Compliance
The controls you have to demonstrate, and the evidence for each.
Security → Compliance tracks controls and the evidence for them.
What it does
Maps controls to the evidence AccelerUp already holds. Most of an audit is producing evidence that a control operated, and much of that evidence is already here.
| Control | Evidence AccelerUp holds |
|---|---|
| Access is reviewed | Audit log, grants |
| Changes are authorised | Approvals, deploy audit ledger |
| Incidents are managed | Incidents and post-mortems |
| Monitoring is in place | Coverage, alert history |
| Backups are tested | Backup records |
| Data is retained appropriately | Retention policies |
The tamper-evident ledger
Deploy history is chained, so a modified or deleted record is detectable.
For compliance this matters because a deploy history that could be quietly edited is not evidence of anything — and the difference between a log and evidence is exactly whether it could have been changed afterwards.
Notification delivery as evidence
Every dispatch attempt is recorded with its outcome. "Was the on-call engineer paged at 03:12?" is a query, not a recollection. See Notification delivery.
Access reviews
The grants page answers "who has access to production right now", and grants expire, so the answer stays small. Standing access is what makes access reviews painful.
Gaps
Controls with no evidence are listed as gaps. A gap found six weeks before an audit is a task; found during one, it is a finding.
Related
- SSO and enterprise — SAML, SCIM, IP allowlisting
- Audit log
Where this behaviour lives: frontend/src/app/compliance/. If the code and this page disagree, the code is right — please fix the page.
Part of Security — Vulnerabilities, compliance, hardening and enterprise identity.