Compliance

Seven compliance frameworks.
One architecture blueprint.

Compliance checks that used to take weeks of consultant time now run in seconds — grounded in your actual blueprint elements, not a generic questionnaire. Get a gap report and evidence pack ready for auditors without leaving the platform.

Frameworks covered

SOC 2

Trust Services

CC6 — Logical and physical access controls mapped to architecture elements

CC7 — System operations and change management coverage

CC8 — Change management traceability from blueprint to code

Availability and confidentiality criteria assessed against your data flows

ISO 27001

Information Security

Annex A.12 — Operations security: logging, monitoring, capacity management

Annex A.14 — System acquisition, development, and maintenance controls

Risk treatment mapping: architecture elements to control objectives

Statement of Applicability (SoA) draft generated from your blueprint

GDPR

Data Privacy

Data flow mapping: personal data elements identified in the blueprint

Data residency: storage locations checked against permissible regions

Consent mechanisms: UI flows evaluated for lawful basis requirements

Data minimisation and purpose limitation assessed at entity level

HIPAA

Healthcare

PHI storage: data objects classified and encryption requirements flagged

Encryption at rest and in transit: verified against architecture decisions

Access control: role-based access mapped to application layer elements

Audit logging: event capture points identified in the technology layer

PCI-DSS

Payments

Cardholder data environment (CDE) boundary defined and scoped

Network segmentation: isolation of CDE from out-of-scope systems verified

Encryption of cardholder data at rest and in transit

Vulnerability management and patch processes mapped to architecture

DORA

EU Financial

ICT risk management framework — Article 6 requirements mapped to architecture

Incident classification — ICT-related incident categories identified

Third-party ICT risk — provider dependencies scoped from blueprint

Digital resilience testing — architecture gaps flagged against Article 25

NIS2

EU Critical Sectors

Risk management measures — Article 21 security requirements mapped

Incident reporting obligations — notification pathways identified

Supply chain security — third-party service dependencies assessed

Governance and accountability — roles and ownership mapped to architecture

How it works in practice

Gap report with severity levels

Every compliance gap is classified as Critical, High, Medium, or Low. You know exactly what to fix before the auditor arrives.

Evidence pack export

Generate a structured evidence pack — control coverage table, gap list, architecture diagram — ready to hand to an auditor or upload to a GRC tool.

Re-run as your architecture evolves

Every time you update your blueprint, run the compliance check again. Gaps are automatically re-evaluated against the new model.

Know your compliance posture before the auditor does

free plan. No credit card required. Run your first compliance check in minutes.

Loading…

Frameworks covered

SOC 2

Trust Services

CC6 — Logical and physical access controls mapped to architecture elements

CC7 — System operations and change management coverage

CC8 — Change management traceability from blueprint to code

Availability and confidentiality criteria assessed against your data flows

ISO 27001

Information Security

Annex A.12 — Operations security: logging, monitoring, capacity management

Annex A.14 — System acquisition, development, and maintenance controls

Risk treatment mapping: architecture elements to control objectives

Statement of Applicability (SoA) draft generated from your blueprint

GDPR

Data Privacy

Data flow mapping: personal data elements identified in the blueprint

Data residency: storage locations checked against permissible regions

Consent mechanisms: UI flows evaluated for lawful basis requirements

Data minimisation and purpose limitation assessed at entity level

HIPAA

Healthcare

PHI storage: data objects classified and encryption requirements flagged

Encryption at rest and in transit: verified against architecture decisions

Access control: role-based access mapped to application layer elements

Audit logging: event capture points identified in the technology layer

PCI-DSS

Payments

Cardholder data environment (CDE) boundary defined and scoped

Network segmentation: isolation of CDE from out-of-scope systems verified

Encryption of cardholder data at rest and in transit

Vulnerability management and patch processes mapped to architecture

DORA

EU Financial

ICT risk management framework — Article 6 requirements mapped to architecture

Incident classification — ICT-related incident categories identified

Third-party ICT risk — provider dependencies scoped from blueprint

Digital resilience testing — architecture gaps flagged against Article 25

NIS2

EU Critical Sectors

Risk management measures — Article 21 security requirements mapped

Incident reporting obligations — notification pathways identified

Supply chain security — third-party service dependencies assessed

Governance and accountability — roles and ownership mapped to architecture

How it works in practice

Gap report with severity levels

Every compliance gap is classified as Critical, High, Medium, or Low. You know exactly what to fix before the auditor arrives.

Evidence pack export

Generate a structured evidence pack — control coverage table, gap list, architecture diagram — ready to hand to an auditor or upload to a GRC tool.

Re-run as your architecture evolves

Every time you update your blueprint, run the compliance check again. Gaps are automatically re-evaluated against the new model.

Seven compliance frameworks.One architecture blueprint.

Frameworks covered

How it works in practice

Know your compliance posture before the auditor does

Seven compliance frameworks.One architecture blueprint.

Frameworks covered

How it works in practice

Know your compliance posture before the auditor does

Seven compliance frameworks.
One architecture blueprint.

Seven compliance frameworks.
One architecture blueprint.