A fly on the wall
of every system you run.

Tell Certifly which system decides who works here. Anyone gone from it but still active in GitHub, Slack or AWS is orphaned access, critical when the account is an admin. Suspensions get a grace period first, so somebody on leave is not a fire.

Accounts are correlated into people from what the providers report. Each link shows the value that made it, a wrong one can be separated, and a GitHub handle with no email can be joined to its owner by hand.

A review snapshots every live account, and each one is kept or revoked with a reason. A revoked account reads awaiting removal until an import sees it gone. The CSV your auditor gets says who decided, when, and when removal was confirmed.

The access path: the account, the group it is in, the rule that put it there, and the role at the end, drawn as a graph with every route listed.

Every version is kept, and a published one can never be edited. Each member presses I have read and accept, a new version asks again, and the acknowledgments export to CSV. Existing PDFs import as drafts.

SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF and NYDFS Part 500 map through common controls to yours. Each requirement reads failing, not covered, automated, performed, evidenced, attested or not applicable. You get the breakdown, not a percentage.

Manual controls run on a schedule. A period that ends with nothing recorded opens a deficiency on its own. Operating tests sample performances from a recorded seed, and a deficiency closes only on a passing retest.

Open a Type I or Type II audit period and issue a read-only link with an expiry. Every view is logged. Export the control matrix, an evidence pack, or OSCAL.

Evidence has an owner, a renewal cadence and a file. Thirty days before it lapses a reminder goes out, and when it does, the requirements it covered go back to not covered.

Findings route to a Linear team or a Jira project by severity and system. Marking the issue done makes Certifly re-check the setting. The finding closes only when an import sees the fix, and if it doesn’t, the issue is reopened.

An exception needs a reason and a review date, recorded under the name of whoever made it. Require a second approver for any severity. Nobody can approve their own, and an expired exception counts again.

Every import is versioned and rendered as readable text, so a changed policy reads as three changed lines. Diff any two versions beside the provider’s own admin log for the time between them.

Every line of an import’s run log is hash-chained to the one before, and the chain is sealed when the run ends. The export says whether the log is complete and unaltered.

A CNAME to a deleted app or S3 bucket, an address in AWS, Google Cloud or DigitalOcean you no longer hold, a subdomain delegated to nameservers that don’t serve it. Hostnames come from certificate transparency logs and from your DNS hosts’ zones, checked hourly.

Point your DMARC rua at Certifly and see every sender and how much of its mail is aligned. Once 98% has passed for fourteen days, it tells you to enforce. Reports are accepted only from senders that pass DMARC themselves.

Every record change is kept with before and after. Changes to nameservers, MX or the apex alert Slack or your webhook, and when AWS recorded the edit, the change says who made it.

Okta, OneLogin, Entra ID, Google Workspace, JumpCloud or any OpenID Connect provider. Require it, map groups to roles, and end sessions with Okta Universal Logout. Admins keep a break-glass way in, and every use is recorded and alerted.

The audit log records every change to sign-on, access, members, integrations and domains, with who made it and from which address. Nobody can edit or delete an entry, Certifly included.

AI is off until an admin turns it on. The assistant reads only what the person asking could already see, never changes anything, and is never sent credentials. Bring your own Anthropic key if you’d rather.

Validate connection re-tests every permission and names the one that went missing, with the command to grant it filled in. Credentials are write-only once saved.