Launched this week

Scorifya Controls

Launched this week

Self-hosted SOC 2 readiness, $99/mo, RFC 3161 timestamps

7 followers

Self-hosted SOC 2 readiness, $99/mo, RFC 3161 timestamps

7 followers

Self-hosted SOC 2 compliance for teams that can't justify Vanta's $10K-$15K/year. 33 automated checks across AWS, GitHub, GCP, Azure mapped to AICPA TSC 2017. 20 manual controls with evidence. RFC 3161 timestamps on every attestation (DigiCert, verifiable offline with OpenSSL). Deploys in one docker-compose. Flat tiers from $99/mo. First 25 buyers per tier get 20% off forever.

Payment Required

Launch tags:SaaS•Developer Tools•Security

Launch Team

ElevenAgents by ElevenLabsScale conversations without scaling your team

Promoted

Maker

📌

Hey PH, maker of Scorifya Controls here. The tool came from a pattern I kept seeing: engineering teams getting SOC 2 requirements in enterprise procurement questionnaires 6-12 months before they were ready to spend $12K/year on Vanta or Drata. The gap between "spreadsheet" and "enterprise SaaS with enterprise pricing" was real and nobody was filling it. A few things worth highlighting: The RFC 3161 timestamps are the part I hadn't seen anywhere else in self-hosted tooling. The problem: if your compliance tool controls the timestamps on your evidence, your auditor doing Type II has to take your word for the dates. RFC 3161 moves that trust to DigiCert, their root cert is in Windows, macOS, and Adobe's trust store, so auditors can verify offline without trusting Scorifya at all. The check library was built by engineers who have actually run compliance programs in production, PCI DSS, FedRAMP, SOC 2. Remediation guidance is specific because it comes from having fixed these things across real AWS, GCP, and Azure environments, not from reading AICPA documentation. Self-hosted was a deliberate choice. Some teams, especially in financial services, healthcare, or defense, can't send their cloud credentials to a third-party SaaS regardless of price. If your data can't leave your environment, Controls is currently the only self-hosted option with real automation. Happy to answer questions about the SOC 2 audit mechanics, the timestamp verification, or what any specific check actually tests. Technical writeup on the RFC 3161 implementation if you want the details: scorifya.com/blog/rfc-3161-soc2-timestamps

Report

3d ago

Maker

Quick update for anyone who saw the launch: Controls now maps every check to PCI DSS 4.0.1, not just SOC 2.

Same deployment, same price. The 38 automated checks (AWS, GCP, Azure, GitHub) and the manual controls each carry both an AICPA TSC 2017 criterion and a PCI DSS 4.0.1 requirement code now. There's a framework filter too, so you can flip between "SOC 2 only," "PCI only," or both and watch the posture score recompute.

The thing I actually care about here is PCI scope. If you use a hosted SaaS compliance platform, that vendor becomes a third-party service provider inside your cardholder data environment, so you end up tracking it and collecting an AoC from it every year. Controls runs on your own servers, so it never adds a third party to your CDE scope. For SAQ A and A-EP merchants (the ones who outsource card capture to a hosted payment page) that keeps the scope story a lot simpler.

To be clear about what it is not: it does not complete your SAQ or replace a QSA or ASV. It gets you audit-ready and hands your assessor clean, timestamped evidence.

No per-framework upcharge. It is included on every tier. Happy to answer anything.

Report

15h ago

Finally a compliance tool that doesn't assume I'm a Fortune 500 company. Got it running with the docker-compose in about ten minutes and the RFC 3161 timestamps worked exactly as advertised when I verified them offline.

Report

2d ago