Live demo · Foundry Labs, Inc. is fictional dataHow setup worksGet Controls · from $99/mo

Settings

Organization, notifications, audit periods, and framework currency.

Organization

Shown in the dashboard header, the printed report, and the auditor share link. Host the image on your own asset host; the URL must be HTTPS.

Notifications

Posted to when new check failures are detected after a run.

Email notifications require SMTP integration (coming soon).

Authentication

App password is set via APP_PASSWORD in .env. Edit and restart to change.

For Clerk managed auth, see src/lib/auth-providers/clerk.ts.

Audit Periods

SOC 2 Type II requires a defined observation window (typically 6–12 months). Create a period before your audit starts.

Create new period

License

Your Scorifya Controls license key. Check runs and attestations are paused when inactive.

Keys are validated against your LICENSE_VALIDATION_URL. Without a validation server, keys stay inactive unless LICENSE_DEV_MODE=1 is set for local development.

Audit Access

Generate a time-limited read-only link to share with your auditor or CPA firm. Each link shows all automated check results, manual control attestations, and RFC 3161 timestamps.

Generate new link

Framework versions in use

The framework versions your Controls instance is mapped against, when Scorifya last confirmed them, and where the canonical source lives.

SOC 2SOC 2 TSC (2017, revised 2022)TSC-2017

AICPA Trust Services Criteria. Base is 2017; points of focus were revised in 2022 without a version bump (still referred to as TSC 2017).

Effective: 2017-04-15Last reviewed: 2026-07-02 by ScorifyaNext review: 2027-01-02 (in 128d)
Canonical source
PCIPCI DSS 4.0.1DSS-4.0.1

Released June 2024. All future-dated 4.0 requirements have been enforceable since 31 March 2025.

Effective: 2025-03-31Last reviewed: 2026-07-02 by ScorifyaNext review: 2027-01-02 (in 128d)
Canonical source
ISO 27001ISO/IEC 27001:202227001-2022

Third edition. Annex A restructured to 93 controls in 4 themes (Organizational, People, Physical, Technological). Companion guidance is ISO/IEC 27002:2022. Amendment 1:2024 (climate action) is published and acknowledged in the framework-watch baseline; it adds no Annex A controls and does not affect mappings.

Effective: 2022-10-25Last reviewed: 2026-07-10 by ScorifyaNext review: 2027-01-10 (in 136d)
Canonical source
HIPAAHIPAA Security Rule (45 CFR Part 164, Subpart C)Security-Rule-2013

Omnibus Final Rule baseline. A December 2024 NPRM proposes making all addressable implementation specifications required; re-check for the final rule at every review and bump the version if it lands. Breach Notification Rule (Subpart D, 164.400-414) citations are included for manual controls.

Effective: 2013-09-23Last reviewed: 2026-07-11 by ScorifyaNext review: 2027-01-11 (in 137d)
Canonical source
CMMC L1CMMC Level 1 (self-assessment)2.0-L1

32 CFR Part 170 final rule. Level 1 is the 17 practices from FAR 52.204-21 basic safeguarding of Federal Contract Information (FCI), met by annual self-assessment plus an affirmation recorded in SPRS. Level 2 (110 NIST SP 800-171 controls, mostly C3PAO-assessed) is deliberately out of scope; revisit if L1 sees adoption.

Effective: 2024-12-16Last reviewed: 2026-07-11 by ScorifyaNext review: 2027-01-11 (in 137d)
Canonical source

When the authority publishes a new version, Scorifya updates the registry, refreshes the check mappings, and ships a Controls release. Upgrade with docker compose pull && docker compose up -d.

Framework Currency

Checks should be reviewed against the current AICPA TSC 2017 (SOC 2), PCI DSS 4.0.1, and CIS Benchmarks at least quarterly.

Remediation targets

Days until a new finding is due, by severity. These are your organization's policy, not framework requirements; auditors will ask whether you met your own targets, so pick numbers you can keep.

Network transparency

Every outbound connection this instance can make. Nothing else leaves your server: check results, evidence files, and cloud credentials stay local.

Probes the license server and timestamp authorities only. Cloud connectivity is tested per-integration on the Integrations page.

Everything in this demo runs the same way in your own deployment, with your own data, on your own infrastructure.

Self-hosted · from $99/mo · no per-seat charges · 30-day money-back guarantee · setup in about 10 minutes