Help center. Fealta connectors, locker, SSO, and ledger.

Connectors

Vow includes API collectors. Keep and Court add browser agents for consoles without an API. Each connector writes a method caption on the locker row: api or browser.

System	Method	Typical evidence
AWS	API, read-only IAM role	IAM policies, CloudTrail status, S3 encryption, GuardDuty
GCP	API, viewer + security reviewer	IAM bindings, audit log sinks, KMS keys
Azure	API, Reader plus Security Reader	Role assignments, Defender plans, Key Vault
GitHub / GitLab / Bitbucket	API	Org 2FA, branch protection, SSO enforcement
Okta, Google Workspace, Microsoft Entra	API	MFA, session lifetime, admin roles, SCIM
Jira, Linear, Notion	API	Ticket trails for change and incident controls
Datadog, CloudWatch	API	Alert coverage, log retention
MongoDB Atlas, RDS	API	Encryption, network access lists, backups
Rippling, vendor admin consoles	Browser agent (Keep, Court)	Access reviews, export CSVs, screenshot of the control

To add a connector, open Settings, choose the system, complete OAuth or paste a scoped key, then run Collect now. The first row appears in the locker within a few minutes.

Agent permissions

Collectors use least privilege. Browser agents request a time-boxed grant you approve in Fealta. Break-glass credentials stay in your vault.

Role	Can do
Owner	Billing, SSO, delete workspace, approve break-glass
Admin	Connect systems, edit control owners, open auditor rooms
Operator	Run collections, close monitoring tickets, draft questionnaires
Auditor	Read locker rows, replay, and attached files. No connectors.

Every permission change is written to the access log. Export that log from Security, or ask [email protected] for a Court-side dump.

Evidence locker

Each row has a stable ID, UTC timestamp, collector identity, source system, method, control map, and artifact hash. Crosswalks attach the same hash to sibling controls on SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, and ISO 42001.

{
  "row_id": "evd_08f3c1",
  "collected_at": "2026-08-13T18:41:00Z",
  "system": "rippling_admin",
  "method": "browser",
  "control_ids": ["SOC2-CC6.1", "ISO27001-A.5.15"],
  "sha256": "b7a14c9e0d2f81a6c4e59b0138f70d2aa91c6e4b8d5f3c17e0a2b9c84615d3e1"
}

Replay opens the stored export and the caption the agent wrote. You can share a single row into an NDA room without granting Auditor on the whole workspace.

Auditor view

Create a room from Trust, name the firm, set an expiry, and choose frameworks. The assessor signs in with a magic link or SSO. They see timestamps, method captions, and files. They remain the independent assessor.

Court adds watermarked downloads and an activity feed you can attach to the engagement letter.

SSO

Court includes SAML and OIDC for Okta, Entra, and Google Workspace, plus SCIM for joiner and leaver sync. Keep can add SSO as a line item. Map groups to Owner, Admin, Operator. Auditor accounts stay room-scoped.

Data residency

US-East is the default locker region. Court can pin agents and locker storage to US or EU. Evidence, replay media, and questionnaire drafts stay in the pinned region. See subprocessors for the current list.

Ledger

Public notes from the hall. Three entries are on this page.

Fealty lives in the evidence

12 Aug 2026 · Rahul

Medieval fealty was an oath you lived. Fealta is named for that living pledge: evidence that still matches the systems you run in production.

A Type II report describes a period. Buyers ask what is true tonight. Agents recapture the control, stamp the locker, and leave a method caption. In June the same pledge still has a date.

If you are briefing an assessor on agent-collected evidence, start with replay. Show the source, the time, and the hash. Then hand them the room.

Admin consoles still need a collector

28 Jul 2026 · Fealta desk

Plenty of the estate speaks JSON. Plenty of it still hides behind a login and a table you can only export by hand. Browser agents follow a written instruction, capture that export, and file it beside the API rows so the locker stays one place.

How to brief an auditor on agent-collected evidence

9 Jun 2026 · Fealta desk

Send the room link, the framework list, and a one-page method note: API collectors use read-only roles; browser collectors run under a time-boxed grant; humans approve break-glass. Offer a live replay of one control they already sampled. Your firm still signs the opinion.

How the hall keeps records.