Plain questions. A clear picture.
Answer questions a founder can answer, with each one explaining why it matters. Proofroom skips what doesn't apply, checks through your connected systems instead of asking, and turns the answers into a score for every area of security, a starting risk register, and the frameworks that apply to you.
Payments · question 3 of about 6Do staff ever see a full card number on a screen?Never: only the last four digitsSelected: Some staff, when they need itI'm not sure
Why we askNo software can stop a phone camera. The safest fix is never showing the full number; then hiding it by default and logging every reveal.
A plan before an audit, not after.
See what SOC 2, PCI DSS or another framework would take before you commit. Every action says what it closes and in how many frameworks: adopt a ready-made policy, switch on a recurring check, connect a system, or decide on a risk. Start the audit when you're confident.
If you pursued SOC 264% ready
- 38 done
- 9 partly
- 14 not done
- 3 not applicable
- PolicyAdopt the Vendor Management PolicySOC 2 CC9.2 · already meets PCI 12.8
- CheckSwitch on the quarterly vendor reviewCC9.2 · PCI 12.8.4
- ConnectConnect your HR system for joiners and leaversCC6.2, CC6.3 · PCI 8.2.6
- DecideDecide on the shared payroll admin accountCC6.1
Your auditor's list, answered.
Evidence collects itself from your systems all year and is reviewed as it arrives. Import your auditor's request list, link what they asked for, and hand over one folder per request. Up to three auditors per audit sign in free; a PCI assessor records findings in Proofroom too.
- REQ-014Quarterly user access reviews, Q1–Q33 filesAccepted
- REQ-022Change approvals for a sample of 25 releases25 filesProvided
- REQ-031Incident response test results2 filesProvided
- REQ-040Vendor SOC 2 reports for critical suppliersNo files yetOpen