Features · the full instrument panel
For the Team That Answers Every Auditor From One Record
Seven instruments, each built for a single job: testing controls on the hour, filing evidence as it appears, naming drift while it is still small, and handing your auditor a door instead of a folder. Read in order, they describe an audit year with nothing left to reconstruct.
Continuous control tests
Every Control Is Tested on the Hour, Not the Quarter
Each of your 225 controls carries an owner, a test and a cadence. Vestal runs the test against the live system — an Okta policy, an IAM credential report, a branch rule — and records pass, fail or pending with the reading that proved it. The score on your overview is simply the sum of those readings.
In your workflow: the control owner is named once; after that, the test runs without them.
Self-filing evidence
Evidence Files Itself Against the Control It Proves
Vestal reads from more than 100 integrations and attaches each artefact — the MFA enrollment log, the credential report, the disk-encryption inventory — to the control it supports, stamped with the moment it was collected. The screenshot-and-paste ritual simply ends.
In your workflow: connect a source once with read-only access; every quarter’s artefacts arrive on their own.
Drift alerts
Drift Announces Itself, With the Owner Already Named
When an admin loses MFA or a bucket turns public, the control flips on the next run and a message reaches Slack or your inbox carrying the resource, the severity, the owner and the fix. Snooze it, assign it, or open a ticket without leaving the thread.
In your workflow: route critical drift to #sec-alerts, medium findings to a weekly digest.
The remaining four instruments are where audits are actually won.
Compare the three plansAccess reviews
Quarterly Access Reviews Without the Month of Reminders
Vestal assembles who can reach what, flags accounts that have gone quiet and routes each decision to the right manager. Revoking happens inside the review itself — one click, one log entry, no ticket round-trip.
In your workflow: launch a review on the first of the quarter; managers decide, Vestal records.
Auditor portal
A Read-Only Door for the Person Holding the Clipboard
Invite your auditor into a scoped portal. They find the evidence, raise questions against the exact artefact and watch the request list close. Links expire, downloads are watermarked and every view is written to the log.
In your workflow: invite on the day the audit window opens; revoke on the day the report is signed.
Findings board
Every Failing Control Becomes a Finding With a Name Beside It
Failures are ranked Critical, High or Medium, grouped by resource and assigned to an owner. Select several, create tickets in bulk, or snooze a known exception for seven days with a reason on record.
In your workflow: triage on Monday, tickets land in Linear or Asana, closure is verified by the next test.
Hash-chained audit log
A Log That Cannot Be Rewritten, and Can Prove It
Every action — a test result, a revocation, an export, an auditor’s view — is chained to the one before it by hash. Export a framework-mapped report as CSV or PDF, then verify the chain end to end.
In your workflow: export at period end, attach the chain verification to the report.
Security
A Compliance Tool Ought to Be the Most Careful Thing You Own
Vestal holds the keys to your evidence, so it asks for as little as it can and keeps nothing it does not need.
Read-only by design
Connectors use scoped roles or OAuth with read permissions. Nothing is installed on your servers.
Revocable in one screen
Every grant is listed beside its scope, and any of them can be withdrawn from the same page it was given.
SSO and SCIM
On Citadel, sign-in and provisioning follow your identity provider, so leavers lose Vestal access with everything else.
Every view recorded
Staff and auditor access is written to the hash-chained log alongside your own team’s actions.
Integrations
One Hundred Connectors, Grouped by the Question They Answer
Each connector exists to answer a specific auditor question — who has access, what changed, what is encrypted — and is mapped to controls on arrival.
Reliability
Tests That Keep Running While You Sleep
A missed test is a gap in the record, so Vestal treats its own schedule as a control. Failed connector runs retry on their own, and a source that goes quiet is shown as stale with its last good reading, never silently passed.
Where each one pays off
The Audit Year, Read Against the Instruments
Onboarding
Connect systems, choose frameworks, assign control owners. Tests begin the same afternoon and the first score appears before you close the tab.
Control testsMid-year
Drift reaches the owner the hour it happens; access reviews close inside the quarter; findings are cleared by the next test.
Alerts · ReviewsAudit window
Invite the auditor, answer questions in context, and watch the request list drain without an export in sight.
Auditor portalReport signed
Export the framework-mapped report, verify the chain, revoke the portal link. The record carries straight into next year.
Hash-chained logSeven Instruments, Priced Once a Year.
Sentinel, Bastion and Citadel carry the same instruments in different quantities, from $199 a year, billed annually. Pick the one that fits the frameworks you keep.