Compliance evidence that stands up

Attest connects to your systems through secure, tenant-bound connectors. Each connector is authorised with the minimum permissions required and bound to your specific tenant, no connector can access another organization's data. Evidence is collected on a policy-driven schedule: a full baseline at onboarding, then recurring collection at defined intervals. Delta collection runs where the source system supports it. If a connector fails or a source is temporarily unavailable, the gap is recorded honestly, Attest never fabricates evidence to fill a gap.

Supported connectors include: Microsoft 365 (Graph API), Active Directory (LDAP/Agent), AWS (Security Hub, Config, CloudTrail, IAM), Microsoft Azure, Google Cloud Platform (Security Command Center), Google Workspace, CIS scan ingestion (CIS-CAT Pro, Tenable/Nessus, Qualys), backup software (Veeam, Datto, Acronis), EDR platforms (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint), and a generic API intake for additional sources.

Every evidence record is written to WORM storage (Write Once, Read Many). WORM storage physically prevents modification or deletion of stored objects. This is not a software setting that can be turned off, it is an infrastructure-level guarantee provided by the underlying storage service. Evidence is stored in AWS Sydney (ap-southeast-2) and does not leave Australia. Each stored object is individually locked at the time of writing.

After evidence is written to WORM storage, a SHA-256 hash is computed from the evidence payload. This hash is then combined with the previous record's hash to create a new ledger block in a per-tenant hash chain. Each tenant has its own independent chain — no cross-tenant chaining exists. The chain is append-only: there is no update operation and no delete operation at any layer. If any record in the chain were altered, all subsequent hashes would become invalid, making tampering immediately detectable.

Device identity fields, including device ID, hostname, IP address, and MAC address where available, are included in the hashed evidence packet. This means the evidence is cryptographically bound to the specific device context at the time of collection.

Attest maintains a set of universal controls that are stable and framework-independent. Compliance frameworks , Essential Eight, ISO 27001, NIST CSF 2.0, APRA CPS 234, ASD ISM, and others — are views mapped onto these universal controls. This means adding a new framework requires loading requirement definitions and mapping rules, not rebuilding the engine. A single universal control (such as "MFA enforced for all users") can map to multiple framework requirements simultaneously across Essential Eight, ISO 27001, NIST, and CIS.

Framework assessment is confidence-calibrated. A control can only produce a PASS result when confidence is high — meaning the evidence is present, fresh, complete, structurally valid, from the correct source, and within scope. If any of those conditions is not met, the output is UNKNOWN (insufficient evidence), never PASS. Missing evidence never produces a passing result.

Attest generates PDF report packs with a fixed structure designed for insurers, auditors, boards, and regulators. Every report includes: an executive summary in plain English, risk scorecards with RAG (red/amber/green) status per framework, a findings table with plain-language explanations and remediation guidance for every non-passing control, an evidence proof appendix with cryptographic hashes, timestamps, event IDs, and device identity, a governance appendix with attestation records and risk acceptance history, a data residency and integrity statement, and a chain-of-custody statement.

Every report prints the exact framework version, mapping rules version, control rules version, and assessment date it is bound to. Reports are generated server-side only, never in the browser. The generated report's hash is recorded in the evidence ledger, creating a verifiable proof that the report existed in its exact form at the time of generation.

Every report generated by Attest can be independently verified through a dedicated verification endpoint. The endpoint accepts a report identifier and returns: the report hash, generation timestamp, framework versions and scope, and confirmation that the report hash is recorded in the evidence ledger. The verification response confirms whether the report is valid or invalid without revealing any tenant data beyond the verification metadata.

Reports can optionally include a QR code that links directly to the verification endpoint. An insurer, auditor, or regulator receiving a Attest report can scan the QR code and confirm independently that the report is genuine and unaltered — without needing APEXLyn platform access and without needing to trust APEXLyn.