Auditee
The team being audited.
My Tasks4 open
Today
in 2d
in 5d
in 8d
My Tasks queue, sorted by due date
Upload evidence, draft once, submit when ready
Reply to auditor questions inline
One workspace for every framework
Run your compliance program like an engineering team.
SentinelPanda unifies COBIT 2019, HIPAA, ISO 27001, ISO 42001, NIST CSF, PCI DSS, and SOC 2 into one auditable workspace — with live evidence collection, three-role audit workflow, and one-click ROC, AOC, and SAQ reports.
COBIT 2019HIPAAISO 27001ISO 42001NIST CSFPCI DSSSOC 21,330 controls · 7 frameworks
app.sentinelpanda.com/workspace/acme-fintech/compliance-health
v4.0.1Workspace overview
Compliance Health
Overall
72%
+4 this week
Open risks
5
2 high · 3 med
Nonconformities
5
3 open · 2 in review
Calendar
4
next 30 days
Compliance by requirement group
Implemented At risk
Build & Maintain a Secure Network84%
Protect Account Data71%
Vulnerability Management Program62%
Strong Access Control78%
Regularly Monitor & Test Networks44%
Information Security Policy91%
02 · The three sides
Built for the three sides of an audit.
One workspace. Three role-shaped surfaces. Every action linked to the same append-only history.
Draft
Needs info
In review
Approved
Auditor
The reviewer, internal or external.
Audit Queue3 awaiting
PCI-1.2.5kira@acme
Service ports inventory
ISO-A.5.7rohan@acme
Threat intelligence program
SOC-CC4.1mei@acme
COSO control monitoring
Audit Queue across every assigned framework
Approve, Reject, or Request More Info in one click
Full workflow history on every control
Support
Programme manager across tenants.
Cross-tenant Portfolio4 tenants
Acme Fintech
72%On track
Helix Health
41%At risk
Lumen Robotics
88%On track
Ridge Insurance
23%Just started
Cross-tenant portfolio dashboard
Review Queue and engagement runbook
Run engagements without leaving the tenant context
Every comment, status change, and approval is recorded to an HMAC-signed append-only audit log.
03 · Coverage
Seven frameworks. One mapping engine.
Evidence for one control auto-credits its equivalents in other frameworks. Stop doing the same work twice.
81.9%mapping coverage
04 · Workflow
Every control has the same workflow.
Whatever framework you're working in, the path from draft to approved is identical — and reviewable end-to-end.
PCI 8.3.6Under Review
Strong cryptography is used to render all authentication factors unreadable
Assessment · PCI DSS 4.0.1 · Last updated 2 hours ago
Evidence & Notes
All user authentication factors are stored as
argon2id hashes with per-user salts. TLS 1.3 enforced for all auth endpoints; ciphers per CIS Benchmark.kira.s @ 14:08
Added Okta config export, see file 3.
Evidence Files
2.1 KB
184 KB
12 KB
Comments · 3
Maya · Auditor
Hash params look fine. Can you confirm rotation window?
Kira · Auditee
Confirmed — 90 days, enforced via Okta.
Maya · Auditor
Great — approving.
Workflow Actions
You are reviewing as auditor.
→ Two-stage approval: Confirm Approve required after this step.
Threaded commentsAuditee, auditor, and support all see the same thread on every control.
Recorded transitionsEvery state change captures actor, timestamp, and reason — immutably.
Optional recipient noteApprove or reject with a comment scoped to the person who submitted it.
05 · Evidence
Continuous evidence. No more quarterly screenshot drills.
Native connectors pull live data from your security stack into your control library. Sync on a schedule or on demand.
C
CrowdStrike FalconA
AWS ConfigG
GitHub DependabotO
OktaJ
Jamf ProG
GCP SCCQ
QualysR
Rapid7T
TenableT
TrustwaveM
Microsoft DefenderS
SnykCloud configCloud findingsApp vulnsIdentity + MFAEndpoint postureEDRExternal vuln scanning
See all connectors - ACS3 bucket encryption verified12s ago
- OKMFA snapshot · 248 users1m ago
- SNCritical vulns: 0 · High: 24m ago
- CSEndpoint agent health 99.4%9m ago
- PGNightly backup completed · 14.2 GB21m ago
Credentials encrypted with AES-256-GCM at rest. Decrypted only at sync time.
06 · Registers
Everything an auditor will ever ask for, already on screen.
Risk, nonconformity, assets, vendors, scope, applicability — each tile is a working register, not a spreadsheet template. Score every risk on a 5×5 likelihood-by-impact matrix and tie it back to the controls that mitigate it.
Risk heatmap · Likelihood × ImpactImpact →
Very low
Low
Med
High
Critical
Critical
5
10
15
20
25
High
4
8
12
16
20
Med
3
6
9
12
15
Low
2
4
6
8
10
Very low
1
2
3
4
5
Risk Register
47
risks
Nonconformity Register
12
open
Asset Inventory
1,284
assets
Software Inventory
386
packages
Vulnerability Scans
94
this month
Penetration Tests
3
in last 12 mo
Key Management
218
active keys
Vendor Risk
63
vendors
Scope Statement
v4
current
Statement of Applicability
93
controls
07 · PCI DSS 4.0.1
The most complete PCI DSS 4.0.1 surface on the market.
Built around the structure of the current standard — not a generic checklist with PCI-flavoured labels glued on.
01Full 697-control library, mapped to every PCI DSS 4.0.1 requirement.
02All 9 SAQ types with auto-applicability based on your scope answers.
03Versioned Scope Statement — required by Req 12.5, kept under change control.
04Targeted Risk Analysis support for every Req 12.3.x customized frequency.
05Customized Approach and Compensating Controls workflows in the same UI.
06One-click Report on Compliance and Attestation of Compliance export.
Form 1Report on Compliance
ROC · v4.0.1
ROC · v4.0.1
Form 2Attestation of Compliance
AOC · v4.0.1
AOC · v4.0.1
Form 3SAQ Readiness
SAQ · A through D
SAQ · A through D
08 · Reports
Ship audit-ready outputs in one click.
Every report is generated from live data — no copy-paste, no spreadsheet stitching, no last-minute scrambles.
09 · GRC Compass
From zero to a tailored compliance program in ten minutes.
GRC Compass profiles your organisation across 9 quick questions — sector, employee count, sensitive data, infra mix, current maturity — and produces a recommended framework set with starter policies, risks, and a calendar.
Answers stay in your browser. Not sent to our server.
Question 3 of 9
Do you handle cardholder data?
10 · Security & trust
Compliance-grade by construction.
A compliance product has to clear the bar it asks customers to clear. These six commitments are non-negotiable.
HMAC-signed audit logEvery state change, comment, and approval written to an append-only log, signed and chained.
AES-256-GCM credentialsIntegration secrets are encrypted at rest. Decrypted only at the moment a sync runs.
SSO + MFA, enforcedPer-tenant OIDC single sign-on, or email + password — all with required MFA and idle session timeout.
Per-tenant isolationEvery record is scoped to a tenant and access is enforced server-side on every call — never at render time.
Three-layer RBACRole, tenant, and resource. Permissions are checked on every server call, not at render time.
Self-hosted optionDeploy SentinelPanda on your own infrastructure so tenant data never leaves your environment.