The product
Your evidence, collected while you sleep
Step one
Connect it, then forget about it
Read-only credentials to your cloud, identity, devices, code and HR system. Trusterio reads them on the schedule you choose and never writes to any of them — which is also why it will not pretend to have revoked anything. Two connections are there to write: Jira gets an issue for each fix you send it, and Slack gets the notices you choose.
- AWS
- accounts, MFA, buckets, keys, security groups, logging
- Azure
- subscriptions, storage, SQL, role assignments, Defender
- Google Cloud
- IAM roles, service account keys, buckets, SQL, disks, audit logs
- Entra ID
- accounts, MFA and conditional access, admin roles
- Google Workspace
- accounts, two-step enforcement, audit logging
- GitHub
- repositories, branch protection, reviews, security alerts
- Okta
- accounts, deactivated accounts, sign-on and password policies, admins
- Intune
- devices, encryption, OS version, compliance policies
- Jamf
- Macs and mobile devices, FileVault, firewall, OS version
- Kandji
- devices, agent and check-ins, FileVault, OS version
- Personio
- employees, start and end dates
- HiBob
- employees, start and end dates
- BambooHR
- employees, start and end dates
- Jira
- creates an issue for each fix you send it, and reads its status back
- Slack
- posts the notices you choose to a channel; reads nothing
Each connection reports when it was last read and what it found. A connection that has gone quiet says so on the dashboard, rather than silently reporting yesterday.
And your own AI, over MCP
MCP is the open standard that AI apps such as Claude use to connect to other tools. Trusterio has an MCP server: connect Claude, or another AI app that supports MCP with OAuth sign-in, to one business, with your approval and with no more rights than you have. It can read your controls, risks, findings, policies and questionnaires. It can draft answers, add evidence, add and update risks, and move a finding to open, in remediation or resolved. An answer it drafts stays a draft until a person approves it. It cannot delete anything, and it never touches members, billing or security settings. Every change it makes is in the audit log under your name, with the app it came through.
Step two
Controls that test themselves
A control backed by a check is retested every time its system is read, and one with no check cannot count as passing. The result is a status you did not type in — and a history showing how long it has been true.
Untested is not passing
A control whose test has not run recently is reported as unknown, and unknown lowers your score. Rounding up is how a dashboard becomes a decoration.
One control, many frameworks
Requirements from ISO 27001, SOC 2, NIS2 and DORA point at the same control. Collect the evidence once; it counts wherever it applies.
An exclusion is on the record
Decide a requirement does not apply and the score moves — with your reason attached to it, visible beside the number it changed.
Step three
A short list, with names on it
Findings come out of readings, not out of a workshop. Each one can be given an owner and a date. A passing reading closes it on its own — not somebody ticking a box.
- Owners, not a queueA finding with nobody on it is a finding nobody will do. Give each one a person and a date.
- Closed by observationA passing reading closes a finding by itself. Mark one fixed by hand and it needs a reason — and if the next reading still fails, it is raised again.
- Risk that argues backA risk you reduced on paper is reported at its inherent score until a completed treatment or a passing control backs it up.
The rest of it
The three spreadsheets you can throw away
The parts of compliance that usually live somewhere else entirely, in the same place as the evidence that backs them.
The GDPR Article 30 record
Every processing activity with its purpose, legal basis, categories, recipients and retention — and checked against what your Trust Center says you hold. The two cannot quietly disagree.
Joiners and leavers
Read from your HR system when it is connected. A leaver stays open until a later reading of every connected directory reports the account gone.
Security questionnaires
Answers drafted from your answer library, controls, approved policies and evidence, with the sources attached, and checked against them before anybody sees a draft. Nothing is invented.
One price. The whole thing.
€500 a month for one business, billed yearly, excluding VAT. Tell us about your company, and we set your account up with you, personally. Your data is stored in the EU.