Compliance Yoke

The Compliance Yoke turns audit readiness into everyday work. It ships SOC 2 first but is framework-agnostic — your controls, criteria, and evidence are data, so the same engine carries other frameworks over time. It installs ready to use, with a populated SOC 2 / SCF starter crosswalk so you can see the model immediately and refine it to your environment.

How it works: map your controls to criteria

Compliance frameworks define criteria — what an auditor tests against. You define your own controls and map each to the criteria it satisfies. The Compliance Yoke makes that mapping first-class:

• Criteria — the framework's units (for SOC 2, the AICPA Trust Services Criteria — CC1–CC9 plus Availability). These are the fixed reference.
• Controls — your organization's controls, each with an owner, status, and whether it's automated or manual.
• Mappings — every control-to-criterion link carries a relationship type (subset, intersects, equal, superset), so cross-framework coverage is auditable rather than approximate. One control can satisfy many criteria — map once, cover many.

Finding → Corrective Action → Evidence → Verify

When a control falls short, you open a finding and drive it to closure with a corrective action:

• Corrective Actions — a board moving from Identified → Assigned → In Progress → Evidence Submitted → Verified → Closed.
• Evidence — attach the proof (a config export, a policy document, an attestation). A corrective action can only be verified once its evidence is attached — sign-off is a privileged step.
• Findings — the open gaps, each tied to a control and a criterion, with a severity.

Evidence connectors (read-only)

Connect your stack and the Yoke runs checks continuously, appends an immutable result history, and opens a corrective action automatically when a control drifts out of compliance (auto-resolving when it recovers):

• GitHub — organization 2FA enforcement and repo posture, via a read-only GitHub App installation.
• Fly.io — platform encryption-at-rest and infrastructure posture.
• WorkOS — SSO / directory MFA enforcement.
• AWS — a cross-account, read-only SecurityAudit role assumed via STS. No static keys ever leave your account: you create a role with the AWS-managed SecurityAudit policy whose trust policy allows our platform account plus a one-time ExternalId we generate for you (shown when you connect). We assume that role for short-lived, read-only credentials at check time — a leaked role ARN alone is useless. AWS checks cover encryption defaults (EBS/S3/RDS), S3 public-access block, CloudTrail logging, and root account security.

Manual evidence & expiry reminders

Not everything is automatable. Policies, security-training records, penetration tests and board minutes are manual evidence: upload and attest them with an expiry date. When an attestation is lapsing (or lapsed), the Yoke raises the same finding → corrective-action path as automated drift, and re-attesting fresh evidence resolves it automatically.

Registers

Four framework-as-data registers ship seeded from a real SOC 2 program and map to your controls: Policies, Personnel, Vendors, and Risks.

Auditor evidence room

Open an engagement for your audit period and invite your CPA as a read-only, time-boxed auditor (a seeded Auditor role; revoke by removing the membership at the end). Within the engagement the auditor sees, scoped to the period:

• each control's current status, mapped criteria, and linked findings/actions;
• the immutable, date-ranged check-result history per control (the chain of custody);
• reproducible population samples (onboarding/offboarding/change/access review) — the same seed always yields the same sample.

Export OSCAL assessment-results (SAR) + plan-of-action-and-milestones (POA&M) JSON, or a per-control evidence package zip. The product produces the inputs to the examination — your CPA authors the opinion; we never fabricate a test conclusion.

Trust Center (public, opt-in)

Turn on a public posture page at a slug you choose. It shows a readiness summary, your subprocessor list, and policy titles — and nothing else: no raw evidence, findings, or PII. It's off until you enable it.

Questionnaire AI (opt-in, draft-only)

With AI enabled, draft questionnaire answers grounded only in your control library, with cited control ids. If there's no relevant evidence it says so without inventing an answer, and every output is a draft for human review — it never auto-publishes or signs off a corrective action.

Getting started

Install the Compliance Yoke from the marketplace. It is a paid, recurring app — your operator configures the subscription. On install you get the SOC 2 starter crosswalk, sample findings, and corrective actions across every lane, ready to adapt.