Compliance automation
Connect AWS, GitHub, Microsoft 365, Cloudflare, PostgreSQL and Slack. ComplyWard reads their live configuration, checks it against ISO 27001, SOC 2, GDPR, HIPAA and PCI DSS, and tells you exactly what is failing — with the evidence attached.
Verify your email, name your organisation, pick your frameworks. No payment details at signup.
6 connectors · 38 checks · per-resource results
Each failure opens a finding carrying the affected resource and the raw result it was judged on.
Frameworks in the catalogue
Enrol in one or several. Controls are shared across frameworks, so a system you connect once counts toward every framework it satisfies.
What it actually checks
This is not a questionnaire. ComplyWard authenticates to the systems you already run, reads their real configuration, and maps each result to the controls it satisfies or fails — across every framework you have enrolled in.
Root-account MFA, and MFA on every user with console access. IAM password policy minimum length of 14. Customer-managed policies that grant administrative privileges. Account-level S3 public access blocks. CloudTrail multi-region logging and log-file validation. GuardDuty. EBS volume and RDS storage encryption. Security groups open to the internet. KMS key rotation. Backup plans.
TLS enabled. No trust lines in pg_hba. SCRAM authentication. Connection logging. pgaudit installed. Superuser count. Whether your major version is still supported by the community.
Per zone: Always Use HTTPS, minimum TLS version at 1.2 or higher, DNSSEC, WAF managed rulesets, and rate limiting rules.
Conditional access policies that require MFA. Legacy authentication blocked. How many Global Administrators you actually have. Enabled accounts nobody has signed into for 90 days. Unified audit log.
Two-factor authentication required across the organisation. Branch protection on every repository's default branch. Dependabot alerts enabled. A Gitleaks scan of your repository history, not just the current tree.
Workspace-wide two-factor enforcement, which is readable on every plan. App approval, session duration and public file sharing, where an Enterprise Grid admin token exposes them.
Each connector asks for read-only credentials with specific, documented permissions, and what you paste is encrypted at rest with AES-256-GCM. Checks your plan or token scope does not expose are marked not applicable and fall back to manual evidence rather than being scored as passes.
How it works
Paste read-only credentials for the systems you run. ComplyWard runs a live connection test before it stores anything, then discovers what is in each account: repositories, zones, databases, people.
Every mapped control is checked against reality. Failures come back per resource, with the finding, the affected resource and the raw result it was judged on — not a red mark.
Each open finding gets a drafted remediation recommendation for you to accept or dismiss. Accept one and it becomes a tracked task you can assign. Policies your frameworks require are drafted for a human to review and approve.
Generate a per-framework audit package: control matrix, findings, the evidence collected per control, your approved policies, and a manifest listing every file in the ZIP with its SHA-256 hash and byte size.
Before you sign up
Select frameworks, connect systems, run the gap assessment and remediate to audit-ready, in a simulation of the real product. It asks for no account and no email address.
The obvious questions
No. The checks above run against live APIs and return a result per resource: this repository has no branch protection, this security group is open to 0.0.0.0/0, this database still allows trust authentication. Readiness is computed from your last completed assessment, weighted per control. Where no automated check covers a control, readiness falls back to the status your team recorded for it — half weight for implemented, full weight only for verified.
Connecting a system is a credentials-and-permissions job, not an integration project: create a read-only role or a scoped token, paste it, and ComplyWard runs a live connection test and tells you straight away if the scope is wrong. You do not have to connect everything to start. After that, the work is the remediation itself, which is work you would be doing anyway. What you do not do by hand is the control matrix, the evidence chase, or the audit package.
We will not speak for your auditor. What we can tell you is exactly what they receive: a versioned ZIP per framework holding the control matrix with every control's status, the open findings from your last completed assessment, the evidence collected per control, your approved policies, and a manifest.json listing every file with its SHA-256 hash and byte size, so the package can be integrity-checked.
Second service, same portal
ComplyWard also runs expert-led penetration tests of your web applications, external perimeter and cloud configuration. Findings are published to your portal as testing progresses rather than arriving as a PDF weeks later, and each one is mapped back to the controls it affects — so a tester's finding and a failed automated check sit in the same record. One retest is included, within 30 days of report delivery.
Create an account, connect the first thing you run, and see what a real assessment says about it. You do not have to connect everything to learn something.
Verify your email, name your organisation, pick your frameworks. No payment details at signup.