One evidence engine
Every framework reuses the same evidence versions, independent review, journal and renewal, so evidence collected once can serve more than one framework.
Roadmap Honest status
What works today, what we are building, what comes next
Everything marked available works in the pilot today; nothing marked in development or planned should be relied on yet. We do not publish dates for unfinished work.
01 Status
Capabilities by status
Available In the pilot today
- CRA: orientation, obligation catalogue and applicability decisions, inventory and SBOM import, advisories and exploited-vulnerability feeds, guided checks, reporting preparation, policy templates
- ISO/IEC 27001: Annex A catalogue in our own words, Statement of Applicability, maturity
- GDPR: 35 requirements, applicability questionnaire, record of processing activities
- SOC 2 Type 1 and Type 2 readiness: 61 criteria, observation-period coverage
- Incidents, vulnerabilities and notifications, with optional e-mail
- Learning journey, guidance, evidence files with SHA-256, independent review, expiry and renewal
- Dashboard with denominators and auditor packet export
- Dedicated instance per customer on an OVHcloud VPS in Europe, deployed and updated by ProveStack
On request Set up with you
- On-premises installation
- AI companion: Ask AI and GRC skills, drafts for human review
In development Being built
- High availability: active and standby instances in two OVHcloud data centres, automatic failover
- Encrypted, immutable evidence vault with retention lock and SHA-256 verified on every read
- Cold archive for older and superseded evidence
- Automatic SBOM import when a release is published on GitHub
- Guided cybersecurity risk-assessment template
Planned Next
- CRA technical documentation assembly
- User information and instructions template
- Security advisory publication helper
Pilot phase: the customer deployment is proven on test environments; no customer instance is in production yet.
02 Principles
What does not change
No licensed text, no certificates
Licensed standard text is not reproduced; you need your own copy of ISO/IEC 27001. Certificates come from accredited certification bodies and SOC 2 reports from independent CPA firms. ProveStack prepares the record; it does not certify.
Shape what comes next
Pilot teams use what is available today and tell us what to build first.