FAQ

Short answers to the questions people ask first. The guide has the details.

Which frameworks are included?#

SOC 2 (all five trust services criteria), ISO 27001, HIPAA, GDPR, PCI DSS, NIST CSF, CMMC Levels 1 and 2, CIS Controls, CSA STAR, Cyber Essentials, ISO 27017, ISO 27018, ISO 27701, ISO 42001, TISAX, Microsoft SSPA, DORA, CCPA, PIPEDA, DPDP and FCRA. They share one set of controls, so evidence for one counts toward the others. The frameworks lists each one's requirements.

How does evidence get in?#

Through integrations (28 with their own API driver, the rest through SCIM or uploaded exports), a device agent for macOS, Linux and Windows, scheduled CSV or JSON imports, webhooks and a developer API. People can also upload evidence by hand against a control.

What happens when a check fails?#

It opens a task for each failing person, device or system, assigned to an owner with a deadline from the check's SLA. The task goes from due to critical as the deadline nears, and to failing once it passes. If a gap is accepted, record an exception with an expiry date instead.

Can we change the controls and policies?#

Yes. Frameworks, controls and checks are YAML files you can edit, and policies start from templates that you version, send for approval and ask staff to accept.

Where does our data live?#

On your server. ProofTrail is self-hosted: it runs as one Docker image, with SQLite for the data, the queue and the cache, so there is no other infrastructure to run. The only thing it sends out is a daily license check.

What does it cost?#

$20 a year per installation, with a production and a staging server per key and no limit on users. Pricing has the details.

Is the code open?#

You can read and change it: ProofTrail is published under the Elastic License 2.0. It isn't open source in the OSI sense, because the license doesn't allow offering ProofTrail as a hosted service or removing its license check.