EVIDENCE PACKS BY LOCKTIVITY
SOC 2 and ISO 27001 aren't separate programs to build alongside security. They're proof of the security program you already run. We turn the tools you already use into audit-ready evidence that you, your auditors and your agents can trust.
Open format · signed with sigstore · verifiable without our tools
PROOF
We ran our own SOC 2 on Locktivity.
Real programs. Real evidence. Less scramble.
Phillip Lee
vCISO, Reisender
“Our ISO and SOC 2 auditors loved Locktivity. They had allocated three hours for vendor management controls. We gave them the exports, then answered ten minutes’ worth of questions.”
Read how Monte Carlo runs SOC 2 and ISO 27001 with no GRC hires →
CASE STUDY
Continuous compliance without the friction
Monte Carlo is an AI-native observability platform serving global enterprises. Trust isn’t a marketing value for them, it’s the product.
They engaged Locktivity to build a security-first GRC program powered by verifiable evidence, running SOC 2 and ISO 27001 simultaneously.
Read the case study
THE PLATFORM
Run GRC workflows continuously, on evidence you can verify.
Replace quarterly access reviews, periodic snapshots, and policy hope with live evidence. Monitor drift as it happens, run assessments on the fly, and continuously verify that the controls you set are actually working.
Move from point in time and operating on faith to continuous verification
A policy that requires MFA is only the starting point. Locktivity watches the live systems behind that policy, catches drift when it happens, and gives your team proof that the control is still operating- not just a promise from the last review.
Agents that work your evidence, not your keys
Hand an AI agent a signed Evidence Pack and it can run access reviews, flag exceptions, and draft remediation, without holding standing credentials to your systems.
Share once, with the right people
Publish evidence streams once and route the right pack to the right party - your auditor, a customer trust team, or your own security review.
Third-party risk that persists
Discover what vendors exist, see how they are used, and track whether they stay locked down. A management layer that keeps working long after onboarding.
Access reviews when the evidence changes
Instead of waiting for the quarterly access review, monitor the signals that matter continuously and run an assessment the moment risk changes. Reviewers get current context, exceptions are visible early, and every decision is preserved as verifiable evidence.
Explore our Services
THE OPEN STANDARD UNDERNEATH
Evidence Packs are built on the open .epack standard. Each collector pulls live proof that a control is on straight from a system you already run. Your evidence verifies with or without Locktivity.
G
Google Workspace
COLLECTOR
Ok
Okta
COLLECTOR
aws
AWS
COLLECTOR
GH
GitHub
COLLECTOR
+
Your collector
BUILD IT
Trusted by the people you need to verify them.
Auditor trust
Open, portable evidence gives auditors the transparency and integrity checks they need. Evidence Packs are trusted by the auditors you trust.
QUESTIONS, ANSWERED PLAINLY
What teams ask before they start
What is an Evidence Pack?
An Evidence Pack is a portable, cryptographically signed archive—the open .epack format—that packages security and compliance evidence pulled directly from the systems you run: AWS, Okta, GitHub, Google Workspace, and more. Because it conforms to the open standard, anyone can verify a pack’s authenticity and contents without vendor-specific tools. Evidence Packs by Locktivity is the product that builds, signs, monitors, and distributes these packs continuously.
How long does onboarding take?
Time to value is minutes. You can plug in some collectors in literally a couple of minutes, while others take around 20 minutes to configure. If you’re building custom collectors, it depends on the tool’s documentation, available APIs, and your coding skills. If you’re subscribed to Locktivity, we support customers in building and modifying collectors to meet their needs.
Will my auditors accept Evidence Packs instead of screenshots?
Yes. Multiple auditors already do, and we haven’t run into one yet who doesn’t know how to read JSON or ask AI a question. With the MCP plugin, auditors can review evidence quickly and verify it through integrity checks and the transparency of open-source collectors. Ask us for the auditor guide if you want to check with your auditor.
I don’t care about continuous compliance. I just need to get through my audit - do I need Evidence Packs?
It’s entirely possible to get through your audit without tools. Your first SOC 2 can absolutely be done in spreadsheets and with screenshots—and the wrong tools can create more work than they save. We encourage Evidence Packs because they quickly show what you’re already doing that can support your compliance program, so you can spend your energy on genuine gaps and have the evidence ready to go. Continuous compliance simply means you don’t get bogged down chasing evidence and fixes when audit time comes around: the upfront work is lighter than other compliance platforms, and the outcomes are better.
START FREE · KEEP WHAT YOU BUILD
Prove your security. The compliance follows.
Connect a system you already run, generate your first signed Evidence Pack, and share it with your auditor or a customer.
Talk to our team
Review a defensible trail instead of reconstructing one.