year

    Watch drift

    Re-tests run continuously; alerts name the person and the change.

  4. Each quarter

    Review access

    Certify who holds what. The signed review becomes evidence.

  5. Audit window

    Open the portal

    Invite the auditor, answer comments in place, export nothing.

SPEC 03 · security and reliability

A compliance tool should pass its own audit.

Eddystone holds the keys to a map of your infrastructure, so it asks for as little as possible and shows its work. These are the design rules the product runs on.

Read-only scopes
Collectors request read permissions only. Eddystone cannot change a policy, a bucket or a branch rule.
Scoped auditor access
Auditors see only the requests and evidence you share, cannot edit, and every view is logged.
Timestamped evidence
Every item records when it was read and from which source, and earlier versions stay on file.
Collector health
A source that stops syncing or has an expiring token shows a warning in the sources list, before it leaves a gap.
Sign-in controls
SSO and SCIM provisioning on the Citadel plan, so your own offboarding rules apply here too.

SPEC 04 · integrations

Native where it matters, routed everywhere else.

Three sources get deep, purpose-built collectors. The rest feed tickets, alerts and records into the same evidence trail.

Native collectors

Where the evidence lives

Configuration, identity and change history, read on a schedule.

  • AWS: IAM, S3, CloudTrail, backups
  • GitHub: branch rules, PR history
  • Okta: MFA, sign-on, users
Workflow

Where the fixing happens

Alerts and tickets go where your team already works.

  • Jira: drift tickets, change records
  • Microsoft Teams: owner alerts
  • Asana and Notion: task handoffs
Connectors

Where the odd records are

Pull in evidence from tools without a native collector.

  • Zapier: custom evidence zaps
  • Airtable and Xero records
  • Shopify store admin settings

Seven capabilities, three plans

Pick the plan that matches your audit.

Start with the framework you owe someone this year. The collectors, drift alerts and auditor portal come with you as you grow.

Get access