Docs

Set up, run and extend InsightAssure

Everything here matches the product as it ships. Examples use assure.example.com for your InsightAssure host.

Start in four steps

Sign in to your workspace (VerticalServe SaaS) or install InsightAssure in your own environment with ./install.sh.
Run onboarding: adopt the frameworks you report on, create the policy set from the 23 templates, load the 47-risk library and the 83-answer knowledge base.
Connect integrations: your identity provider, HR system, cloud accounts and source control first. The 65 monitors start judging within minutes.
Invite people: employees open My tasks to accept policies, take training and enroll their laptop with the agent.

From an empty workspace to tested controls: onboarding, the first integrations, people and the first monitor run.

Docker Compose in your own environment: the services, every environment variable, the database role, storage, keys, backups and upgrades.

How connections work, least-privilege credentials, the normalized resource types, CSV import and pushing resources from your own systems.

The macOS, Windows and Linux agent: what it checks, how to enroll a laptop, MDM rollout and what it sends.

The envelope, authentication, the endpoint groups and worked examples with curl.

Where InsightAssure runs and what it uses on each cloud.

Tenancy, roles, sealed credentials and what the AI may see.

Term	Meaning
Organization	Your workspace. Every row carries it; Postgres row-level security on `assure.org` enforces it underneath the API’s own scoping
Framework	A standard you report against: SOC 2, SOC 1, ISO/IEC 27001, HIPAA, PCI DSS, NIST CSF, GDPR, ISO/IEC 42001, or your own. Adopting one copies its requirements into your workspace
Requirement	A criterion, objective, clause or safeguard of a framework (SOC 2 CC6.1, SOC 1 CO-01, ISO A.8.5). Met when every in-scope control mapped to it is passing or not applicable
Control	One of 114 unified controls (IAM-02 Multi-factor authentication, CHG-02 Peer review of changes…). Its health is passing, failing, needs evidence, not started or not applicable
Monitor	An automated test over the inventory or the program itself. 65 ship; each feeds named controls and opens an issue when it fails
Resource	One normalized thing an integration found: an account, an employee, a device, a repository, a bucket, a finding. 20 types
Evidence	A file, link, statement or automated snapshot, linked to controls and, through requests, to audits. Manual controls need evidence inside their frequency window
Audit	An engagement: a framework, a type (Type 1, Type 2, certification…), a period, a firm, and the auditors invited to it

Role	Can
admin	Everything, including users, integrations and settings
compliance	Run the program: frameworks, controls, policies, evidence, vendors, risks, audits, trust center
contributor	Work the controls, issues, evidence and access-review items assigned to them; read the rest
employee	The employee portal only: accept policies, take training, enroll a device
auditor	Only the audits they are invited to: requests, the evidence attached to them, populations and findings
viewer	Read the program