SPHIOR · Enterprise Feature
Scan results flow directly into your compliance platform.
SPHIOR automatically maps every scan result to SOC 2 Trust Services Criteria and pushes audit-support evidence directly to Vanta, Drata, and Secureframe. No manual uploads. No spreadsheets. Every month, automatically.
SOC 2 compliance breaks every time your infrastructure changes.
Add an S3 bucket. Update your auth code. Open a new port. Each change can trigger a "Failed" alert in Vanta, Drata, or Secureframe — and someone has to manually screenshot, upload, and re-map evidence. Every. Single. Month. SPHIOR eliminates that entire workflow.
Scan
Monthly automated scans: Sentinel (CVE), Spectra (DAST), infrastructure (AWS/GCP/Azure/Cloudflare)
Map
Results are mapped to 17 SOC 2 TSC controls. Each control is evaluated as PASS or FAIL based on actual findings.
Push
Evidence is pushed to Vanta (custom checks API), Drata (evidence API with PDF attachment), and Secureframe (Custom Integration JSON ingest) automatically.
Repeat
Every month, the cycle repeats. Your compliance evidence is always current, always audit-ready.
17 SOC 2 Controls Mapped
Every monthly scan automatically evaluates these controls and determines PASS or FAIL based on real scan data — not self-assessments.
Web Security Controls
12Cloud Infrastructure Controls
5Supported Infrastructure
Direct Integration with Vanta, Drata & Secureframe
Custom Integration Checks
sphior.CC6.1 format per TSC controlEvidence API v2
Custom Integration
sphior.CC6.1.YYYY-MM for idempotent monthly upsertManual vs. SPHIOR Automation
| Manual |  SPHIOR | |
|---|---|---|
| Evidence collection | Manual screenshots & CSV exports per tool | Automated after every scan — PDF + structured data |
| Upload to Vanta/Drata/Secureframe | Login, navigate UI, upload files, tag controls manually | Direct API push — zero clicks, controls auto-tagged |
| TSC control coverage | Depends on who remembers — gaps found at audit | 17 controls mapped every cycle — no gaps possible |
| Infrastructure changes | Often missed until auditor flags it | AWS/GCP/Azure/Cloudflare scanned — drift detected & pushed |
| Evidence format | Inconsistent — screenshots, PDFs, spreadsheets mixed | Standardized audit-support PDF with CVSS scores & remediation |
| Audit readiness | Scramble before audit — weeks of preparation | Always audit-ready — evidence current as of last scan |
| Time per month | 4–8 hours of manual work | 0 minutes — fully automated pipeline |
| Annual cost of manual work | $4,800–$9,600/yr (engineer time at $100/hr) | Included in your SPHIOR plan |
Every Push is Logged
Push Log
Every push attempt is recorded: provider, status code, request ID, duration, evidence count.
Evidence Catalog
Full history of PASS/FAIL per TSC control per month. Auditors can inspect any point in time.
Event Log
SOC2_EVIDENCE_COLLECTED events with control satisfaction breakdown. Tamper-evident audit trail.
Month-over-month improvement, pushed automatically
Vanta, Drata, and Secureframe show current Pass/Fail state only. SPHIOR additionally captures an immutable monthly snapshot — new findings, resolved findings, MTTR, posture trend — so auditors see proof of continuous improvement. SOC 2 Type II requires evidence of ongoing operation, not just a point-in-time check.
Current state only
GRC dashboards show 'CC6.1: PASS' — but auditors can't see if it was Fail last month, or how long the fix took.
With SPHIOR12 months of immutable improvement trail
SPHIOR pushes a complete delta snapshot every month — new, resolved, MTTR, posture trend — preserved immutably for ≥24 months.
Audit-ready improvement trail
Auditors see month-over-month progress without asking — SOC 2 Type II requires continuous operation evidence.
MTTR + remediation velocity
Per-severity Mean Time To Resolution is automatically calculated from finding lifecycle — no manual tracking.
Immutable for 24+ months
DB-level trigger blocks UPDATE/DELETE on history rows. Audit trail survives any future change to the system.
Your API Keys Never Leave Encrypted Storage
Connecting Vanta, Drata, or Secureframe requires API credentials (Secureframe uses both API_KEY and API_SECRET). Those credentials grant write access to your compliance platform — they must be protected at rest and in transit. SPHIOR encrypts every credential with AES-256-GCM before storage and decrypts it only at the moment of push, in an isolated worker process.
Encrypted at Rest
API keys are encrypted with AES-256-GCM using a dedicated encryption key before being written to the database. The plaintext key is never stored.
{ iv, ciphertext, tag } → DBDecrypted Only at Push
The key is decrypted inside an isolated Cloudflare Worker at the exact moment the evidence push runs. It exists in memory for milliseconds, then is discarded.
Worker → decrypt → POST → discardZero Exposure Surface
No admin panel, no API endpoint, no log entry ever exposes your key. Even SPHIOR engineers cannot read it — the encryption key is stored in a separate Cloudflare secret, inaccessible from application code.
ENC_KEY → CF Secret