- contact@verticalserve.com
- Continuous compliance, proven every hour
Solutions
One control set, the report your customers ask for
Who uses InsightAssure, which framework they start with, and what it does for them. The examples come from Northwind Labs, the demo company that ships with the product.
SaaS
Your first SOC 2, without screenshot season
A prospect’s security review asks for a SOC 2 Type 2 report. A small team has no policies written, no evidence collected and no idea which of its 30 tools matter to an auditor.
What InsightAssure does
Onboarding adopts SOC 2 with Security, Availability and Confidentiality in scope and drafts the 23 policies. Connecting the identity provider, HR system, cloud and source control starts the monitors; the 61 criteria are mapped to the unified controls, so what is left to do is a list, not a guess.
What you get
- Readiness per criterion, with the controls behind each and why each is failing
- Type 1 (design at a date) for a deal that cannot wait; Type 2 (operation over 3–12 months) with evidence collected as you go
- Policies with approval, versions and per-person acceptance
- An auditor workspace with generated requests and reproducible samples
- A Trust Center and questionnaire answers to send while the report is in progress
In the demo: SOC 2 readiness starts at 18%: 7 of 38 in-scope criteria met, with 47 of 92 controls passing and the failing ones traced to real gaps, such as unreviewed changes in one repository.
Fintech, payroll & billing
SOC 1 for services that touch your customers’ books
If you process payroll, billing, revenue or payments, your customers’ auditors will ask for a SOC 1 report on controls relevant to their financial reporting. There are no prescribed criteria: management writes the control objectives, and the report must say what customers and your own vendors are assumed to do.
What InsightAssure does
SOC 1 ships as 13 template control objectives (ITGC plus transaction input, processing and output) that you rewrite, remove or add to. The system description carries the CUECs your customers must operate and the CSOCs assumed of carved-out subservice organizations, and vendor reviews record each subservice organization’s SOC report.
What you get
- Control objectives as editable rows, mapped to the same controls as SOC 2
- Default CUECs (user access, terminated users, input completeness, report review) and CSOCs (cloud physical and environmental security) to edit
- Subservice organizations as vendors, carved out or inclusive, with report expiry tracked
- A system description drafted from your settings, integrations, people and vendors
- Type 2 populations of changes, hires and terminations, sampled with a recorded seed
In the demo: AWS and Stripe are carved-out subservice organizations; AWS’s SOC 2 Type 2 report is on file with an unqualified opinion and the CSOC “Physical and environmental security of data centers” recorded beside it.
Healthcare
HIPAA Security Rule safeguards you can show
Covered entities and their business associates must implement the administrative, physical and technical safeguards of the HIPAA Security Rule, and be able to show it to a hospital’s vendor review or a regulator.
What InsightAssure does
The HIPAA framework covers 45 CFR 164 Subpart C and the Breach Notification Rule as 69 requirements, each mapped to the unified controls, so the work done for SOC 2 counts here too. A built-in HIPAA privacy and security course trains the workforce, and vendor reviews track the business associates who touch ePHI.
What you get
- Administrative, physical and technical safeguards with required and addressable specifications
- Workforce training with completion tracked per person
- Vendors flagged for PHI, with their reviews and agreements
- Breach notification and incident response controls with their evidence
In the demo: HIPAA reads 46% ready from the same controls that put SOC 2 at 18%: 32 of 69 requirements met.
Payments
PCI DSS v4.0.1 on the controls you already run
Merchants and service providers that store, process or transmit cardholder data are assessed against PCI DSS v4.0.1: network security, secure configuration, encryption, vulnerability management, access, logging and testing.
What InsightAssure does
PCI DSS ships as its 12 principal requirements at the defined-requirement level (63 requirements), mapped to the unified controls. Encryption, MFA, logging, vulnerability SLAs and change review are tested continuously by the same monitors.
What you get
- Requirement-level readiness with the controls behind each
- Vulnerability SLAs by severity (critical 15, high 30, medium 90, low 180 days by default)
- World-open admin ports, public storage and unencrypted databases found as they appear
- A built-in PCI awareness course for staff in scope
In the demo: Two critical vulnerabilities open past the 15-day SLA fail vuln.critical_sla and each opens an issue.
AI companies
ISO/IEC 42001 for an AI management system
Teams building on models are asked how they govern them: what AI systems they run, what data goes in, how outputs are evaluated and who oversees them. ISO/IEC 42001 is the certifiable answer.
What InsightAssure does
ISO/IEC 42001 ships with its clauses 4–10 and Annex A controls (65 requirements), mapped to the AI governance controls AI-01 (AI system inventory and impact assessment), AI-02 (AI policy and acceptable use) and AI-03 (model and data lifecycle) alongside the shared security controls. The AI Governance and Acceptable Use Policy and an AI acceptable use course come with it.
What you get
- An AI system inventory and impact assessments as evidence
- The AI policy with versions and acceptance
- AI acceptable use training for everyone
- Shared controls (access, change, vendors) reused from ISO 27001 and SOC 2
In the demo: The AI Governance policy is still a draft in Northwind Labs, which is exactly what the policies monitor flags.
Consultancies & MSPs
Run many clients’ programs from one place
A firm that prepares clients for SOC 2, SOC 1 or ISO 27001 juggles a spreadsheet per client, evidence in shared drives and no view across them.
What InsightAssure does
This is how VerticalServe uses InsightAssure: one workspace per client on SaaS, consultants holding the compliance role in each, and a portfolio of every client’s readiness, failing controls, issues and audits. Clients with regulated data run it self-hosted and give the consultants accounts there.
What you get
- A workspace per client, isolated by Postgres row-level security
- Portfolio: readiness per framework, control health and open issues across clients
- Each client’s auditor invited to that client’s audit only
- The same policy templates, risk library and answer library for every client
In the demo: The portfolio shows Northwind Labs at 27% average readiness and VerticalServe’s own program, which adopted SOC 1, SOC 2 and ISO 27001, side by side.
