Scope & Ownership

Registry

One connected record of every system, vendor, and person your program depends on — each one owned, current, and tied to the controls and evidence behind it.

Map your platforms

Turn a list of systems into the scope you can hand an auditor. Capture each platform's purpose, boundaries, and data flows in one record, and give every one a named owner accountable for it.

Visualize connected assets and services in an interactive graph
Tag systems as in-scope, production, or containing PII

Track assets and vendors

Know who you depend on and whether they meet your standards — before a customer or auditor asks. Keep a live record of every asset your platforms rely on, with vendor approval status, SOC 2 attestations, and contacts in one place.

Filter assets by type, owner, and scope status
Approval and SOC 2 status visible per vendor, not buried in a folder

ResendTRANSACTIONAL EMAILFOR USE · OFFFOR USE · ON

DraftJUL 02ReviewJUL 18ApprovedAUG 06OffboardSEP 30TerminatedOCT 14

Record retained after terminationHistory stays available to auditors

Know your people

See who has access to what — and prove it — without chasing spreadsheets across teams. Keep one record per person with their role, employment details, and every account they hold, with MFA status and directory coverage synced from the tools your team already uses.

One view of every account a person holds across your tools
MFA status per account, ready as access-control evidence

Google WorkspaceSOURCE OF TRUTHSYNCING

DIRECTORYSTATUSMFA Google Workspace

Google WorkspaceACTIVEENFORCED GitHub

GitHubACTIVEENFORCED

SlackACTIVEDISABLED

Ever needed to know who owns a system — and found no good answer?

When a system, vendor, or person carries a named owner on its record, the answer is a lookup instead of a hallway poll — and the controls and evidence tied to that record inherit the same accountability.

SOC 2 System Description

Registry is your Section 3

Every SOC 2 audit requires a System Description — a precise account of the systems, people, and data flows that make up your organization. Registry keeps that picture current as your systems change, so when your auditor asks, you already have the answer.

Infrastructure & software

Keep the infrastructure and software behind your system description current — services, data flows, and diagrams, each with an assigned owner — so it's ready when your auditor asks.

People & access

Maintain a live record of who has access to what — each person's role and every account they hold, with MFA status current as access-control evidence.

Vendors & third parties

Track every vendor your platforms depend on — approval status, SOC 2 attestations, and contacts — so your subservice organization list is current before an auditor asks.

Native Integrations

Sync people and assets from
your directories and cloud accounts

Personnel sync from your identity provider and asset sync from your cloud accounts keep the registry current, so your records stay accurate without manual upkeep.