About The Audit Trail

What The Audit Trail is

The Audit Trail rates compliance automation software: the platforms companies use to get through SOC 2, ISO 27001, HIPAA, PCI DSS and the frameworks that follow. Every platform is scored on one rubric, and every score shows its sources.

We are not owned by a vendor, a security consultancy, or an audit firm. Some vendors pay us to be included, and that payment never affects the rankings or the review itself. Any commercial relationship with a vendor is disclosed on every page it touches.

The rubric

The current rubric is version 0.9, published on 23 September 2026. It covers eight criteria, weighted by how much each one shapes a compliance team’s working week:

• Framework coverage (15 points): How many frameworks run out of the box.
• Automated evidence (20 points): How much evidence the platform collects and tests on its own.
• Audit path (15 points): How short the road is from ready to a signed report.
• Pricing transparency (10 points): Whether a buyer can estimate cost before speaking to sales.
• Trust and questionnaires (10 points): How the platform helps you prove compliance to your own buyers.
• Vendor risk management (10 points): Assessing and tracking the risk of your own suppliers.
• Customisation (10 points): Frameworks, controls and tests you build yourself.
• User sentiment (10 points): What verified users report, weighted by how many of them there are.

Each criterion runs from level 0 (missing) to level 5 (its strongest form). A criterion’s points are its level divided by five, times its weight, and the eight add up to 100. Score bands: 85 and above is Exemplary, 70 to 84 is Strong, 55 to 69 is Adequate, 35 to 54 is Limited, and below 35 is Deficient.

The full rubric explains why each criterion carries its weight and what every level takes.

What a score means

A score is a snapshot of what the platform ships on the date printed beside it. Roadmap promises earn nothing until the feature ships. When a vendor ships something new, the score moves and the changelog says why.

Independence and conflicts of interest

Some vendors pay us to be included on The Audit Trail. That payment never affects the rankings or the review itself. Scores come from the rubric and nothing else, and a vendor cannot pay to move up a ranking or to push another vendor down.

We do not hold financial interests in any platform we rate. If this ever changes, we will disclose the relationship and explain how editorial separation is maintained. The details are on how we make money.

We accept re-score requests from vendors. When a score changes, we update the scorecard and record the change in the rubric changelog with the date.

Corrections

If a score or factual detail is wrong, we want to know. Send the source URL that shows the correct information. A correction that holds up is fixed in the record, and the change is noted with the date. The previous score remains visible in the changelog. Our editorial policy describes the full corrections process.

Contact

For corrections, re-score requests, and editorial questions, contact us at hello@theauditrail.com.