Cloud connections
Automatic evidence collection from the cloud environment, yours and the supplier's.
Evidence that collects itself
Some security evidence does not need to be attached by hand: it can be read directly from the cloud environment. Encryption settings, access policy, activity logging — things a questionnaire answer asserts and the cloud can confirm.
The connection works for your own environment, feeding the organization's self-assessment, and for a supplier's environment when they agree to connect theirs.
Read-only, and nothing more
The connection is read-only. The platform collects what it needs to corroborate answers and changes nothing in the connected environment — which also means it does not fix a misconfiguration, it only observes one.
Frequency
Collection runs periodically, without depending on someone remembering to trigger it. A failed collection is recorded in the audit log rather than passing in silence — a collector that stopped running and says nothing is indistinguishable from an environment that did not change.
Relationship to the questionnaire
Collected evidence complements the questionnaire, it does not replace it. It serves to corroborate or contradict what was declared — the same role the surface scan plays, with the difference that here there is consent and access, so the reading goes much deeper.