SOC 2 · CC8.1
Change Authorization
Every merged diff produces a signed change record tied to the PR author, approver, and deployment — ready to export directly as SOC 2 Type II evidence.
Compliance & Trust Center
Continuous compliance mapped to every pull request.
Stop chasing screenshots at the end of the quarter. Impulsed verifies SOC 2, ISO 27001, GDPR, and HIPAA controls directly on your Git diffs before code reaches production.
Security and compliance
Mapped to the controls your auditor actually checks.
Impulsed doesn't just flag code issues — each pull request is evaluated against your active compliance framework and exported as immutable, auditor-ready JSON evidence.
Run a live control checkSOC 2 · CC6.1
Logical Access & Secrets
AST-aware diff analysis detects committed credentials, weak JWT/hashing schemes, and missing webhook signature verification before they reach main.
SOC 2 · CC7.2
Anomaly & Vulnerability Monitoring
Continuous PR scanning flags abnormal schema alterations, unauthorized PII expansion, and unindexed hot-path database migrations.
SOC 2 · CC6.2 & CC7.3
Access Provisioning & Rollback Plans
Tracks privilege-relevant changes automatically while generating explicit deployment rollback checklists — the exact evidence auditors ask for.
ISO/IEC 27001 · A.8.32
Change Management Controls
Attests every production release to documented risk assessments, separation of duties, and pre-deployment testing verification.
GDPR Art. 32 · HIPAA §164.312
PII & PHI Data Boundary Protection
Flags unencrypted sensitive fields, logging of regulated identifiers, and cross-border telemetry payloads before deployment.
Auditor Mapping Reference
How AST diff signals map to formal audit clauses.
Every finding generated by Impulsed includes the exact framework citation, remediation snippet, and SHA-256 commit attestation.
| Framework | Mapped Clauses | AST & Diff Signals Verified | Exported Evidence |
|---|---|---|---|
| SOC 2 Type II | CC6.1, CC6.6, CC6.8, CC8.1 | Auth middleware bypasses, hardcoded secrets, unreviewed schema migrations, and missing change-management evidence. | Signed JSON + SARIF 2.1.0 + Vanta/Drata webhook payload |
| ISO/IEC 27001:2022 | Annex A.8.4, A.8.9, A.8.25, A.8.28 | Secure coding regressions, configuration drift in Terraform/K8s manifests, and privileged access modifications. | Statement of Applicability (SoA) PR trace log |
| GDPR & EU Data Privacy | Articles 25 & 32 | PII/email/token fields logged in plaintext or exposed in unencrypted analytics/webhook payloads. | Data-protection-by-design diff attestation |
| HIPAA Security Rule | 45 CFR §164.312(a)(1), (b), (e)(1) | ePHI model mutations without audit-log decorators or TLS/encryption enforcement. | HIPAA technical safeguard verification report |
Zero False-Positive Allowlists
Scope rules by path, service owner, or test fixture directory via `.impulsed.yaml`.
Auditor-Ready Packets
Export a complete quarterly bundle of signed PR approvals in one click.
Strict Zero Data Retention
Source code is analyzed in ephemeral memory and never written to disk or used for training.