Stop rebuilding the same SOC 2 evidence pack for every client
EvidenceVault turns an auditor's PBC list into control-mapped requests, matches the evidence you already hold, flags what is missing, and exports the packet. One workspace per client, isolated at the database.
A senior engineer replies within one business day.
- PBC list in
- Mapped to controls
- Evidence matched
- Gaps flagged
- Audit packet out
Why this exists
Compliance consultants and vCISOs manually turn messy auditor request lists and evidence files into control-mapped checklists, gap analyses, narratives, and audit packets.
EvidenceVault ingests PBC requests and evidence, maps them to controls, flags gaps, drafts narratives, and exports audit-ready PDF packets for consultants managing many client companies.
What it does
Everything EvidenceVault handles for you.
PBC-to-control analyzer
Turns raw auditor request text into structured, deduplicated, SOC 2 control-mapped requests.
Tenant-isolated consultant workspace
Organizations, clients, engagements, PBC items, evidence, matches, narratives, subscriptions, and RLS tenant isolation.
Evidence matching and gap flags
Uploads PDF/DOCX/text evidence, extracts text, matches it to controls, and records confidence, rationale, and gaps.
Narratives and PDF packets
Drafts audit narratives and exports branded audit packet PDFs with @react-pdf/renderer.
What you get
Concretely, what lands.
Not adjectives — the things that exist afterwards that did not exist before.
- A control-mapped, deduplicated request list generated from the auditor's raw text instead of retyped.
- Every client in its own tenant, isolated by Postgres row-level security rather than by a column you have to remember to filter on.
- A branded, audit-ready PDF packet with the narratives drafted and the gaps named.
How it works
From nothing to working.
Paste the request list
The analyzer reads the auditor's PBC text as written — numbered, prose, or copied out of a spreadsheet — and turns it into structured requests mapped to SOC 2 controls.
Upload what you already have
PDF, DOCX or plain text. Text is extracted and matched against the mapped controls, with the confidence and the reasoning recorded rather than hidden.
Work the gaps
What is unmatched is the gap list. It is the part of the engagement that needs a human, and it is the only part you have to look at.
Export the packet
Narratives are drafted per control and exported as a branded PDF packet you hand to the auditor.
Who it's for
Built for these people.
If you are not one of them, we will say so rather than sell you a seat.
- Compliance consultants and fractional CISOs managing SOC 2 / ISO 27001 evidence across clients
- MSPs and advisory firms that need repeatable client evidence collection
- Internal teams proving multi-tenant AI workflow depth
Why it holds up
What we can show you.
No logos and no usage numbers. These are things that are true about the software itself.
87/87 engine tests green across the latest handoff verification.
Multi-tenant workspace with Postgres row-level isolation and repository-level org scoping.
Extract-to-match-to-narrate-to-PDF pipeline for evidence packets.
Before you ask
The questions that come up.
No. Isolation is enforced by Postgres row-level security and again at the repository layer, so it does not depend on a query being written correctly. Organizations, clients and engagements are separate objects, and evidence belongs to one engagement.
No, and it should not. It maps requests to controls, matches evidence, and records its confidence and reasoning so a consultant can check the work. The judgement stays with the consultant — that is who signs.
SOC 2 and ISO 27001 are what it is built around today. If you need another framework mapped, that is a scoping conversation rather than a setting.
Ask. It ships as Docker behind Caddy, so a self-hosted deployment is realistic, but we price it per engagement rather than from a page.
Tell us what you'd use it for.
A few lines is enough. A senior engineer reads it and replies within one business day — and says straight away if it isn't a fit.
Or email contact@caffinix.com. We sign a mutual NDA before scoping if you need one.
Built on·Next.js 16 · Postgres + RLS · Drizzle · Heimdall LLM gateway · Docker · Caddy
← All products