SOC 2 · CC8.1
Change Authorization
Every merged diff produces a signed change record tied to the PR author, approver, and deployment — ready to export directly as SOC 2 Type II evidence.
We build automated PR compliance & release toolsAudit every pull request,
Audit every pull request,
and keep everyone in the loop.
Built for regulated engineering teams & compliance standards
What we do
We unleash your release velocity by verifying compliance controls on every diff and keeping customers & auditors connected.
Live PR Compliance Engine
Audit a live Git diff or pull request.
Fetch any GitHub/GitLab pull request diff, paste your own git diff, or select a scenario. Impulsed evaluates compliance controls with Gemini 3.8 Flash and signs the JSON evidence with HMAC-SHA256.
1. Pull Live PR or Select Scenario
Zero Data Retention (ZDR)Unified Git Diff Input
1,418 / 32,000 chars
Awaiting compliance audit
Click Run Compliance & Release Audit on the left to generate findings, control mappings, release notes, and cryptographically signed JSON evidence.
Security and compliance
Mapped to the controls your auditor actually checks.
Impulsed doesn't just flag code issues — each pull request is evaluated against your active compliance framework and exported as immutable, auditor-ready JSON evidence.
Run a live control checkSOC 2 · CC6.1
Logical Access & Secrets
AST-aware diff analysis detects committed credentials, weak JWT/hashing schemes, and missing webhook signature verification before they reach main.
SOC 2 · CC7.2
Anomaly & Vulnerability Monitoring
Continuous PR scanning flags abnormal schema alterations, unauthorized PII expansion, and unindexed hot-path database migrations.
SOC 2 · CC6.2 & CC7.3
Access Provisioning & Rollback Plans
Tracks privilege-relevant changes automatically while generating explicit deployment rollback checklists — the exact evidence auditors ask for.
ISO/IEC 27001 · A.8.32
Change Management Controls
Attests every production release to documented risk assessments, separation of duties, and pre-deployment testing verification.
GDPR Art. 32 · HIPAA §164.312
PII & PHI Data Boundary Protection
Flags unencrypted sensitive fields, logging of regulated identifiers, and cross-border telemetry payloads before deployment.
Cloud architecture
Designed for security, speed, and zero retention.
How Impulsed processes regulated engineering workloads from pull request webhook to immutable compliance evidence.
Webhook Ingestion.
GitHub Enterprise and GitLab webhooks are ingested via serverless edge workers with strict HMAC-SHA256 signature verification.
Ephemeral AST Sanitization.
Unified Git diffs are parsed inside isolated, ephemeral containers; raw secrets and high-entropy tokens are masked prior to inference.
Frontier Gemini 3.8 Flash Reasoning.
Reasoning runs on Google Gemini 3.8 Flash via the Interactions API with strict Zero Data Retention (store: false) and structured JSON schema enforcement.
Immutable Audit Ledger.
HMAC-SHA256 signed JSON compliance artifacts and customer changelogs are persisted in the workspace ledger ready for Vanta, Drata, or external auditors.
Pricing
Simple, transparent pricing for every release cadence.
Start free in the interactive sandbox. Scale to unlimited automated PR checks and signed auditor evidence as your team grows.
For solo developers & OSS
Starter
Fast compliance checks & release notes for individual repos.
$0/ mo
- Up to 30 PR audits / month
- 1 connected repository
- Standard Markdown release notes
- Live Gemini 3.8 Flash ZDR inference
- Community support
Most popular · Scaling teams
Growth Team
Automated SOC 2 & ISO 27001 evidence across every pull request.
$49/ mo
- Unlimited PR audits
- Unlimited private repositories
- SOC 2 CC8.1 & ISO 27001 HMAC-signed JSON exports
- GitHub & GitLab PR webhook automation
- PR blocking status checks
For regulated FinTech & HealthTech
Enterprise
Dedicated zero-retention inference and custom policy gates.
$199/ mo
- Single-tenant ZDR inference
- Custom compliance policies
- WorkOS SAML 2.0 SSO & SCIM provisioning
- 7-year immutable audit archive
- Dedicated SLA
Testimonials
What engineering teams say
See how platform, security, and product teams ship faster with automated PR compliance.
FinStack Cloud
“Writing SOC 2 CC8.1 change-management evidence used to stall every Friday release. Impulsed generates signed JSON evidence and customer release notes directly from our PR diffs.”
Vanguard Pay
“It caught an unindexed migration and a dropped webhook signature check in the same pull request before it ever hit staging.”
Kinetix Health
“Having HIPAA & SOC 2 control mappings attached to every changelog entry cut our external audit prep time by more than half.”
LedgerFlow
“We replaced manual release-note spreadsheets the week we connected Impulsed. Product managers get clean Markdown changelogs and auditors get SHA-256 attestations.”
Aether API
“The AST-aware diff parser immediately spots breaking GraphQL and REST contract changes that standard linters miss.”
NovaSec
“Strict Zero Data Retention with HMAC-SHA256 signed evidence packets made security sign-off effortless for our compliance committee.”
obol.io
“In less than ten seconds per PR, we have a risk score, remediation advice, deployment rollback steps, and a customer-ready changelog.”
ScaleGrid
“Our external SOC 2 Type II auditor specifically praised the consistency of our CC8.1 and CC6.1 evidence packets.”
SynthCore
“Clean UI, zero noise in pull requests, and release notes we actually dare to publish straight to our customer docs.”
About the Founder
Kevin Yao
Founder & Lead Architect · San Francisco, CA
A platform engineer who spent a decade shipping fintech infrastructure before obsessing over a single question: why is the most important evidence an auditor ever reads — the release note — still written by hand? Impulsed is the answer.
Ready to make PR compliance effortless?
Run a live Gemini 3.8 Flash compliance check on your unified Git diff or pull request right in the sandbox.