CertAssist

What it is

CertAssist: the homepage

CertAssist is compliance certification software built by consultants and auditors. It lays out every control in a framework, provides built-in policy and evidence guidance, and keeps the entire implementation in one organized place. Rather than connecting to your systems, it asks you to upload evidence, eliminating the security risks of deep vendor access. Your auditor can review the evidence directly through read-only access to a workspace designed the way auditors actually read audits. The platform covers multiple frameworks including ISO 27001, SOC 2, HIPAA, GDPR, PCI DSS and others, with a single flat monthly price.

Quick answers

1. No integrations? Isn't that a step backwards?

   Vanta and Drata pull evidence automatically but require deep access to cloud, identity and code systems, creating more attack surface and letting vendors hold production keys. CertAssist asks you to upload evidence instead, which is slower initially but safer overall.

2. Will my auditor actually accept this?

   The workspace is laid out the way auditors read audits with control, requirement, status, evidence and owner clearly organized. Auditors get read-only access rather than folders of screenshots, and it was designed by people who have sat in the auditor's chair.

3. What happens to my evidence?

   Organizations are isolated at the database level, not just by application filters. Multi-factor authentication is mandatory on every account, and evidence is scoped per assessment so client users only see their own.

4. Do I pay extra for additional frameworks?

   No. Every framework CertAssist supports is included in the one plan, and you can run as many assessments across as many frameworks as you like, including ISO 27001, SOC 2, ISO 42001, ISO 9001, ISO 14001, ISO 45001, HIPAA, GDPR, PCI DSS, UK Cyber Essentials, CMMC Level 2, the Essential Eight and DISP.

5. How many users are included?

   Unlimited team members and read-only auditor accounts are both included at no extra cost, because charging per seat punishes you for involving the people who actually hold the evidence. Multi-factor authentication is mandatory on every account.