Continuous compliance evidence
The evidence your auditor asks for, collected every day, filed in the GRC you already run.
ProofLayer reads your cloud and SaaS accounts, checks them against versioned rules, hash-chains every result into an evidence manifest, and pushes it into CISO Assistant, ServiceNow or an auditor pack. It is not another GRC platform. It is the missing evidence layer for yours.
- collectedAt
- 2026-09-04T09:30:12Z
- sourceAccount
- aws · 123456789012 · ap-south-1
- collector
- aws.iam.users @ 0.9.3
- ruleId
- aws.iam.mfa-enabled @ v2
- resource
- arn:aws:iam::123456789012:user/bob
- result
- fail — console user without MFA
- maps to
- ISO 27001 A.5.17 · CERT-In A1.1 · DPDPA 8(5)
- rawPayloadSha256
- 9f2c…e41b
- prevHash
- c8a1…77d0
The gap
GRC tools are rich in workflow and poor in evidence.
Audits, risk registers, policies and approvals live in a GRC system, or in spreadsheets and a consultant. The evidence behind them is still screenshots, exported CSVs and a week of people-hours before every audit. And it goes stale the day after.
How it works
One chain, from regulation to signed result.
Every check in ProofLayer is an instance of this chain. The collectors are shared across frameworks; the mappings are the content that makes them mean something to an auditor.
Regulation
CERT-In Directions 2022The law or standard you are held to.
Requirement
D5.2 — retain logs 180 daysThe specific clause an auditor will test.
Evidence
CloudTrail log-group retentionThe artefact that proves it, defined once.
Collector
aws.cloudtrail.trailsRead-only code that fetches the facts on a schedule.
Rule
retentionDays >= 180A versioned, readable expression. Change it and you get a new version, never a silent edit.
Assessment
pass / fail + hash-chained manifestPushed into your GRC against the right requirement, with the raw payload hash.
One collector serves many frameworks: the same privileged-account listing satisfies ISO 27001 A.5.18, SOC 2 CC6.3 and RBI §5.2 at once. Adding a framework is mapping work, not code.
What we collect
Your cloud, SaaS, devices, code, people and tickets — read-only.
Not just cloud config: device/MDM posture, dependency scanning, HR evidence and change management too — the people-and-process controls that are ~40% of an audit. Hosted mode assumes a read-only role with short-lived credentials; in-account agent mode runs the collector inside your account so no credential ever leaves it.
Who it's for
Two people, two tools. That is the point.
The security engineer works in ProofLayer. The compliance manager works in the GRC. The auditor receives evidence they can verify without either of them.
Sees what is failing today, and what changed since yesterday.
- Connections, scheduled scans, findings with remediation
- “What changed” diff per run, timeline per resource
- Accepted risk with owner, reason and re-review date
- Alerts by email or signed webhook when a check starts failing
- One click turns a failing finding into a Jira or ServiceNow ticket
Opens the audit and finds the evidence already attached.
- Evidence objects created against the right requirement
- Posture per assessment: mapped, evidenced, gaps
- Single sign-on from ProofLayer into the GRC with the right role
- Nothing to re-key, nothing to screenshot
Verifies the chain instead of trusting a screenshot.
- Evidence pack per period with every manifest and raw payload hash
- Collector version, rule version, mapping version on each result
- A standalone verify.py in the pack re-walks the chain offline — no ProofLayer software, just python3
- Read-only access to CISO Assistant if they want the source
India first
Built for Indian regulated companies, with the data staying in India.
Bundled compliance suites are priced and mapped for US frameworks. Indian BFSI, fintech and SaaS companies answer to CERT-In, the DPDP Act, the RBI, SEBI and IRDAI, and often cannot send evidence abroad. ProofLayer ships those mappings and can run entirely inside your own infrastructure.
Logs kept 180 days, inside India, with clocks in sync.
- Direction 5: log retention checks across AWS, Azure and Google Cloud
- Direction 5: India-region residency of logs and storage
- Annexure I: controls that prevent the reportable incident types
Reasonable security safeguards, proven continuously.
- Section 8(5): access control, MFA, encryption, monitoring evidence
- Section 8(6): breach detection capability (GuardDuty, CloudTrail)
- Section 16: processing outside India, from region residency checks
The India BFSI stack — banking, markets and insurance, shipped.
- RBI Master Direction on IT Governance 2023, mapped to collector rules
- SEBI CSCRF 2024 and IRDAI 2023 — ProofLayer-authored libraries you can push
- Same collectors also cover ISO 27001, SOC 2 (TSC 2017) and PCI DSS 4.0.1
Trust
We hold keys to your production cloud. We designed for that.
Hash-chained, versioned evidence
Every manifest carries the SHA-256 of the raw payload and the previous manifest's hash. Rules are content with versions; a changed expression is a new version, and findings reference the version forever.
Sealed credentials, per-tenant keys
Envelope encryption with a data key per organisation, wrapped by a master key in KMS. Tokens are write-only: never shown again, never in a log, never in the browser.
Read-only, or no credential at all
Hosted collection assumes a read-only role and receives short-lived credentials. The in-account agent runs on your host with your role; ProofLayer never holds a key for it.
Row-level isolation, open GRC boundary
Every table carries the tenant and is enforced by database row-level security. Your GRC stays yours: we push through its API, deep-link into its UI, and never fork or embed it.
Where we sit
Not a suite. The evidence layer next to whatever you already have.
| You run | What you get today | With ProofLayer |
|---|---|---|
| Spreadsheets and a consultant | Evidence gathered by hand before each audit | Continuous evidence packs the consultant files, with a verifiable chain |
| CISO Assistant (open source) | A strong GRC with manual evidence upload | Evidence objects created and attached to requirements automatically; SSO and role mapping |
| ServiceNow GRC, Archer, MetricStream | Workflow-rich, evidence-poor | Automated evidence feeding the controls you already track (CSV today, native targets next) |
| A bundled compliance suite | Automation, if you move your GRC into it | Automation without moving anything |
Questions
Straight answers.
Is ProofLayer a GRC platform?
No. We do not build audits, risk registers, policies, approvals or reports. We produce trustworthy evidence and push it into the GRC you already run. If a feature would recreate something a GRC does, we do not build it.
What makes the evidence audit-ready?
Each result is an evidence manifest recording what was collected, from which account, by which collector version, against which rule version, when, with a SHA-256 of the raw payload chained to the previous manifest. The export lets an auditor verify the chain offline. Tampering breaks it.
Do you hold credentials to our cloud?
Hosted mode assumes a read-only role and exchanges it for short-lived credentials at scan time. Agent mode runs the collector inside your account and ProofLayer never receives a credential for it. Anything we do store is sealed with a key unique to your organisation.
Can we run it inside our own infrastructure?
Yes. ProofLayer ships as Docker Compose with Postgres and an S3-compatible evidence store, and can be deployed in an Indian region or on-premises, alongside CISO Assistant if you use it.
Which regulations are covered today?
ISO/IEC 27001:2022, SOC 2 (TSC 2017), PCI DSS 4.0.1, CERT-In Directions 2022, the DPDP Act 2023, the RBI Master Direction on IT Governance 2023, the SEBI CSCRF 2024 and the IRDAI Cyber Security Guidelines 2023. Mappings other than ISO 27001 are marked draft until a compliance professional has reviewed them.
Do you use AI, and does it invent evidence?
AI is optional, off by default, and never authors evidence. Turn it on and it drafts auditor narratives, maps requirements to rules, answers plain-language questions over your findings and suggests fixes — all grounded in your own manifests, cited back to them, and reviewed by a human before use. You bring your own model (Azure OpenAI, Claude, a self-hosted model or a gateway); the key is sealed per organisation and inference stays in the region you choose.
What does a pilot look like?
Four weeks. We connect one cloud account read-only, run scans on your cadence, push evidence into your GRC or a CSV pack, and hand your auditor one evidence pack. You measure the hours saved; we measure what the auditor accepted.
Get started
Start with one account and your next audit.
Connect one cloud account read-only, run the first scan in minutes, and push evidence into your GRC or an auditor pack.
Sign in to your organisation
This deployment is invitation-only. Sign in with your work email, or ask your administrator for an invitation.