Review compliance evidence
Open an evidence record, check its supporting artifacts and linked controls, and record the review decision.
Follow an evidence reviewCompliance software. A team to do the work.
Prepare for SOC 2, ISO 27001 and HIPAA with the platform and our US-based team. Manage evidence, policies and security findings together. Operators request and review artifacts; you provide business context and approve policies. Advisory and implementation work are separately scoped.
Bring your framework requirements and deadline. We'll discuss evidence work, ownership, and the scope of the annual package.
Read the EchoWin case study
Know what is collected, reviewed and still outstanding.
The platform keeps evidence, controls and decisions together. Our own US-based employees handle the agreed security and compliance work alongside your team. We do not outsource or offshore delivery.
Collect evidence and track review
See supporting artifacts, linked controls and review status together. Our team helps collect evidence and resolve gaps; designated reviewers decide what to approve.
- collected + reviewed + approved
Keep up with the work between audits
Review control tests and outstanding evidence throughout the year. Use the platform to see what needs attention before preparing your next audit package.
- tests + evidence + follow-up
Connect pentesting to evidence
Completed pentests with published reports link automatically to applicable compliance evidence. New applicable reports update that link, while evidence approval remains a separate review.
- published report + evidence link
Prepare for the independent audit
We provide existing scoped evidence and correct our deliverables. Audit coordination, auditor meetings, and bespoke questionnaires require a separate scope. The independent assessor determines the outcome.
- existing scoped evidence included
From scoping to audit preparation.
Agree the scope, connect your systems and prepare evidence for review. We coordinate the work with your team and support the independent assessment.
Phase 01 - gated
Scope your frameworks
We agree which frameworks you actually need - SOC 2, ISO 27001, HIPAA - and lock the scope. No paying for controls that will never apply to you.
Framework set - scope locked
Phase 02
Connect & baseline
Integrations pull live config from your cloud, identity, and code. We baseline where you stand today against every control in the chosen frameworks.
In-scope controls baselined
Phase 03
Map controls to evidence
Link supporting artifacts to the applicable controls. Published pentest reports can supply evidence from testing completed by our team.
Controls mapped to sources
Phase 04
Collect and review evidence
Supported integrations gather artifacts. Review collection status and freshness, and request missing evidence from the people responsible.
Collection status and missing inputs visible
Phase 05
Close gaps & approve
Operators review technical evidence and explain gaps. You supply business context and approve policies. Implementation requires separate scope; approval does not prove a control is effective.
Gaps owned - evidence approved
Phase 06 - gated
Prepare for independent assessment
We provide existing scoped evidence for independent review. Auditor meetings and coordination are separately scoped; the assessor determines the outcome.
Evidence prepared for the assessor
See how the work moves through the platform.
Start with a specific task, then follow the walkthrough to see who acts and what needs review.
Connect the pentest report
When a pentest is completed and its report is published, the latest applicable report links to eligible compliance evidence. Review and approval remain separate.
See testing and retestingTrack vulnerability work
Review findings by source and asset, track remediation deadlines, and check the outcome of scheduled scans.
See scheduled scanning
Security and compliance work for echowin.
Our published case study covers penetration testing, vulnerability management and compliance support for echowin's AI platform.
Jarred, Andrew, and their team are trusted partners - extensive penetration testing, code analysis, and security reviews that protect our users. We share a vision of prioritizing customer security above all else.
A managed plan, with the frameworks you need.
$20,000/year including one framework. Each additional framework is $3,000/year. For companies under $5M revenue or 50 staff. The SOC 2 Type I, Security-only bundle includes the independent auditor fee. Type II audits, additional audit criteria, and other certification fees are quoted separately. Enterprise pricing is custom. The SOC 2 Type I, Security-only bundle is $20,000/year total, including the $3,000 independent auditor fee. Sythe coordinates preparation and the audit through the platform. The independent auditor performs the audit and issues the report. Type II audits and additional criteria are quoted separately.
Each year includes 2 scoped penetration tests, one scoped retest per test, 2 risk assessments, and 12 vulnerability scan runs. Asset and host limits are agreed before work starts. Schedule testing within the service year, subject to availability. Managed security plans have no per-seat platform fees. One compliance framework is included; additional frameworks are annual add-ons. Standalone pentests are priced per engagement; Knell subscriptions use per-user pricing.
The work included between audits
Sythe operators request and review evidence, prepare materials, and follow up in the platform. You supply business information and approve your organization's policies. Routine clarification, corrections, and supported platform integration repairs are included.
When the work needs a separate scope
Ongoing security monitoring and incident response are additional services. We recommend fixes; hands-on changes to your systems require a separate implementation scope.
Strategic compliance advice and expressly delegated decisions use a vCISO retainer at $250/hour, with hours approved in advance. Kickoff and pentest scoping and closure meetings are included. Other routine delivery happens in the platform; recurring consulting meetings are extra.
SOC 2
Type I & Type II, across all five trust-services criteria.
See the program
ISO 27001
The 2022 revision, ISMS scoping through Statement of Applicability.
See the program
HIPAA
Security & Privacy Rules for teams handling protected health data.
See the program
GDPR
Records of processing, DPAs, and data-subject obligations.
See the program
PCI DSS
For anyone touching cardholder data, scoped to your environment.
See the program
NIST CSF
Govern, Identify, Protect, Detect, Respond, Recover.
Supported
CMMC
Levels 1-2 for the defense industrial base and contractors.
Supported
Custom
Customer security questionnaires and your own control set.
On request
+ $3,000 / yrper additional framework. One framework is included in your annual plan. Add only what you need, when a deal, a region, or a regulator actually requires it.
Powered bySecure Controls Framework
What is driving your compliance deadline?
Bring the customer's request or the audit requirement to a 30-minute scoping call. These details help us work out what belongs in your program. Leave unknowns open; you do not need a finished compliance plan to talk to us.
- The requirement and date
- Who is asking, what do they need to receive, and when? Distinguish a sales deadline from an agreed audit date.
- The business and systems
- Which product, teams, and environments are involved? Note your cloud, identity provider, and who manages access.
- Work you already have
- List existing policies, reports, and evidence. Note open findings and any assessor or provider already engaged. Do not send confidential reports through a booking form.
- People who can act
- Identify the customer lead for business information and policy approvals, plus whoever owns technical changes. Tell us if you need separately scoped advisory or implementation help.