Not built to replace your auditor

ISO 27001 and SOC 2 both come from an auditor

This platform collects and organizes evidence for ISO 27001, SOC 2, and GDPR, and it has no accreditation to certify ISO 27001 or issue a SOC 2 report.

ISO 27001 certification comes from a licensed certification body. It audits your organization against Annex A (the control catalogue in ISO/IEC 27001) and issues the certificate itself.

A SOC 2 report works the same way. A licensed CPA firm examines your controls over an observation window and writes the report under its own name.

This platform is evidence-and-readiness tooling for both standards. It has no accreditation to certify ISO 27001 or to issue a SOC 2 report, and it does not claim otherwise.

Only a licensed auditor issues either one.

A pass is evidence, not a guarantee

Every result this platform produces describes one configured control at the moment the check ran, evidence for your own review rather than a verdict on your organization's compliance as a whole.

A pass from a deterministic check means the exact setting it reads matched the expected configuration when the check last ran. It says nothing broader than that one setting, at that one time.

A branch-protection check reporting pass means that repository's merge-review requirement was set correctly at that timestamp. It does not mean every repository is configured the same way, or that the setting is still correct an hour later.

Your organization remains accountable for its own overall compliance posture. That includes engaging its own auditor for ISO 27001 certification or a SOC 2 report. This platform does not act as your compliance officer or your legal advisor.

• Pass. The specific setting the check reads matched the expected configuration when the check last ran.
• Needs review. The check could not read a definitive answer from the target system's own API, and a person needs to confirm the setting by hand.
• Fail. The specific setting the check reads did not match the expected configuration when the check last ran.

This platform does not replace your auditor.

No auditor-referral partnership yet

Some competitors in this category run an auditor marketplace or a referral partnership, and this platform does not have one yet.

An auditor-referral partnership or marketplace: not built yet.

Many customers already have a relationship with an accountancy or security-audit firm. Each check result stores the exact date it ran. A SOC 2 Type II auditor sampling evidence across an observation window can request a result for a specific past date, instead of today's snapshot.

That historical query is built and tested. It is not yet wired into a dashboard page a customer can use directly.

Findings are yours to fix

A failing or needs-review result names what did not match, and your own team decides what changes, when, and how.

A fail or needs-review result names the specific setting involved, together with the raw evidence a script read directly from the target system's own API.

The platform reads your settings. It does not change them.

Your own team decides what changes, and when. Verazo AI writes the plain-language summary of what a check found, after the check has already run.