Stasys
Monitor every server. Page the right person. Prove it was handled. One agent for Linux and Windows, with monitoring, on-call, security and compliance in one place, and a status page that stays up when yours do not.
Compliance and the Trust Center
Adopt your frameworks, keep the evidence current, and show customers where you stand.
Stasys gathers and organises the evidence an audit asks for. An auditor or certification body still awards the certificate.
Adopt your frameworks
Under Compliance, choose the frameworks you are measured against and write a scope statement for each. Stasys covers 24 frameworks, standards and laws, including ISO 27001, SOC 2, NIS2, DORA, GDPR, PCI DSS, Cyber Essentials and the EU AI Act; your licence sets which ones you can adopt. Only adopted frameworks appear in your reports, exports and on your Trust Center.
Keep the evidence current
- Automatic checks score controls from what your servers are doing.
- Controls about people and process are confirmed by your team. Give each one an owner and a review date, and Stasys reminds them.
- A control done once counts for every framework it applies to.
Before the audit
- Produce the Statement of Applicability and evidence packs as PDFs.
- Send your auditor a read-only pack that expires, or invite them to the auditor portal, where they see only their engagement.
- Use the policy library, risk register, internal audit programme, management reviews and nonconformity register to show the system behind the evidence.
When an incident may be reportable
Confirm that it falls under NIS2, DORA, GDPR, the CRA or the EU AI Act and the statutory deadlines start counting, with draft notices to send.
Help from your AI staff
If you use the AI staff, the AI Compliance Officer drafts the monthly board report, the management review pack and policy updates when something changes. It runs your supplier reviews on a schedule and drafts answers to customers' security questionnaires from your live evidence. A person approves each draft. Seven acts are always a person's: attesting a control, approving the Statement of Applicability, accepting a risk, approving a policy, submitting to a regulator, signing a management review and accepting a supplier's risk.
Your Trust Center
Every install has a public Trust Center in your brand. It shows your scores for adopted frameworks, open vulnerabilities as totals, the date of your last penetration test, your subprocessors, data processing agreement and privacy policy, certificates and badges, and documents you choose to publish. Send its link when a customer asks how you handle security.
Last updated 3 November 2026