Connect
OAuth and scoped keys for AWS, GCP, Azure, GitHub, Okta, Google Workspace, Microsoft Entra, Jira, Datadog, and MongoDB Atlas. Browser sessions for consoles that only speak UI.
Platform
Connect, collect, lock, monitor.
Connect your stack. Fealta agents work across SaaS, cloud, and internal tools. Humans stay in the loop for break-glass access. Evidence lands in a dated locker an assessor can read.
Collect
Instruction in, evidence out. Agents pull configs, membership lists, encryption settings, and screenshots. Every run stores source, actor, and method.
Locker
A single evidence store with timestamps. One artifact can satisfy sibling controls across frameworks. Replay shows what was gathered and from where.
Evidence agents
Agents operate in browsers when an API is missing. Collection is logged. You approve privileged paths. Rahul’s team tunes runtime against the same replay the auditor later sees.
API collectors
Read-only calls against cloud and identity APIs. Results hash into the locker. Failed calls retry on a schedule and surface in monitoring.
Browser agents
For HRIS, vendor admin, and internal tools with no public API. The agent follows a written instruction, captures the screen and export, and stores the trail.
Replay
Open any row and see the source system, the collector identity, the UTC time, and the raw artifact. Share a read-only link into an NDA room.
Human loop
Break-glass credentials stay with you. Agents request a time-boxed grant. Fealta never stores customer environment passwords in the locker.
Frameworks
SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, and ISO 42001. Crosswalks so one piece of evidence can satisfy sibling controls.
SOC 2
Type I and Type II against the Trust Services Criteria: security, availability, confidentiality, processing integrity, and privacy. Agents map locker rows to CC-series and matching criteria. Sales-blocker first audits land here.
ISO 27001
Annex A controls, the Statement of Applicability, and internal-audit evidence. Cloud configs, access reviews, and change records feed the same locker used for SOC 2.
HIPAA
Security Rule administrative, physical, and technical safeguards. ePHI access logs, encryption evidence, and BAA tracking. Counsel stays on your side; Fealta keeps the proof current.
GDPR
Article 32 security of processing. Support for records of processing packets, DPA requests, and subprocessors published on the trust page.
PCI DSS
SAQ-relevant evidence for teams adjacent to a cardholder data environment: network segmentation proofs, access control, logging, and vendor diligence rows.
ISO 42001
AI management system controls: model inventory, logging, human oversight records, and supplier diligence. Useful for companies whose product is itself an agent runtime.
Continuous monitoring
Checks rerun on a schedule you set. Tickets open in Jira, Linear, or Slack when a control fails. A program that still holds in June.
Drift tickets
A GitHub org drops mandatory 2FA. An S3 bucket policy widens. The agent files a ticket with the last good locker row attached.
Owner routing
Each control has an owner. Failed checks page that owner. Recurring failures escalate to the named CSM on Court.
Questionnaires
Draft answers from policies and the live evidence locker. A human sends the packet. SIG, CAIQ, and custom security spreadsheets all pull from the same rows.
Use cases
First SOC 2
The sales-blocker audit. Vow covers up to 25 employees and one framework with a basic trust center your buyers can open.
Healthcare adjacent
HIPAA evidence with counsel still on your side. Agents keep ePHI control proof dated while legal reviews BAAs.
Multi-framework
Capture once, map many. SOC 2 plus ISO 27001 plus GDPR share encryption, access, and logging artifacts.
Questionnaire surge
Faster answers because the proof already exists. Drafts cite locker IDs so a buyer can ask for the underlying file.
Who buys Fealta
Seed-to-series-B SaaS, AI companies with messy cloud estates, and lean security teams. If procurement waits on a report, the locker is the product.
For auditors
A read-only room. Evidence with timestamps and collection method. You remain the independent assessor. Fealta never signs the opinion.