• contact@verticalserve.com
  • Continuous compliance, proven every hour
Request a demo
InsightAssure · continuous compliance

Continuous compliance, proven every hour

InsightAssure connects read-only to the systems you already run (cloud, identity provider, HR, source control, laptops, scanners) and tests your controls every hour. SOC 2, SOC 1, ISO 27001, HIPAA, PCI DSS, NIST CSF, GDPR and ISO 42001 are reported from one control set. Your auditor works in a scoped workspace, and customers see the live status on your Trust Center. Run it as VerticalServe SaaS or in your own cloud.

Request a demo How a control is proven
8frameworks, 559 requirements mapped
114unified controls, tested once, reported everywhere
65automated tests, every hour
55read-only integrations, plus a push API
app.insightassure.com/overview
InsightAssure Overview for Northwind Labs: tiles for controls passing (52%, 57 of 110), monitors failing (30 of 65), open issues (30) and policy acceptance (84%); readiness rings for SOC 2 (18%), SOC 1 (15%), ISO/IEC 27001 (28%) and HIPAA (46%); a control-health bar and a Needs attention list.
The whole program on one screen. Readiness is per framework, from the same 110 controls; Needs attention lists what moves it: 30 failing monitors, 11 controls needing evidence, 18 people with onboarding incomplete and one offboarding with access still open.
Proof, not promises

Three screens from the demo company, as they are

Northwind Labs is a 25-person demo company with real gaps planted in its systems: an engineer who left but kept his accounts, a public bucket, unreviewed changes. This is what InsightAssure found without being asked.

app.insightassure.com/monitors/accounts.terminated_disabled
Monitor ‘Accounts of people who left are disabled within the offboarding SLA’, critical, failing: 2 tested, 2 failing, with the fix ‘Disable or delete the listed accounts…automate deprovisioning through the IdP (SCIM)’ and two failing resources, marcus.webb@northwindlabs.io and marcusw-nw, both ‘Still active 21 days after the person left’.

The leaver, by name

Marcus Webb left 21 days ago. The offboarding monitor found his Okta and GitHub accounts still active, named both, and said how to fix it.

app.insightassure.com/controls/chg-02
Control CHG-02 Peer review of changes, failing, with a Why it is in this state box listing five failing monitors (default branches protected, approving review required, administrators bound, force pushes blocked, changes reviewed by someone other than the author), the test procedure and the evidence to collect.

Why a control fails

CHG-02 Peer review of changes is failing because five tests over the GitHub data fail, and the auditor’s test procedure sits right beside them.

app.insightassure.com/audits/soc2-type2/populations
Populations & samples: the ‘Merged changes’ population of 43 items with 10 sampled (northwind/data-pipelines#130, northwind/infrastructure#124, northwind/mobile-app#142, northwind/internal-tools#133…), each sample with its own open request.

An audit that samples itself

The auditor drew 10 of 43 merged changes with a recorded seed; three lacked a second reviewer and became a finding.

What continuous means here

Six rules the product is built on

Every compliance tool says “automated”. These are the properties that decide whether an auditor, and a customer, can rely on what it says.

Tested, not attested

Controls take their health from monitors over real data and from evidence collected inside each control’s frequency window. A checkbox nobody verified does not turn a control green.

Not judged when not reported

A monitor never fails a resource for data its source did not provide. An unknown MFA status is unknown, not a pass and not a failure, and the monitor says when it has no data.

One control, every framework

114 unified controls cover 559 requirements across eight frameworks. MFA is tested once and counts toward SOC 2 CC6.1, ISO A.8.5, HIPAA 164.312(d) and PCI DSS 8.4.

Evidence an auditor can reproduce

Monitor history, access-review decisions and policy acceptances are kept as evidence. Samples are drawn with a seed stored on the audit, so the same draw can be made again.

Honest AI

Questionnaire answers come from your approved answers, published policies and the live health of the controls behind them. A failing control is never described as in place.

Yours to run

VerticalServe SaaS, or the same images in your own cloud with your Postgres, object store and model provider. With no model at all, every AI feature still answers by rule.

The product

Everything a compliance program needs, from one control set

Frameworks, monitoring, people, policies, vendors, risk, access reviews, audits and trust, built around one set of controls so nothing is collected twice.

Frameworks & controls

Eight frameworks and 559 requirements mapped to 114 unified controls. Test a control once; its health counts toward every framework that asks for it.

Learn more

Continuous monitoring

Sixty-five automated tests run hourly over a normalized inventory. A failure names the resource and the fix, opens an issue, and closes it when it passes again.

Learn more

Integrations

Fifty-five read-only connectors across cloud, identity, HR, code, devices, scanners, ticketing and monitoring, plus CSV import and a push API.

Learn more

People & devices

Personnel from your HR system, onboarding checked automatically, offboarding checked against every system, and laptop posture from MDM or a small agent.

Learn more

Policies & training

Twenty-three audit-ready policies with versions, approval and acceptance, and five built-in training courses with quizzes.

Learn more

Vendors & risk

Vendor inventory, SOC report reviews that map CUECs to your controls, SaaS discovery from the IdP, and a 47-risk register with a 5×5 heat map.

Learn more

Access reviews

Quarterly reviews from any identity system, with accounts flagged for leavers, admins, no MFA and inactivity; the decisions become evidence.

Learn more

Auditor workspace

Requests generated from your controls, an auditor role scoped to one audit, seeded reproducible sampling, findings and a one-click package.

Learn more

SOC 1

Control objectives as editable rows, CUECs and CSOCs in the system description, subservice organizations carved out and monitored.

Learn more

Trust Center

A public page with live control status, subprocessors and NDA-gated documents released through expiring links.

Learn more

AI questionnaires & Ask

Questionnaires answered from your approved answers, policies and live control health, with citations, and plain-language answers about your own program.

Learn more

For consultancies

A workspace per client, consultant roles in each, and a portfolio of every client’s readiness in one view.

Learn more

See every feature

How a control is proven

From a connected system to a met requirement

Each step can be opened and checked: the resource, the test result, the control’s reasons, the requirement it satisfies.

From integrations to framework readiness: connect, normalize, test, roll up to controls, satisfy requirements, share with the auditor 1ConnectRead-onlycredentials tocloud, identity,HR, code,devices,scanners;sealed, neverreturned.2NormalizeEvery sourcebecomes the sameresource types:accounts,employees,devices,repositories,buckets,findings.3Test hourly65 monitorsjudge theresources; afailure namesthe resource andthe fix, andopens an issue.4ControlhealthMonitors,evidence in itswindow andpublishedpolicies decidepassing, failingor needsevidence.5RequirementsmetSOC 2, SOC 1,ISO 27001, HIPAAand more readthe samecontrols;readiness perframework.6Auditor andcustomersA scoped auditorworkspace withsamples and apackage; a TrustCenter with livestatus.AI drafts answers and descriptions from these results; with no model configured, the same features answer by rule.From integrations to framework readiness: connect, normalize, test, roll up to controls, satisfy requirements, share with the auditor 1ConnectRead-only credentials to cloud,identity, HR, code, devices,scanners; sealed, never returned.2NormalizeEvery source becomes the sameresource types: accounts,employees, devices, repositories,buckets, findings.3Test hourly65 monitors judge the resources; afailure names the resource and thefix, and opens an issue.4Control healthMonitors, evidence in its windowand published policies decidepassing, failing or needsevidence.5Requirements metSOC 2, SOC 1, ISO 27001, HIPAA andmore read the same controls;readiness per framework.6Auditor and customersA scoped auditor workspace withsamples and a package; a TrustCenter with live status.AI drafts answers and descriptionsfrom these results; with no modelconfigured, the same features answerby rule.
Connectors never touch controls and monitors never call vendor APIs; each stage has one job, so each can be audited.
Solutions

Who it is for

The same product, scoped for the report your customers or regulators ask for.

SaaS: first SOC 2 Fintech & payroll: SOC 1 Healthcare: HIPAA Payments: PCI DSS AI companies: ISO 42001 Consultancies & MSPs
Runs where your data lives

VerticalServe SaaS, or your own cloud

The same images either way. Self-hosted, InsightAssure uses your Postgres, your object store and your secret manager, and any model provider or none.

SaaSHosted by VerticalServe; a workspace per organization with Postgres row-level security between tenants
AWSRDS PostgreSQL, S3, Secrets Manager, Bedrock; the AWS integration reads accounts through an assumed role
AzureDatabase for PostgreSQL, Blob Storage, Key Vault, Azure OpenAI
Google CloudCloud SQL, Cloud Storage, Secret Manager, Vertex AI
On-premises./install.sh and Docker Compose on one VM; no model required

Deployment options

From the blog

Playbooks and worked examples

SOC 2, SOC 1, monitoring and audits, shown on the demo company’s real data.

SOC 2 in 90 days — a practical playbook for a small SaaS team
SOC 2

SOC 2 in 90 days — a practical playbook for a small SaaS team

Scope, readiness week by week, Type 1 vs Type 2, the observation period and fieldwork — a SOC 2 plan a 25-person SaaS company can actually run.

October 29, 2026 · 9 min read
Read article
SOC 1 explained properly — control objectives, CUECs, CSOCs and carve-outs
SOC 1

SOC 1 explained properly — control objectives, CUECs, CSOCs and carve-outs

How SOC 1 differs from SOC 2, how to write control objectives, and how CUECs, CSOCs and carved-out subservice organizations fit together.

October 26, 2026 · 8 min read
Read article
How continuous control monitoring actually works
Monitoring

How continuous control monitoring actually works

From an Okta account to a framework readiness score — the data model, the 65 monitors, exceptions and the rule that keeps tests honest.

October 23, 2026 · 7 min read
Read article

All posts

See your own program tested

Connect your identity provider, HR system and one cloud account to a pilot workspace. Within the hour the monitors report, and we walk through what they found.

Request a demo