Getting started

1. Create an account

Sign up with an email and password. This creates your organization, the container every integration, check, and evidence record belongs to.

2. Connect an integration

From Integrations, pick a provider and enter its credential: a personal access token for GitHub or GitLab, an API key and application key for Datadog, an OAuth token for Google Workspace, and so on, one credential field set per provider. The credential is encrypted at rest and used only to call that provider's own API when a check runs.

One check needs no integration at all: tls-certificate-valid takes a domain and opens a real TLS connection to it, nothing else to configure.

3. Add a control check

From Controls, choose a check type, give it a target (a domain, a repository, an organization name, depending on the check), and select the integration it should use, if it needs one. See /docs/checks for the exact target format each check expects.

A check with a schedule runs on that cadence automatically. A check with no schedule runs once, on demand.

4. Read the result

Every run writes one evidence record: a status of pass, fail, or needs-review, a timestamp, and the raw response the check received. A failed authentication attempt against a provider's API is always recorded as needs-review, never fail, since an auth error proves nothing about the setting itself.

Evidence appears on the Evidence page immediately, and rolls up into per-framework coverage on the Frameworks page for every control it satisfies.

Faster: ask in plain language

The Ask page accepts a plain-language request, for example "check that example.com has a valid TLS certificate". Verazo AI parses the request against a fixed, allowlisted set of known check types and either runs the matching check directly or reports that the request needs human review. It never invents a new check or calls an API outside that allowlist.