01 / YOUR SYSTEMS
Run
You configure the collectors
for your stack.
RENDER COMPLIANCE/epack Audits
The fastest and
most verifiable audit
on earth.
Evidence collected in minutes by configurable open-source collectors. Signed and sealed into a verifiable evidence package.
02 / YOUR EVIDENCE PACK
Verify
We guide you through configuration
of validators so that you can validate
evidence internally pre-audit.
03 / RENDER'S AUDIT
Audit
Render utilizes internal validators
to validate the package then review
machine readable evidence against
defined testing baselines.
01 / YOUR SYSTEMS
Run
You configure the collectors for your stack.
02 / YOUR EVIDENCE PACK
Verify
We guide you through configuration of validators so that you can validate evidence internally pre-audit.
03 / RENDER’S AUDIT
Audit
Render utilizes internal validators to validate the package then review machine readable evidence against defined testing baselines.
No giving out secrets, no snapping screenshots - run securely on your systems, portable evidence we can validate from the source.
What is epack?
A bundle of evidence.
With a way to check it.
Evidence Packs are an open source protocol for packaging and validating audit evidence. Think exports, configurations and documents, accompanied by a manifests and their digital fingerprints.
The epack tools can collect that evidence, package it and sign it. We can then verify the signer and check whether the packaged files have changed.
The software was developed by the good people at Locktivity, who also offer a Review Room for managing epack audits end-to-end, Trust Center for sharing automated and validated compliance results, and an entire ecosystem around evidence gathering, validation, sharing across stakeholders.
Explore the open standard ↗How it Works
Your controls.
Your collectors.
Our audit.
We guide you through the initial epack setup to ensure a smooth path to automation.
Define Scope and Controls.
Render Compliance works with the client to establish SOC 2 system boundaries, identify applicable controls, and agree on evidence requirements.
Configure Evidence Collectors.
The client configures epack collectors for each relevant system, starting with available open-source components and customizing or developing additional collectors as needed to accommodate its technology stack and controls.
Configure Compliance Validation.
The client configures optional validation profiles (YAML) to automatically evaluate collected evidence against defined requirements. Existing profiles can be adapted to align with the client's controls and Render's evidence requirements.
Automate Evidence Collection.
The client establishes a scheduled workflow, such as GitHub Actions, to collect evidence, run applicable validation checks, and generate cryptographically signed Evidence Packs.
Share Evidence with Render.
At agreed-upon intervals or audit milestones, the client provides Render with signed Evidence Packs covering the requested systems and dates, along with any relevant validation results.
Perform Independent Audit Testing.
Render verifies the integrity and provenance of the Evidence Packs and applies its own audit testing procedures, including custom automated validators where appropriate. Render evaluates the results, investigates exceptions, and performs additional procedures as necessary to support its audit conclusions.
Repeat. Monitor Continously.
Schedule collection and configured checks to monitor the status of covered controls throughout the year. Reuse your workflows for the next audit, and share appropriately scoped epacks to answer direct customer inquiries. Continuous visibility reflects the systems, checks and collection frequency you configure; each audit still covers its own scope and period.
Verifiable, in plain English
Good evidence should
stand up to a closer look.
Check the files.
Digital fingerprints make changes to the packaged evidence detectable.
Check the signer.
Signatures let us verify the identity that signed a pack against the identity we expect.
Check the method.
With open collectors and retained versions, we can inspect the collection logic and understand how results were produced.
A valid signature establishes provenance and integrity. We still evaluate whether the evidence is accurate, complete and sufficient for the audit.
A few fair questions
Plain answers.
Do we need another compliance platform?
No particular compliance platform is required to use the open format and epack tools. We can use your preferred platform, Locktivity Review Room, or our own Yak audit platform to manage the audit.
Can epack automate the whole audit?
Automate what’s machine-readable. System configurations? No problem. A third-party risk register? If it integrates, it ships. We tailor the collectors and checks to the data your systems expose. The evidence work gets automated; our auditors still evaluate it and form the opinion.
What happens at the next audit?
Keep the collection running between audits. Scheduled packs and configured checks help you track covered controls throughout the year, while the same workflows support your next audit. You can also share a pack scoped to a customer’s question, after reviewing it for sensitive information and permitted use.
How much time will this save?
That depends on your systems, controls and readiness. We start by identifying where collection creates the most work, then scope the setup and audit together.
Let’s take the busywork
out of your audit.
Show us your systems and controls. We’ll help you see where epack fits.