A read-only GitHub App that records branch protection, scanning alerts, and organization access as they change — maps each signal to SOC 2 and ISO 27001 controls, and exports point-in-time CSV and PDF evidence packages. It never modifies your repositories, permissions, or membership.
Evidence accrues on its own — you install the app once and pull a package whenever an auditor asks.
Webhooks record branch protection, rulesets, and scanning alerts the moment they change. An hourly cron polls for state webhooks never announce — protection that predates install, and current membership — storing each as a timestamped snapshot.
Each signal is mapped to SOC 2 and ISO 27001 controls with a plain-language rationale. Mappings apply as a join at query time, so one can be corrected without re-ingesting history.
Point-in-time CSV and PDF evidence packages, rendered off the request path via a queue. Every export reflects the exact state at the moment you asked — not just today’s.
Every mapping — and why each signal is defensible evidence for its control — is documented alongside the machine-readable version in the repo.
# 1. Install the GitHub App on your org # (read-only, least-privilege scopes) # 2. Select the repositories to cover # 3. Snapshots begin immediately # 4. Export a package whenever you need one
Read-only, by design — what it never does:
Prefer to run audits yourself? audit-report turns offline evidence packages into the same control-mapped reports.
Rather not trust our tenant? Self-host it in your own Cloudflare account — it’s a single Worker with D1 and R2. Privacy and security policies apply to the hosted instance.