Compliance automation and vendor risk, one platform
Compliance automation software for SOC 2, ISO 27001 and vendor risk management
Scrutineer maps your controls to SOC 2, ISO 27001, HIPAA, GDPR and PCI, collects evidence on autopilot and flags gaps before the auditor does. Then it scores the risk of every vendor you trust.
- Read-only integrations, nothing to deploy
- Your auditor still issues the attestation
Interactive walkthrough on a sample company, not a scan of your systems.
›
Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.
Two jobs, one platform
Scrutinize any company, including your own
Most teams pay for one tool to keep themselves compliant and a second tool to vet their vendors. Scrutineer runs both sides of the desk from a single source of truth, so the same evidence that proves your posture also benchmarks everyone you do business with.
Continuous compliance, not a fire drill
Scrutineer maps your controls to every framework you carry, pulls evidence automatically from your cloud, identity, code and ticketing systems, and watches them continuously. You walk into the audit ready, and you stay ready after it.
- Auto-map controls across SOC 2, ISO 27001, HIPAA, GDPR and PCI continuous compliance
- Collect evidence on autopilot instead of chasing screenshots audit readiness
- Flag gaps in plain English before an auditor finds them soc 2 compliance
- One crosswalk so a single control satisfies many frameworks grc software
Vendor and third-party risk, scored continuously
Stop running vendor reviews in a spreadsheet once a year. Scrutineer resolves a vendor's external surface, reads its certifications, auto-answers and scores inbound security questionnaires, and monitors every third party you depend on between reviews.
- Risk-score vendors, partners and M&A targets in minutes vendor risk management
- Continuous third-party monitoring, not a yearly snapshot third party risk management
- Auto-answer inbound security questionnaires from your evidence security questionnaire automation
- Run a full vendor security assessment without the back-and-forth vendor security assessment
One platform for compliance automation and vendor risk, instead of a stack you have to reconcile by hand.
How it works
From connected to audit-ready in five steps
Scrutineer runs the whole readiness loop for you. Connect your stack once, and the platform maps, collects, watches and reports continuously, so the audit becomes a review rather than a scramble.
Connect your stack
Link cloud, identity, code, HR and ticketing. Read-only integrations pull the signal Scrutineer needs.
Map controls
Scrutineer maps what it sees to SOC 2, ISO 27001, HIPAA, GDPR and PCI, with a crosswalk across all of them.
Collect evidence
Evidence is gathered automatically and kept fresh, so you stop chasing screenshots and exports by hand.
Monitor continuously
Controls and vendors are watched year-round. Drift, stale evidence and new risk are flagged the moment they appear.
Report and share
Generate audit-ready reports and vendor scorecards your auditor, board and customers can actually read.
Frameworks and vendor risk
Map five frameworks once, prove them everywhere
The expensive part of compliance is not the audit. It is the months of manual control mapping, evidence gathering and questionnaire ping-pong before it. Scrutineer turns that work into something the platform does for you, and shows its work so you can defend every result.
- A single control crosswalk across SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS
- Evidence collected automatically and time-stamped, so it never goes stale unnoticed
- Plain-English gap remediation, ranked by what an auditor will look at first
- Inbound security questionnaires auto-answered from your live evidence
- Vendor scorecards with a letter grade, category bars and flagged findings
Interactive walkthrough on a sample company, not a scan of your systems.
›
Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.
Switch to "Assess a vendor" and score any third party you trust.
What Scrutineer actually checks
The control domains, the integrations and the report
No vague promises. These are the control domains Scrutineer maps and monitors, the systems it reads evidence from, and exactly what lands in the report you hand your auditor.
Control domains it maps
- Access control, MFA and periodic access reviews
- Change management and code-review approvals
- Logging, monitoring and alerting coverage
- Encryption in transit and at rest
- Backup, recovery and business continuity
- Incident response and on-call procedure
- Onboarding, offboarding and security training
- Vendor and subprocessor oversight
Where evidence comes from
Read-only integrations across the categories that hold your proof. You choose which are connected, and you can revoke any of them at any time.
- Cloud infrastructure and configuration
- Identity providers and SSO directories
- Source control and CI pipelines
- Ticketing and change-request systems
- HR systems for joiners, movers and leavers
- Device management and endpoint posture
What the report contains
- Readiness per framework and per control domain
- Every control linked to the evidence that proves it
- Open gaps in plain English, ranked by audit impact
- Timestamps showing when each item was last verified
- A change log of drift since the previous report
- Vendor scorecards with grades and flagged findings
Scrutineer does not issue attestations or certificates. An accredited auditor or certification body does that, and this report is what you hand them.
Pricing
Less than one GRC analyst, every month
A GRC analyst and a year of questionnaire busywork cost far more than a Scrutineer plan. Every plan is paid and enterprise-grade. Prices in USD. Annual billing is half the monthly price (save 50%), charged once a year, and monthly is one tap away. An accredited auditor still issues your attestation; Scrutineer gets you ready and keeps you ready.
Essentials
One framework, continuously
$299/mo
Billed monthly Billed annually ($3,588/yr), charged once a year
- 1 framework (e.g. SOC 2)
- Continuous control monitoring
- Automated evidence collection
- Audit-ready report
- Email support
Growth
Multi-framework crosswalk
$600/mo
Billed monthly Billed annually ($7,200/yr), charged once a year
- Everything in Essentials
- SOC 2 + ISO 27001 + GDPR and more
- Framework crosswalk
- Security-questionnaire automation
- Priority support
Risk+ (TPRM)
Add vendor and third-party risk
$1,250/mo
Billed monthly Billed annually ($15,000/yr), charged once a year
- Everything in Growth
- Unlimited vendor risk scoring
- Continuous third-party monitoring
- M&A diligence reports
- Dedicated GRC success
Enterprise
Scale, SSO and custom frameworks
$2,400/mo
Billed monthly Billed annually ($28,800/yr), charged once a year
- Everything in Risk+
- SSO and SCIM
- Custom frameworks and controls
- API and audit-firm collaboration
- Priority support with 4-hour response
No per-questionnaire fees. See full pricing and what is in every plan.
Before you start
The questions security buyers ask first
Scrutinize your whole company, and everyone you trust.
Map your controls, collect evidence on autopilot, and score your vendors continuously. Walk into the audit ready, and stay ready after it.
SOC 2 · ISO 27001 · HIPAA · GDPR · PCI · vendor risk · decision-support, not a replacement for your auditor