More connectors, same discipline
Beyond the hundred-plus integrations already reporting in, new connectors arrive read-only first, with the same scoped, revocable access as the rest.
About Vestal
For the Teams Who Believe an Audit Should Be a Reading, Not a Reconstruction
Vestal is a continuous compliance platform for SOC 2, ISO 27001 and HIPAA. It exists because the way most companies prove they are secure — a frantic quarter of screenshots and spreadsheets — proves very little about the other eleven months.
01 The problem
The Binder Was Never the Point
A control that passed in March says nothing about October.
The old ritual is familiar to anyone who has owned an audit. Weeks before the window opens, someone opens a spreadsheet, lists every control, and begins to hunt: a screenshot of an MFA policy, an export of IAM users, a PDF of last quarter’s access review. Each artefact is accurate on the day it is taken and stale on the day after.
The work is real, but it measures the wrong thing. An auditor samples a moment; your risk lives in the intervals between moments — the bucket made public on a Friday, the contractor who kept admin rights after the project closed, the branch rule quietly loosened to unblock a release.
Vestal was built on a plainer premise: if a control matters, test it as often as it can change, and file the result at the instant it is produced. Then the evidence is not assembled for the audit. It is simply there, in order, dated, and unaltered.
02 Principles
Four Convictions the Product Is Held To
Every feature is argued against these. When one fails the test, it does not ship.
-
Measure continuously, report calmly
Testing runs around the clock, but alerts are reserved for real drift, with the owner, the resource and the remedy attached. A tool that cries wolf teaches a team to look away.
-
Evidence should be unalterable
Results enter a hash-chained, append-only log as they occur. The history you hand an auditor must be the history that happened — and provably so.
-
Ask for the least access, and show it
Every connector is read-only, scoped and revocable from a single screen. A compliance tool that widens your attack surface has defeated its own purpose.
-
Respect the auditor’s craft
Auditors are not adversaries. Give them a scoped, read-only door, context beside every artefact, and a log of what they viewed. Better questions follow better access.
03 How it is built
Read-Only by Design, Supported by People Who Read the Tickets
Vestal connects to cloud accounts, identity providers, code hosts and endpoint managers through scoped roles and OAuth. Nothing is installed on your servers, and no connector can write back to your systems.
- AccessRead-only scopes only; every grant listed and revocable in one place.
- RecordEach test result and user action is hash-chained in an append-only log.
- LibraryOne control is tested once and mapped to SOC 2, ISO 27001 and HIPAA.
- SupportQuestions go to hello@vestalcontinuous.com and are answered by the people who maintain the connectors.
04 Where it is going
The Next Chapters, Stated Plainly
Direction rather than promise: these are the areas the product is being shaped toward, in the order they are being worked.
Fewer alerts, better ones
Drift detection is being tuned to group related changes into a single finding, so one misconfiguration reads as one story and not five notifications.
Questions answered in context
The auditor portal will carry more of the back-and-forth itself — requests, clarifications and sign-offs kept beside the evidence they concern.
Have a framework or a system you wish Vestal covered? Write to hello@vestalcontinuous.com; the roadmap is read by the people who build it.
Light It Once. Keep It Lit.
Three plans, billed annually, from $199 a year. Pick the one that fits the frameworks you carry, and let the record write itself.