How our compliance program is defined, proven, and shared.

ConfianceCloud is the single place where every control we operate is written down, evidenced, and made available to the people who need to see it. This page explains how the pieces fit together, in plain language, before you sign in.

If you were sent here to acknowledge a policy, review our security posture, or audit our program — start below. Part 4 tells you exactly what to do, and signing in takes about two minutes the first time.

* Confiance is a French word meaning trust and reliability — pronounced “con” (like icon) + “fee” + “onse” (like response).

Part one

Controls are the hub of everything

A control is one statement of something the organization does. Everything else in the system either defines a control, proves it, or is governed by it. Read the diagram inward.

Define — what the control must say

Prove — that it operated

Frameworks

SOC 2 · HIPAA · ISO 27001 · more

Each framework is a list of requirements. Requirements map many-to-many to controls, so one control can answer several frameworks at once.

The hub

CONTROLS

One control is one statement of something the organization does.

Statement

What we do

Owner

Who is accountable

Status

Covered / Partial / Gap

Everything else in the system either defines a control, proves it, or is governed by it. Nothing stands alone.

Evidence

Append-only · checksummed

Two sources feed it: people upload proof by hand, and automated collectors read our cloud configuration on a schedule. Evidence is never edited — it is appended.

Policies & procedures

Versioned · approval workflow

Documents that state how a control is met. Each version is drafted, approved, and attached to the control it governs.

Registers

Linked back to controls

The risk register, incident log, access reviews, penetration test findings and business continuity tests — each entry ties to the control it affects.

Connect — who the control governs

People

Every person confirms each approved policy version, and those acknowledgments are kept with training records and professional certifications against the same controls.

Vendors

Risk tiers, periodic evaluations, and business associate agreement tracking. A filtered view of the same vendor list is what we publish as our subprocessor list.

Read the diagram inward. Each object earns its place through its relationship to a control — that relationship is what makes the program auditable rather than a folder of documents.

A framework never owns a control. It points at controls that already exist, which is why the same control can answer SOC 2, HIPAA and ISO 27001 at the same time.

Evidence is never rewritten. New evidence is appended with a checksum, so the record of what was true, and when, survives the passage of time.

Part two

One control answers many frameworks

This is the relationship that makes the whole program tractable. Requirements from different frameworks converge on the same controls — adding a framework is a mapping exercise, not a rebuild.

Four example controls and the frameworks whose requirements they answer.
Control	SOC 2	HIPAA
Access to systems is granted by role and approved
Access rights are reviewed on a fixed cadence		—
Changes are peer-reviewed before release
Workforce completes annual security and privacy training	—

Adding a framework is mapping

A new framework's requirements are pointed at controls that already exist. Only the true gaps become new controls — the program is extended, not rebuilt.

Proof is reused, not duplicated

Policies and evidence attach to the control once and satisfy every requirement mapped to it, in every framework, without a second copy.

Change once, propagate everywhere

When a control or its proof changes, every framework view that depends on it moves with it and coverage is recomputed.

Part three

The operating loop

Compliance is not a project that finishes. Schedules create work, the work is done by the people accountable for it, and doing it produces the next round of evidence.

Step one

Schedules

Cadences set on controls, document reviews, vendor evaluations and certifications decide what comes due, and when.

Step two

Work items

Reviews due, evaluations due, acknowledgments outstanding, expirations approaching — each with a named owner.

Step three

Dashboard, worklists & calendar

Work appears in front of the person accountable for it. One compliance calendar carries every upcoming date — document reviews, vendor evaluations, certification expirations, acknowledgments due — and can be subscribed to from any calendar application.

Step four

Completion

Finishing an item writes a review record and appends new evidence to the control — which sets up the next cycle.

The next cycle, and the evidence trail it leaves behind

Coverage rolls up per framework

Each requirement takes its state from the controls mapped to it and the proof attached to those controls. Requirement states roll up to a single, always-current position for each framework.

SOC 2

HIPAA

ISO 27001

Covered — control in place, proof current Partial — control in place, proof incomplete Gap — no mapped control

Bars illustrate the three states. They are not a measurement.

What keeps the loop honest

Automated collectors read cloud configuration on a schedule and append what they find as evidence, without anyone having to remember.

Append-only evidence with checksums means a completed item can be re-examined later exactly as it was recorded.

Nothing expires silently — an approaching expiration is itself a work item, and an overdue one is visible to more than its owner.

Part four

Get started — find yourself here

Four audiences sign in to ConfianceCloud. Everyone sees the same underlying controls; what differs is the view you are granted and the work you are asked to do.

Audience one

Internal team

The people who run the compliance program day to day.

What you'll do here

Work the dashboard of what is due, overdue, and at risk
Clear your worklist — the items assigned to you as owner
Follow one compliance calendar, subscribable from any calendar application
Administer controls, framework mappings, and review cadences
Track and answer inbound security questionnaires from client institutions
Ask the assistant questions about the program, have it draft the plain-English change summaries employees see, and have it suggest which policies support which controls

A person reviews every suggestion the assistant makes. It never writes a record on its own, and it is never available to external audiences.

Audience two

Employees & contractors

Everyone who works here and is covered by our policies.

What you'll do here

Read each approved policy version that applies to you
Acknowledge it — one confirmation per approved version
When a policy changes, read a plain-English summary of what changed before you confirm
Find your own acknowledgment history in one place

Acknowledgments are timestamped and feed compliance reporting automatically — there is nothing to file and nobody to email.

Audience three

Client security reviewers

Customers performing their own diligence on us.

What you'll do here

Sign in to a credentialed view kept separate from our internal one
Read the documents explicitly granted to you, and only those
Work with copies watermarked to you as the viewer
Need something not shown? Ask your contact — access is granted per document

Every view and download is logged. Our public subprocessor list is available without signing in.

Audience four

Auditors

Examiners who need to test the program, not run it.

What you'll do here

Read controls, their framework mappings, and the evidence attached to them
Trace any requirement to the controls that satisfy it, and to their proof
Export an audit package scoped to a single framework
Verify the package later against its manifest and checksums

All auditor access is read-only. Nothing an auditor does changes a record.

Shared by all four audiences

Your first sign-in

It takes about two minutes and it is the same for employees, contractors, client reviewers and auditors — all through the Sign in button on this site. (Internal team members administering the program use the separate console address provided during onboarding.)

Step one

Use your temporary password

You will receive a temporary password by email at the address your access was granted to. It is single-use.

Step two

Set a real password

Choose your own password. The temporary one stops working the moment you do.

Step three

Enroll multi-factor

Register a passkey — Touch ID, Face ID, Windows Hello or a hardware security key — or an authenticator app. Multi-factor is mandatory for everyone.

Sign-in supports passkeys as well as password plus multi-factor. Identity is handled by a managed identity service: it decides who you are, and it holds no view of the compliance program.

ConfianceCloud decides what you may see. Your audience, and the documents granted to you within it, are set here — never by the identity service.