Platform
Six tools that share one set of controls.
Controls, evidence, policies, vendors, access reviews and your trust center all read from the same control library, so a fix in one place shows up everywhere it counts.
See it with your stackProduct tour
Controls
Every control, tested and owned
A single list of the controls in scope, each with its tests, owner and current status. Statuses come from live checks against your systems, not from a checkbox someone ticked in March.
- Hourly tests across cloud, identity, code and devices
- Owners and due dates on every control
- One control satisfies several frameworks at once
- Exceptions recorded with a reason and an expiry
| ID | Control | Tests | Status |
|---|---|---|---|
| AC-04 | Role-based access with least privilege | 6/6 | ✓ Passing |
| CR-01 | Data encrypted at rest | 9/9 | ✓ Passing |
| LM-03 | Log retention for twelve months | 3/4 | ▲ 1 bucket at 90 days |
| AC-06 | Access removed within one business day | 4/5 | ✕ 1 account open |
| CM-01 | Peer review before production changes | 2/2 | ✓ Passing |
| VD-03 | Yearly review of critical vendors | 11/12 | ▲ Due in 9 days |
Evidence
Evidence with a timestamp, collected for you
Wardline pulls configuration snapshots, review records and tickets from your tools as they happen, and files them against the right control for the audit's observation period.
- Automatic collection from connected tools
- Manual uploads with reminders when they go stale
- A complete trail for the whole observation period
- Auditor-ready export, organized by control
-
· 09:12 ET
Production access review completed
42 accounts reviewed by Platform lead, 3 removed. Signed export attached.
-
· 16:40 ET
Snapshot collected from Passgrove
Users, groups and MFA status at the start of the review.
-
· 10:05 ET
Reminder sent to 2 reviewers
Review due within 5 business days of quarter start.
-
Previous review on file
Kept with its timestamp for the audit's observation period.
Policies
Policies people actually read and sign
Start from 22 editable policy templates written in plain English, adapt them to how you work, get them approved and track acknowledgments from every employee.
- 22 policy templates to adapt, not adopt blindly
- Version history and named approvers
- Acknowledgment tracking with reminders
- Yearly review dates that roll forward
4. Access reviews
4.1 System owners review user access to production systems every quarter and record the result in Wardline.
4.2 Access no longer needed is removed within one business day of the review.
Approval
Approved by CTO
Acknowledged
132 / 140
8 reminders scheduled
Vendor risk
Know which vendors touch which data
Keep an inventory of every vendor, tier them by the data they handle, send questionnaires and file their reports and agreements where your auditor will look.
- Risk tiers based on data and access
- Security questionnaires and report reviews
- Data processing and business associate agreements tracked
- Yearly reviews scheduled for critical vendors
- Cloud hostingTier 1 · report reviewed✓ Passing
- Payroll providerTier 1 · review due▲ Due soon
- Analytics SDKTier 2 · DPA missing✕ DPA missing
- Design toolTier 3 · no customer data✓ Passing
Access reviews
Access reviews in an afternoon, not a week
Wardline builds each quarterly review from your identity provider and HR system, flags leavers and dormant accounts, and saves the signed decisions as evidence.
- Reviews built from live identity data
- Leavers matched to HR events automatically
- Keep or remove decisions in one click
- Removal tickets opened in your tracker
- a.amesburyAdmin · last used 2 days agoKeepRemove
- j.tranRead-only · last used 71 days agoKeepRemove
- svc-backupService account · owner: SREKeepRemove
- r.kadeLeft the company · HR event matched✕ Remove today
31 of 42 decided · reviewer: Platform lead · signed export saved as evidence
Trust center
Answer security questions before they're asked
Publish a trust center with live control status, subprocessors and documents. Gate reports behind an NDA and approve requests from one queue.
- Live control status from your Wardline tests
- Gated documents with a click-through NDA
- Access requests with work-email checks
- Questionnaire answers reused from a library
Kelvara Trust Center
✓ 19 of 20 passingSOC 2 Type II
Request report
PCI DSS
Attestation on file
Subprocessors
9 listed
- Encryption at rest✓ Passing
- MFA for all employees✓ Passing
- Vulnerability remediation▲ Monitoring
3 access requests waiting · NDA signed automatically
Who it's for
Built for the four groups who live with compliance.
-
Security leads
One view of every framework, owner and deadline, with the reports leadership asks for.
-
Engineers
Failing checks arrive as tickets with the exact setting to change, not a spreadsheet row.
-
Auditors
A read-only workspace with every control, test and document, sorted the way auditors work.
-
Leadership
A monthly summary of readiness, risks and open findings that fits on one page.
Access we ask for
Read-only by default, and we show our own work.
A compliance tool that needs admin keys to your cloud would be a strange way to reduce risk. Wardline asks for the narrowest read-only roles each integration supports.
See Wardline's own trust center| Integration type | Access | Writes |
|---|---|---|
| Cloud infrastructure | Read-only audit role | None |
| Identity and SSO | Directory and log read | None |
| HR and people | Employee status read | None |
| Ticketing | One project you choose | Creates remediation tickets |
| Code and CI | Settings and metadata, never source code | None |