Compliance evidence (SOC 2, PCI DSS, HIPAA)

How it works

Every heartbeat is already normalised into the facts behind the health score: firewall state, SSH settings, open ports, certificate validity, log health, disk encryption, pending updates and so on. The compliance module maps each control of a standard onto those facts. No agent change, no second scanner, and no new data collected.

Three standards are covered: SOC 2 (12 controls), PCI-DSS v4 (12 controls) and HIPAA (10 controls). Each control on each server gets one of five results:

Score and coverage

The score is pass ÷ (pass + fail + partial) × 100. Manual and no-data controls never count toward it. Next to every score is coverage: the share of the standard’s controls that can be measured automatically. The two are always shown together so a 100 is read as "every measurable control passes", not as "certified".

Evidence and gaps

Expand a control to see its evidence lines, each in the form *label: current value (observed at snapshot time)*, so an auditor can see what was true and when. A failing control lists the gap with the same recommendation and runnable fix the health score gives, and a Run button that dispatches it through remote actions with the usual confirmation. Manual controls show To complete this control: with what to attach, for example your joiner and leaver process, which the SSH-key audit log supports.

Where to find it

• •Monitor → Compliance — the workspace view. Tabs per standard; a scorecard with the average score, servers passing, servers with gaps and the most common gap; the list of servers with gaps that drills down to every control; the top gaps across the fleet.
• •Server page → Security → Compliance — every control for that server with evidence and remediation, plus a 90-day trend of its score.

History and reports

After each heartbeat the assessment is stored as one row per server, per standard, per UTC day. Rows are kept for 400 days, long enough for a yearly audit cycle with margin. The pages themselves always recompute from the latest snapshot, so a new rule shows up immediately; the stored rows feed the trend.

Click the PDF button for the whole workspace or for one server. The report has a cover and scope, the scorecard, the most common gaps, one section per server with status, evidence, timestamps and remediation for each control, and an appendix of manual controls. Every page footer states that it is observed evidence, not a certification. Exporting a report is written to the audit log.

Plan

Compliance scorecards and PDF reports are part of the Growth plan and above. Free workspaces see the explanation and a link to plans; the list of standards is visible on every plan.