Compliance automation and vendor risk, one platform
Compliance automation software for SOC 2, ISO 27001 and vendor risk management
Scrutineer maps your controls to SOC 2, ISO 27001, HIPAA, GDPR and PCI, collects evidence on autopilot, and flags gaps before the auditor does. Then it scores the risk of every vendor you trust. Scrutinize any company, including your own.
›
Illustrative sample · not an audit attestation
Two jobs, one platform
Scrutinize any company, including your own
Most teams pay for one tool to keep themselves compliant and a second tool to vet their vendors. Scrutineer runs both sides of the desk from a single source of truth, so the same evidence that proves your posture also benchmarks everyone you do business with.
Continuous compliance, not a fire drill
Scrutineer maps your controls to every framework you carry, pulls evidence automatically from your cloud, identity, code and ticketing systems, and watches them continuously. You walk into the audit ready, and you stay ready after it.
- Auto-map controls across SOC 2, ISO 27001, HIPAA, GDPR and PCI continuous compliance
- Collect evidence on autopilot instead of chasing screenshots audit readiness
- Flag gaps in plain English before an auditor finds them soc 2 compliance
- One crosswalk so a single control satisfies many frameworks grc software
Vendor and third-party risk, scored continuously
Stop running vendor reviews in a spreadsheet once a year. Scrutineer resolves a vendor's external surface, reads its certifications, auto-answers and scores inbound security questionnaires, and monitors every third party you depend on between reviews.
- Risk-score vendors, partners and M&A targets in minutes vendor risk management
- Continuous third-party monitoring, not a yearly snapshot third party risk management
- Auto-answer inbound security questionnaires from your evidence security questionnaire automation
- Run a full vendor security assessment without the back-and-forth vendor security assessment
One platform for compliance automation and vendor risk, instead of a stack you have to reconcile by hand.
How it works
From connected to audit-ready in five steps
Scrutineer runs the whole readiness loop for you. Connect your stack once, and the platform maps, collects, watches and reports continuously, so the audit becomes a review rather than a scramble.
Connect your stack
Link cloud, identity, code, HR and ticketing. Read-only integrations pull the signal Scrutineer needs.
Map controls
Scrutineer maps what it sees to SOC 2, ISO 27001, HIPAA, GDPR and PCI, with a crosswalk across all of them.
Collect evidence
Evidence is gathered automatically and kept fresh, so you stop chasing screenshots and exports by hand.
Monitor continuously
Controls and vendors are watched year-round. Drift, stale evidence and new risk are flagged the moment they appear.
Report and share
Generate audit-ready reports and vendor scorecards your auditor, board and customers can actually read.
Frameworks and vendor risk
Map five frameworks once, prove them everywhere
The expensive part of compliance is not the audit. It is the months of manual control mapping, evidence gathering and questionnaire ping-pong before it. Scrutineer turns that work into something the platform does for you, and shows its work so you can defend every result.
- A single control crosswalk across SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS
- Evidence collected automatically and time-stamped, so it never goes stale unnoticed
- Plain-English gap remediation, ranked by what an auditor will look at first
- Inbound security questionnaires auto-answered from your live evidence
- Vendor scorecards with a letter grade, category bars and flagged findings
›
Illustrative sample · not an audit attestation
Switch to "Assess a vendor" and score any third party you trust.
What Scrutineer actually checks
The control domains, the integrations and the report
No vague promises. These are the control domains Scrutineer maps and monitors, the systems it reads evidence from, and exactly what lands in the report you hand your auditor.
Control domains it maps
- Access control, MFA and periodic access reviews
- Change management and code-review approvals
- Logging, monitoring and alerting coverage
- Encryption in transit and at rest
- Backup, recovery and business continuity
- Incident response and on-call procedure
- Onboarding, offboarding and security training
- Vendor and subprocessor oversight
Where evidence comes from
Read-only integrations across the categories that hold your proof. You choose which are connected, and you can revoke any of them at any time.
- Cloud infrastructure and configuration
- Identity providers and SSO directories
- Source control and CI pipelines
- Ticketing and change-request systems
- HR systems for joiners, movers and leavers
- Device management and endpoint posture
What the report contains
- Readiness per framework and per control domain
- Every control linked to the evidence that proves it
- Open gaps in plain English, ranked by audit impact
- Timestamps showing when each item was last verified
- A change log of drift since the previous report
- Vendor scorecards with grades and flagged findings
Scrutineer does not issue attestations or certificates. An accredited auditor or certification body does that, and this report is what you hand them.
Pricing
Less than one GRC analyst, every month
A GRC analyst and a year of questionnaire busywork cost far more than a Scrutineer plan. Every plan is paid and enterprise-grade. Prices in USD, billed annually. An accredited auditor still issues your attestation; Scrutineer gets you ready and keeps you ready.
Essentials
One framework, continuously
$599/mo
- 1 framework (e.g. SOC 2)
- Continuous control monitoring
- Automated evidence collection
- Audit-ready report
- Email support
Growth
Multi-framework crosswalk
$1,200/mo
- Everything in Essentials
- SOC 2 + ISO 27001 + GDPR and more
- Framework crosswalk
- Security-questionnaire automation
- Priority support
Risk+ (TPRM)
Add vendor and third-party risk
$2,500/mo
- Everything in Growth
- Unlimited vendor risk scoring
- Continuous third-party monitoring
- M&A diligence reports
- Dedicated GRC success
Enterprise
Scale, SSO and custom frameworks
Custom
- Everything in Risk+
- SSO and SCIM
- Custom frameworks and controls
- API and audit-firm collaboration
- Named success team
No per-questionnaire fees. See full pricing and what is in every plan.
Before you start
The questions security buyers ask first
Scrutinize your whole company, and everyone you trust.
Map your controls, collect evidence on autopilot, and score your vendors continuously. Walk into the audit ready, and stay ready after it.
SOC 2 · ISO 27001 · HIPAA · GDPR · PCI · vendor risk · decision-support, not a replacement for your auditor