Skip to content
Start free

Audit evidence from the data you already keep

Tracix maps the log retention, detection coverage, alert handling, validation runs and access reviews it already holds to selected PCI DSS v4.0, SOC 2 and ISO 27001:2022 controls. It builds evidence packs for your auditors on a schedule, hash-chained so a changed or missing pack shows up when you verify them.

Start freeBook a demoRead the security docs
  • PCI DSS v4.0 · SOC 2 · ISO 27001:2022
  • 17 controls mapped
  • Hash-chained evidence packs

Evidence packs support your own audits. They do not certify Tracix or your organization.

How it works

From the data you keep to a pack your auditor can check

Packs are built from records the workspace already holds, and frozen the moment they are generated.

  1. 01ChoosePick PCI DSS v4.0 requirements 10 and 11, SOC 2 common criteria or ISO 27001:2022 Annex A.8.
  2. 02ScheduleGenerate a pack now, or monthly, quarterly, weekly or daily, over a lookback of 1 to 400 days.
  3. 03CollectTracix reads retention policies, detection coverage, alert handling, validation runs and access reviews.
  4. 04SealThe pack is frozen, pinned by its SHA-256 hash and appended to the chain, with the state of the SOC ledger.
  5. 05ShareDownload a pack as JSON, let a GRC tool poll with an API key, or push each manifest to a webhook.
  6. 06VerifyVerification recomputes every hash and names the first pack that does not match.

Evidence packs

Each pack says what it shows, and what it could not collect

A pack holds one framework's evidence over one period: a plain statement of what the data shows for each evidence kind, the measurements behind it, and the controls it covers.

  • A source that cannot be read becomes a failed section with the reason, and the pack is marked incomplete
  • Each control states what an auditor expects the evidence to show
  • Controls you must evidence elsewhere, such as physical access, are left out rather than padded

Verification

A missing or edited pack cannot hide

Every pack is pinned by the SHA-256 hash of its content and chained to the pack before it. Verification recomputes the whole chain, so an auditor can check the trail without trusting anyone's word.

  • Content hash

    Each pack's frozen body is pinned by its SHA-256 hash.

  • Chained rows

    Each row's hash covers the one before it, back to an all-zero start.

  • Ledger state

    Each pack records whether the SOC action ledger was intact when it was built.

  • Named breaks

    A broken chain is reported at the first pack that does not match.

Schedules

Evidence on the calendar your audits keep

Schedule packs per framework, and send them where your GRC process already looks. A pack generated on schedule is recorded the same way as one you generate by hand.

  • Presets for monthly, quarterly, weekly and daily packs, or your own cron expression
  • Push each pack's manifest to your GRC tool's webhook, signed with HMAC when you add a credential
  • GRC tools can also poll the pack list with an API key

Better together

Evidence from the products that produce it

Packs read the records your detection, response and log teams already create, so the evidence is a by-product of running security, not a separate project.

Controls

The controls each pack covers

Packs cover only controls Tracix holds real data for: PCI DSS v4.0 requirements 10 and 11, SOC 2 common criteria and ISO 27001:2022 Annex A.8. Everything else in your audit you evidence elsewhere.

FrameworkControlsEvidence collected
PCI DSS 1010.2, 10.3, 10.4, 10.5, 10.7Log retention and coverage, detection coverage, alert handling, access review
PCI DSS 1111.4, 11.5Detection coverage, alert handling, validation runs
SOC 2 CC6CC6.3Access review
SOC 2 CC7CC7.1, CC7.2, CC7.3, CC7.4, CC7.5Log retention and coverage, detection coverage, alert handling, validation runs
ISO 27001 A.8A.8.2, A.8.8, A.8.15, A.8.16Log retention and coverage, detection coverage, alert handling, validation runs, access review

Each pack also records whether the SOC action ledger was intact when it was generated, as evidence that operational records are tamper-evident.

FAQ

Questions auditors and security teams ask first

Talk to a security engineer
Does Tracix itself have a SOC 2 report or an ISO 27001 certificate?
Not yet. Evidence packs support your own audits against your own controls. They describe your workspace's data and do not certify Tracix or your organization.
Will a pack make us pass an audit?
No. A pack shows what your monitoring data demonstrates for 17 specific controls. Everything else, from physical access to HR screening, you evidence elsewhere, and your auditor decides.
What happens when evidence is missing?
The pack says so. A source that cannot be read becomes a failed section with the reason, and the pack is marked incomplete instead of looking thinner than it is.
How do our GRC tools get the packs?
They can poll the pack list with an API key, or a schedule can push each pack's manifest to a webhook, signed with HMAC when you add a credential. You can also download any pack as JSON.

Generate your first evidence pack

Pick a framework and a lookback window, and build a pack from the data your workspace already holds.

Start freeRead the security docs