Compliance Engineering Platform

Automated Audit Evidence Pipeline

Live

Evidence automation

OIDC Cosign OSCAL

Audit preparation is one of the most expensive recurring costs in a compliance program. Teams spend weeks manually gathering screenshots, exporting logs, and assembling evidence packages. Then an auditor asks for something that was not collected, and the cycle repeats.

This pipeline automates that entire process. Every compliance artifact is collected automatically on every deployment, cryptographically signed with a verifiable identity claim, timestamped, and stored in a tamper-evident vault. Auditors get a link, not a spreadsheet.

3 weeks

Manual audit prep eliminated

Long-lived credentials in the pipeline

100%

Artifacts cryptographically signed

Try it. Run the pipeline.

Trigger an evidence collection run or verify an existing artifact against the Cosign transparency log.

Collecting evidence artifact...

Recent artifacts

How it works

01

Pipeline triggers on every deployment

GitHub Actions fires the evidence collection Lambda on every push to main. No manual steps, no reminders, no missed deployments.
02

OIDC authenticates without long-lived credentials

The pipeline authenticates to AWS using OpenID Connect. No access keys stored anywhere. Every credential is short-lived, scoped, and tied to a specific workflow run.
03

Cosign signs every artifact

Each evidence artifact is signed with Cosign keyless signing. The signature includes the workflow identity, repository, and a timestamp. It is written to the public Rekor transparency log and cannot be forged.
04

S3 Object Lock stores it permanently

Artifacts land in an S3 Object Lock vault with WORM protection. They cannot be deleted or modified, even by an administrator. Auditors get read-only access to exactly what they need.

Stack

S3 Object Lock OIDC Cosign OSCAL GitHub Actions Lambda DynamoDB CloudFront

Part of the Compliance Engineering Platform, built from the S3 Object Lock evidence vault, OIDC pipeline, and Cosign keyless signing developed across 11 labs. This is what those controls look like running continuously in a real pipeline.

Changelog

Jul 6, 2026 Interactive demo launched. Collect and verify flows both live against the evidence pipeline.

Jul 6, 2026 Cosign verification check wired to artifact feed. Signature status now displayed per artifact.

Jul 5, 2026 OSCAL output format added. Evidence packages now export in machine-readable OSCAL SSP format.

Jul 3, 2026 S3 Object Lock vault retention policy set to 7 years, matching HIPAA audit retention requirements.

↗ GitHub repo ← Back to platform ← All projects