01 / 05
Evidence That Files Itself
Vestal reads from more than 100 integrations — cloud accounts, identity providers, code hosts, endpoint managers — and files each artefact against the control it proves. The capture-and-paste ritual ends here.
Continuous compliance · SOC 2 · ISO 27001 · HIPAA
For the Security Lead Who Owns the Audit
Keep your compliance flame burning, audit after audit. Vestal tests your controls around the clock, files the evidence as it is produced, and tells you the moment a control begins to drift — so the audit becomes a reading, not a reconstruction.
- SOC 2CC6.1 Logical access
- ISO 27001A.5.15 Access control
- HIPAA164.312(b) Audit controls
- SOC 2CC7.2 System monitoring
- ISO 27001A.8.16 Monitoring activities
- HIPAA164.312(d) Authentication
- SOC 2CC8.1 Change management
- ISO 27001A.8.24 Use of cryptography
- HIPAA164.308(a)(1) Risk analysis
Teams that keep their evidence in Vestal
Teams who would rather ship product than assemble binders keep their evidence here.
Yarrow & Co
Pinecrest
Kestrel Works
Fallowfield
Saltmarsh
02 Features
Everything an Auditor Asks For, Already in the File
Vestal rests on a single idea: compliance is a property of how you operate every day, not an event you prepare for once a year. Five instruments keep that property measurable.
03 / 05
Access Reviews Without the Chase
Each quarter, Vestal assembles who can reach what, flags accounts gone quiet, and routes every decision to the right manager. Revoke from inside the review itself — one click, logged.
05 / 05
A Log That Cannot Be Rewritten
Every action is hash-chained into an append-only record. Export a framework-mapped report in a click, and prove the history has not been touched since it was written.
02 / 05
Drift Announces Itself
When an admin loses MFA or a bucket turns public, the control flips on the next test run and the message reaches Slack or your inbox with the owner, the resource and the fix attached. You hear it from Vestal, not from your auditor.
04 / 05
A Read-Only Door for Your Auditor
Invite your auditor into a scoped, read-only portal. They find the evidence, ask their questions in context, and never need an export, an email thread or a shared drive. Every view is logged.
Coverage at a glance
One Library, Three Frameworks
A control tested once counts toward SOC 2, ISO 27001 and HIPAA alike. You maintain one library; Vestal maps it to each standard.
100+
integrations reporting into a single live score
A Record That Stays Written
Results enter a hash-chained log as they happen, so the history you hand an auditor is the history that occurred.
03 How it works
The Route From First Connection to a Signed Report
Three movements, each small enough to finish in a single sitting.
Connect
Grant read-only access to your cloud, identity provider and code host through a scoped role or OAuth. Nothing is installed on your servers, and every grant can be revoked from the same screen.
Configure
Choose SOC 2, ISO 27001 or HIPAA. Vestal maps each control to an owner and a test cadence; you tune thresholds and silence whatever does not apply to your scope.
Launch
Tests run continuously, evidence files itself and the score updates live. When the audit window opens, invite your auditor into the portal and step back.
Scroll sideways to follow the route.
04 The practice
Compliance Is a Practice, Not a Project
3frameworks maintained from one control library
1live score, recalculated on every test run
24/7control testing, with drift reported as it happens
0spreadsheets to reconcile when the auditor arrives
05 Integrations
Works With the Tools You Already Keep Open
Vestal reads from the systems where the work actually happens — read-only, scoped and revocable. Beyond the six below, more than a hundred connectors are ready to switch on.
DatadogLog retention and monitor coverage
AirtableVendor and asset registers
NotionPolicies and acknowledgements
ZoomRecording and meeting settings
DropboxSharing and retention rules
AsanaRemediation tasks and owners
06 Plans
Three Plans, Priced Once a Year
Every plan is billed annually. Choose by the number of frameworks you carry and the number of people inside the perimeter.
Sentinel
One framework, watched properly.
$199/yr
billed annually
- 1 compliance framework
- Up to 25 monitored users
- 20 integrations
- Automated evidence collection
Bastion
For teams carrying several frameworks at once.
$279/yr
billed annually
- Up to 3 frameworks
- 150 monitored users
- Vendor risk questionnaires
- Access review workflows
Citadel — recommended plan
For organisations that answer to many auditors.
$560/yr
billed annually
- Unlimited frameworks
- Unlimited users
- Custom control libraries
- SSO and SCIM
- Dedicated compliance advisor
Prices are in US dollars per year, billed annually. Each plan includes read-only connectors and the auditor portal.
07 In their words
What Teams Say After the First Audit
Evidence now files itself against the right control. When our auditor asked for last quarter’s access reviews, I sent a link instead of a folder.
Drift alerts changed our week. A disabled MFA policy surfaced in Slack with the owner already tagged, and it was fixed before anyone outside the team knew.
Access reviews used to mean a month of reminders. Managers now decide inside the review, and the revocation happens from the same screen.
Hand Your Auditor a Link, Not a Folder.
Three plans, billed annually, from $199 a year. Choose the one that fits the frameworks you carry, and let the record build itself.