SOC 2, HIPAA, PCI DSS, and ISO 27001 readiness without the $12,000/year price tag.

Watch the overview

Is your compliance platform inside your audit scope?

A 90-second walkthrough of why self-hosting keeps your compliance tooling out of your audit scope, and how one deployment covers all five frameworks.

See it before you buy

Every screen your team will actually use

Live screenshots from a running instance, not mockups. What you see is what ships on day one. Or skip the screenshots and click through the live demo yourself.

Command Center

Know your posture before your auditor does

The dashboard shows your live compliance posture score, a trend chart across every check run, and a precise count of what's passing and failing right now. The drift detection banner surfaces exactly what changed since your last run, what broke, what you fixed. When your auditor asks how controls performed across the observation window, you show them this chart. No spreadsheet. No manual assembly.

Automated Evidence

54 live checks. Mapped to SOC 2, PCI DSS, ISO 27001, HIPAA, and CMMC L1. Results in minutes.

Every check is dual-mapped: a SOC 2 Trust Services Criterion and the matching PCI DSS 4.0.1 requirement, side by side on the same row. AWS, GCP, Azure, and GitHub checks all run against your live accounts and return results in minutes. Each failing check shows both the SOC 2 criterion and the PCI requirement plus severity, so you know exactly which gaps to close first. Your auditor and your QSA each see labels they already recognize. No translation required between what you've built and what they need to certify.

The gap in the market

Vanta and Drata start at $10,000–$15,000/year and are built for Series B+ companies with dedicated security teams. Below that, teams either pay for tools they barely use or manage SOC 2 readiness through spreadsheets and manual screenshots.

Controls targets the $0–$7,500/year bracket: the team that just landed their first enterprise customer asking for a SOC 2, and needs a real tool, not a spreadsheet.

What it covers

Every check is mapped to specific AICPA TSC 2017 criteria and, where applicable, PCI DSS 4.0.1, ISO/IEC 27001:2022, HIPAA Security Rule, and CMMC L1 requirements. Findings open automatically with remediation targets, exceptions are sealed with RFC 3161 timestamps, and every attestation is independently verifiable.

See every check and control, with framework mappings → What's new →

Your data stays on your server

Controls ships as a Docker image. You run it on your own infrastructure, your own VPS, cloud account, or internal server. AWS credentials, GitHub tokens, check results, evidence files, and attestation records never leave your environment. There is no external telemetry.

Compare that to SaaS compliance platforms: Vanta and Drata connect to your AWS and GitHub accounts and store your compliance data on their servers. For teams with data residency requirements or customers who ask where your audit evidence lives, Controls gives you a clean answer: on your server.

Three self-serve tiers, monthly or annual, plus an enterprise agreement for larger deployments. No per-seat pricing, no per-check pricing, no additional charges as your team grows.

Up and running in about ten minutes

One docker-compose.yml, one command, one setup screen, read-only cloud credentials, first checks. The step-by-step setup guide walks all eight steps with video walkthroughs — including providing audit evidence and what your auditor sees.

Common questions

Is this a replacement for a SOC 2 audit?▾

No. Controls is a readiness and monitoring tool, it helps you build and demonstrate controls before and during your audit. A licensed CPA firm conducts the actual SOC 2 examination. Controls reduces the prep work and gives auditors a continuous evidence trail.

Does Controls support PCI DSS?▾

Yes. One deployment covers five frameworks with no per-framework add-on: SOC 2 (AICPA TSC 2017), PCI DSS 4.0.1, ISO/IEC 27001:2022, the HIPAA Security Rule, and CMMC Level 1. A framework filter lets you view any single framework or all of them together, and NIST CSF 2.0 and CIS Controls v8 coverage views derive from the same evidence for questionnaires. PCI coverage is scoped to SAQ A and A-EP merchants, teams that outsource card capture to a hosted payment page. Controls is a readiness and evidence tool; it does not replace a Qualified Security Assessor, an approved scanning vendor, the SAQ itself, or a CMMC C3PAO.

Where is my data stored?▾

Entirely on your own infrastructure. Controls runs as a Docker container with a SQLite database on a persistent volume. AWS credentials, GitHub tokens, check results, and evidence files never leave your server. There's no external telemetry.

Is there a free trial?▾

Your first month is the trial. Every self-serve tier is billed monthly with no annual contract, and every self-serve purchase is backed by a 30-day money-back guarantee: deploy Controls, connect your clouds, and if it doesn't work for your environment, email team@scorifya.com within 30 days for a full refund. No questions asked. One guarantee per company (per email address or registered domain); prior refunded orders aren't eligible for another. Enterprise agreements carry their own contract terms.