Audit evidence, collected in your environment
Automate evidence collection. AuditFetch collects, validates, and maps readiness evidence for SOC 2, HIPAA, and ISO 27001 directly from AWS, GitHub, Okta, and the rest of your stack*. Review the source, freshness and control links before export. It runs inside your environment. Your team controls where evidence is stored and when it is shared.
Local evidence sources: GitHub, AWS, Okta, Google Workspace, Jira, Linear, Datadog, WorkOS — all read-only. Browser-based capture is in Preview and included in every plan for approved sources without a usable API.
Local vs. Cloud
Hosted convenience when you want it. Local control when you need it.
AuditFetch Local
- Runs in your environment
- Evidence stays local
- Local credentials
- Internal systems supported
- Best for security-sensitive teams
AuditFetch Cloud — managed deployment
Selective onboarding. Managed deployments are separate from the licensing and update services used by local installations. Confirm the available capabilities and data-hosting arrangements with us before purchase.
- Managed hosting by arrangement
- Faster setup
- Managed scheduling
- Team collaboration
We'll confirm availability and scope before anything is purchased.
Custom Evidence Automation
Automate the last mile without turning compliance into custom integration work.
Built-in collectors cover common workflows. Custom Evidence Automation securely adapts reviewed read-only operations for AWS and GitHub—then sends the result through the same governed evidence lifecycle as built-in collection.
Find the last-mile gap
See which missing or manual requirement can be supported by a governed collector.
Choose a reviewed template
Start from an approved read-only operation for a supported provider—not a blank API request.
Set your scope
Set the supported resource scope for the reviewed AWS and GitHub template before testing.
Preview and test
Verify access and inspect a bounded, sanitized result before anything is enabled.
Enable deliberately
Promote the tested version only when the source, permissions, and scope are understood.
Reuse governed evidence
The artifact keeps its source, timestamp, mapping, and audit history across compatible controls and frameworks.
Designed for safe, reviewable collection
Automations use existing integration credentials and read-only scopes. With AuditFetch Local, secrets stay in your environment; hosted deployments use their configured secret store. Tests are audited, and evidence remains subject to the same provenance, review, retention, and export controls as built-in collection.
Read the practical automation guideKnow where your evidence came from
Review where evidence came from, when it was collected, and whether its stored contents have changed. Integrity checks and the audit log help reviewers trace each artifact. Your team still reviews whether that evidence supports the control.
Synthetic examples — not customer evidence or audit results.
aws_iam_users_mfa
- hash
- sha256:9f2a7c1e…
- captured
- 2026-06-20
github_branch_protection
- hash
- sha256:3d5e8b02…
- captured
- 2026-06-19
What you get
Evidence vault
Find your evidence in one place, with a record of its source and collection history.
Control mapping
Link evidence to SOC 2, HIPAA, and ISO 27001 controls. Review its scope and suitability for each requirement before reusing it.
Gap & freshness detection
A live view of which controls are covered and which need attention, before audit week.
Drift alerts
Get notified when a previously-passing configuration changes. Included in every plan.
Reviewer workflow
Human sign-off on sensitive mappings before they land in a packet. Included in every plan.
Auditor-ready packets
PDF / ZIP / CSV / JSON exports generated on demand. Vanta and Drata delivery are in Preview; Google Drive delivery is planned and unavailable in the current release.
What it connects to
Engineering
- GitHub
- Jira
- Linear
Cloud & Infrastructure
- AWS
- Datadog
Identity & Access
- Google Workspace
- Okta
- WorkOS
Browser capture
- Browser playbooksPreview
Evaluator only
- Disposable sample workspaceSample data
Compliance Destinations
- ZIP
- CSV
- JSON
- VantaPreview
- DrataPreview
Already connected to one of the reviewed providers (AWS and GitHub)? Read how to automate the last mile of compliance evidence with a reviewed, read-only template.
Evidence from the tools that have no API
Some evidence is only visible in an admin console. Browser playbooks (Preview) can capture approved pages, record the capture time, and redact selected content. Each workflow needs setup and review for the target system. API evidence first, screenshots only where the API can’t prove it.
Approved browser playbooks
Browser playbooks follow a reviewed sequence of steps in your Local installation. Use API integrations when they provide the evidence you need. Use browser capture for approved pages where API evidence is unavailable, then review the result.
Ready to stop chasing audit screenshots?
See AuditFetch pricing and get started with local-first evidence automation for SOC 2, HIPAA, and ISO 27001.