CEDX Compliance · IT & Security
CEDX Compliance keeps a library of 320 controls mapped to eight frameworks, scores each one, ages the evidence behind it, and puts the gaps in a queue with owners — so an audit is a query, not a project.
The framework cards are honest about the shape of the work: SOC 2 at 84% with 11 gaps, PCI DSS at 68% with 12. Zero frameworks are near-ready, and the card says zero.
Runs on demo data — Northline is the software's sample tenant, not a customer, and its readiness scores are the demo's own.
What it is
The library lists code, control, domain, status, the frameworks it maps to, owner and evidence age: a break-glass procedure passing with 95-day-old evidence, a code-review control failing, an encryption-in-transit control never tested.
Each program shows readiness, control count, gaps and the next audit date: SOC 2 Type II at 84% with its audit on 2026-11-01, PCI DSS v4.0 at 68% due 2026-10-20, ISO 27701 not started at 62%.
The compliance agent chased a fresh MFA coverage export (evidence age 112 days, down to 2), nudged an owner on a 34-day-overdue review, and drafted dual-approval enforcement for the change pipeline. Four actions sit pending a human's approval.
Product tour
Not a mockup and not a concept deck. This is what opens at /app/compliance.
01 — Overview
173 of 320 controls ready, 18 high-gap controls, 70 failing continuous monitors, 104 fail-or-partial with 43 never tested. The readiness bars per framework carry their gap counts — 84% SOC 2 means 11 gaps, not a grade.
02 — Gaps
151 scored gap rows: clock sync failing with evidence 136 days old, logical access controls at 112 days, red-team findings at 167. Each row offers the agent's draft — and the draft waits for you.
03 — Frameworks
The same 320 controls roll up differently per program: 98 controls into SOC 2 Type II, 93 into ISO/IEC 27001:2022, 54 into PCI DSS v4.0, 42 into the HIPAA Security Rule. Status and owner per program, on the row.
04 — Controls
Search by code, title or owner and read the library directly: board reporting passing on 1-day-old evidence, subprocessor inventory untested, privileged-session recording partial. The library is the product; everything else is a view of it.
Who runs it
Roles, not references. We have no named customers yet, so nobody in these photographs is quoted, credited or claimed as one.
Owns the framework packs and the audit dates — the 77% weighted readiness and the zero near-ready card are theirs to move.
frameworks · 8
Keeps their controls' evidence fresh — a 34-day-overdue review is a nudge from the agent, not an audit finding.
stale evidence · 65
Reads the failing tests on the change pipeline and approves — or dismisses — the agent's drafted remediation.
pending approvals · 4The shape of it
Every figure below is legible in the captures above. Nothing here is a claim about any real organisation — it is the state of the demo data.
How it runs
A control enters the library and maps to the frameworks that cite it — one row, up to four programs.
Continuous monitors test the control and the status lands: pass, partial, fail — 70 monitors are failing today, and each failure is a gap with an owner.
Evidence attaches with a date; at 90 days it is stale and the count moves — the agent chases fresh exports and nudges owners before the audit does.
Remediation is drafted with its projected gap impact — dual-approval on the change pipeline projects roughly 18 points — and a human applies it or dismisses it.
One record
A control is only testable if the thing it governs exists as a record — the grant, the rotation job, the restore test. Those records are the estate.
Logical-access controls test against the same grant and review records Access keeps — the MFA coverage export the agent chased is one of them.
CEDX VaultRotation SLAs and never-rotated keys are control evidence with dates — the 134 past-SLA secrets are gaps in both products, once.
CEDX BackupRestore-test freshness is a dated artefact the recovery controls cite — the 45-day-stale test is the evidence, not a story.
CEDX EndpointPatch lag and sensor coverage feed configuration and vulnerability controls from the scored fleet, row for row.
Limits
Finding this out on the third call is worse for you than reading it here, and worse for us.
Start
Open it right now
Your controls, your frameworks
Compliance with the rest of it
Questions
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/compliance. It runs on demo data — Northline is the sample tenant.
No, and this page does not claim otherwise. The product tracks controls, gaps, evidence age and readiness against framework requirements — the attestation is an auditor's, and the work is yours. The demo's own cards show 0 of 8 frameworks near-ready, which is the honest shape of most programs.
It chases evidence (a fresh MFA coverage export arrived, ageing 112 days of staleness down to 2), nudges control owners on overdue reviews, proposes control-to-framework mappings, and drafts remediation with a projected gap impact. Every proposal waits for a human to approve or dismiss.
Each control maps to the frameworks that cite it — the same logical-access control feeds SOC 2, ISO 27001 and others from one row, with its evidence age shared. Readiness is then weighted per program, not averaged.
No certification claim is made here or on this page. What we can evidence about hosting, encryption, tenant isolation and production access is written up on the security page.
Live build, demo data, no card. Then ask how old your oldest piece of evidence is.