- Devices watched
- 1,284
- Open risks
- 17
- Last check-in
- 2s ago
- compliance frameworks
- 6
- framework controls mapped to checks
- 137
- device checks, run fleet-wide
- 45
- operating systems, one agent
- 3
- native package managers
- 8
- ready-made alert rules
- 23
01Why ComplianceOS
Breaches and failed audits start the same way: a device nobody was watching.
IT teams juggle an MDM, a SIEM, a scanner, HR spreadsheets and scripts stitched together with duct tape. ComplianceOS replaces the sprawl with one console that sees every device, fixes what's wrong, and proves it.
Without
With ComplianceOS
Knowing your devices
Without: Partial lists in an MDM and a spreadsheet
With ComplianceOS: Every device reports in, with its owner
Finding problems
Without: At the audit, or after a breach
With ComplianceOS: At the device's next check-in
Fixing them
Without: One ticket, one machine at a time
With ComplianceOS: One command, one device or a whole group
When someone breaks policy
Without: Nobody notices
With ComplianceOS: Flagged against your own rules
Proving it
Without: Screenshots gathered by hand
With ComplianceOS: Daily results exported as PDF or CSV
Tools to run
Without: Seven, stitched together
With ComplianceOS: One console
Built for the audits you actually face
Trust Services Criteria
15 controls mapped to device checks
ISO 27001
Annex A controls
26 controls mapped to device checks
Security Rule safeguards
19 controls mapped to device checks
Also included: NIST CSF, CIS Controls and PCI DSS. ComplianceOS collects and scores the evidence; certification itself comes from your auditor.
See it play out
Someone installs a personal file‑sync app on a work laptop.
- Monday
Without
Nobody sees it
Someone in sales installs a personal file-sync app to work from home. Customer files start syncing to a personal account.
With ComplianceOS
Matched against your banned list
At its next software inventory the laptop reports the app. It's on your prohibited list, so “No prohibited software” fails, rated high.
- Same day
Without:Still syncing. Nobody's looking.
With ComplianceOS
Removed from the console
An admin uninstalls it from the device's software tab, and the next inventory confirms it's gone.
- Weeks later
Without
Data keeps leaving
The app runs every day on a company laptop. Nobody knows it's there, so nobody removes it.
With:Clean at every inventory since.
- Audit day
Without
No proof of control
The auditor asks how you stop unapproved software. The team has a policy document and no evidence.
With ComplianceOS
Evidence on file
The check backs SOC 2 CC6.8 and ISO 27001 A.8.19, with each device's results and history ready to export as PDF or CSV.
How it ends
Found when the data turns up somewhere it shouldn't.
How it ends
Caught on day one, removed the same day, proven on audit day.
02The platform
The agent is the eyes and hands. The console is the brain.
Compliance you define, evidence you can show.
SOC 2, ISO 27001, HIPAA, NIST CSF, CIS Controls and PCI DSS, mapped to checks that run on every device.
- Per-device pass or fail, with the evidence behind it
- A daily score for every framework, with its history
- Checks are configuration, not code: write your own and map them to any control
- Evidence export as PDF or CSV, ready for the auditor
03
How it works
SentinelGo agent
Windows · macOS · Linux
ComplianceOS backend
Auth · queue · storage · releases
Console
Admins · helpdesk · employee portal
- 01
Authenticate
Each agent signs in with its own identity and gets short-lived tokens, renewed in the background.
- 02
Report
A regular heartbeat, plus periodic full inventory of hardware, software and security posture.
- 03
Act
It picks up tasks, verifies any installer file before using it, runs with timeouts and returns structured results.
- 04
Stay current
It installs only Ed25519-signed releases, checks the checksum and signature first, and refuses anything unsigned.
04Integrations
Works with the tools you already run.
Identity, HR, security operations and vulnerability data plug in from Settings, so ComplianceOS starts from what you already know.
Identity
Microsoft Entra ID
Sign in with work accounts, and bring in each device owner's user and MFA status.
SIEM
Wazuh
Forward device and security events over TLS to the SIEM your analysts already use.
Employee directory
Odoo HR
Sync employees so every device has a known owner, and leavers are caught.
Vulnerability data
NVD
The National Vulnerability Database, matched against every installed app version.
Assistance
OpenRouter
Draft scripts and alert rules from plain English through OpenRouter, or any OpenAI-compatible endpoint such as Ollama.
05Trust and security
A security tool should be the hardest thing to break into.
Every layer between a person and your fleet's data has its own guard.
- 01
Access
Accounts are invitation-only. People sign in with Microsoft or a work email.
- Invite only
- Microsoft SSO
- 02
Permissions
Roles decide who can see and do what, page by page and action by action.
- Role-based
- 03
Data
Access rules are enforced inside the database itself, not only in the app.
- Row-level security
- 04
Agent
Devices check in over HTTPS. Agent updates are verified before they install.
- HTTPS only
- SHA-256
- Ed25519-signed updates
- 05
Accountability
Changes made in the console are recorded: who did it, to what, and when.
- Audit log
06
Roadmap
ShippedMay – Oct 2026
MayDevice inventory
Windows, macOS and Linux devices report in, each with its hardware, software and owner.
MayRemote commands
Run a script on one device or a whole group, and see each result.
MayApp catalog
Approved software, installed on devices from one shared catalog.
MayVulnerability scanning
Installed software matched against known vulnerabilities, device by device.
MayEmployee portal
A self-service page for the people who use the devices.
JulCustom roles
Roles that decide who can see and do what, page by page.
JulJust-in-time elevation
Admin rights granted for a limited time, and only with approval.
JulAdmin activity trail
Changes made in the console are recorded: who, what and when.
AugBitLocker enablement
Encryption turned on remotely, with recovery keys kept in a vault.
AugSIEM forwarding
Device events forwarded to Wazuh.
OctCompliance frameworks
SOC 2, ISO 27001, HIPAA and three more, scored daily with evidence reports.
OctOne-click remediation
Fix a device straight from the alert that flagged it.
OctLarge installers
Installers up to 4 GiB delivered to devices.
OctDirectory sync
People and devices kept in step with Entra ID and Odoo HR.
NowQ4 2026You are here
Desired-state compliance
Checks and policies become one definition of compliant: measured today, enforced next.
Signed task execution
Every remote action integrity-protected, so database access alone can't run a task.
Enrollment packages
One signed package per OS (.msi, .pkg, .deb, .rpm) with single-use enrollment tokens.
NextH1 2027
Drift correction
On Windows and Linux, a setting that drifts is detected and put back within one cycle.
macOS MDM pilot
Apple's built-in MDM: FileVault with key escrow, passcode and firewall profiles.
LaterH2 2027
MDM at scale
Zero-touch enrollment through Apple Business Manager, and OS updates on schedule.
Data-loss visibility
USB and removable-media events and print auditing, reporting counts, never content.
Independent security review
An external review of the agent, updater, release pipeline and backend.
● shipped · ● in progress · ○ planned
Questions
What people ask before they let it in.
Short, straight answers. If yours isn't here, your IT administrator can help.
The machine you aren't watching is the one that gets breached.
Sign in with your work account to see your fleet right now.