Features
Readiness in a box: the four pieces, each one real.
30-control checklist
Mapped to the Trust Services Criteria (Security CC6–CC8, Availability A1 basics for a micro-startup Type I). Each control carries the exact evidence artifact an auditor will ask for.
12 policy templates
Information security, access control, incident response, and nine more — pre-written, copied into your workspace to customize.
Evidence tracker
Upload proof per control; status flips to evidenced; the readiness score (evidenced/total) updates live.
Readiness scoring
One number the whole team can see: e.g. 21/30 (70%). No vanity metrics.
HTML report
A readable readiness report with per-control status and evidence on file — customer-controlled text is HTML-escaped.
Auditor handoff pack
One zip: the report, a machine-readable evidence index, every evidence file, and all policies — with open gaps disclosed honestly.
Re-init protection
Re-running init on a live workspace refuses to wipe it unless you pass --force. Your evidence index is never silently destroyed.
Type II + Vendor Risk (upper tiers)
Type II operating-effectiveness log (dated evidence over time) on the plus tier, and a vendor-risk module — inventory, risk tiering, customer-data flags, review-due dates — on the vendor tier. Both are plan-gated in the hosted service.