Audit evidence from your APIs. Signed, mapped and already in Drata.
ApiTraffic already watches your firewall, your vulnerable packages, your vendors and your sensitive data. Compliance records how each control stands every day, maps it to SOC 2, PCI DSS and HECVAT, and hands your auditor signed evidence packs, uploaded to Drata or Sprinto for you.
Turn it on today. Have evidence today.
No questionnaire to fill and no agent to install: the evidence comes from what ApiTraffic already sees in your API traffic.
Turn it on
The checks run the moment you open Compliance, so you see where you stand before your first audit meeting. Run them again whenever you fix something.
Run checks nowEvidence every day
Every morning each check is recorded for the day before, with the records behind it as they were. A bad day becomes an exception with the day it passed again.
Pass · Attention · Not assessedPacks your auditor trusts
On the 2nd of each month, a signed pack per framework. Ask for any other period, environment or set of buckets whenever the auditor does.
manifest.json + manifest.sigYour compliance platform fills itself
Connect Drata or Sprinto once and map ApiTraffic’s controls to yours. From then on, each month’s signed evidence pack lands on the controls it backs, without anyone downloading a zip and uploading it again.
Drata
- Connect
- An API key with workspace, control and evidence permissions, in the NA, EU or APAC region.
- Every month
- One evidence item in your Evidence Library per pack, holding every file and linked to every control you mapped.
Sprinto
- Connect
- An admin token from Sprinto’s Developer API, in your region.
- Every month
- The pack’s files uploaded as evidence to every monitor you mapped, ten files at a time.
Connect
Paste a key or token. ApiTraffic checks it with the platform before saving it, stores it encrypted and only ever shows its last four characters.
ConnectedMap, with suggestions
Each ApiTraffic control comes with a suggested match from your platform. Accept them, change any that are wrong, and leave a control unmapped to keep it in the pack only.
Use suggestionsPushed on the 2nd
Each framework’s pack is uploaded as it is built. Push an earlier month any time; a pack that failed is tried again.
Push| Uploading evidence by hand | ApiTraffic push | |
|---|---|---|
| Every month | Someone remembers, downloads and uploads | Pushed when the month’s pack is built |
| Which controls | Chosen again each time | Mapped once, every change in the account history |
| Retries | Duplicates if you try twice | Never a second copy: each push is recorded |
| File size limits | Split by hand, signatures broken | Split into zip parts, the signed manifest untouched |
| When it breaks | Noticed at audit time | Failing or credential refused, shown and recorded |
The controls ApiTraffic can actually see
Each framework maps its controls to checks. Every control says what ApiTraffic shows for it and what you still need to cover yourself, and counts are of controls, never a percentage that would suggest we cover your whole framework.
SOC 2
2017 Trust Services Criteria
CC6.1, CC6.6 to CC6.8, CC7.1 to CC7.4, CC8.1, CC9.2 and C1.1
PCI DSS 4.0.1
The API-facing requirements
3.3.1, 3.5.1, 4.2.1, 6.3.1 to 6.3.3, 6.4.1, 6.4.2, 10.2, 10.5.1, 12.5.2 and 12.8.1
HECVAT 4.1.6
For higher-education vendors
Application security, vulnerability and change management, logging, authentication, third parties and data, each with a suggested answer
Evidence an auditor would otherwise ask you for
Every check runs for the whole account and for each environment, and keeps the records behind it as they were that day, so evidence for a past day never depends on what is in the app today.
Firewall enforcing in production
Every production bucket with traffic has a WAF policy in block mode, outbound protection is on, and every policy change has its entry in the account history.
Vulnerabilities fixed on time
Critical, KEV and high findings in the packages your services run, held to your SLAs and to PCI DSS 6.3.3’s one-month patch window, with every accepted risk documented.
Every vendor known and reviewed
Destination watch lists every API your code calls. A destination waiting for review longer than 14 days is an exception, and so is one receiving sensitive data unapproved.
Sensitive data redacted
Card numbers, secrets, government ids and health data reaching ApiTraffic unredacted in production put the check in attention until the field is redacted or accepted.
Changes explained
Drift detection is on in production, and no unexplained breaking API change stays open longer than 7 days.
Logs, access and certificates
Request logs kept for 12 months, MFA required for every member, no forgotten API tokens, and every outbound HTTPS host’s certificate monitored.
Signed, so your auditor never has to take our word for it
A pack is a zip with a summary PDF, the daily states, every exception and the records behind each check. manifest.json lists the SHA-256 of every file, and manifest.sig signs it. Packs never hold request bodies, headers or client IP addresses.
- Monthly packs on the 2nd, per framework, kept for six years
- Any period, environment or set of buckets on request, for an audit that covers only some APIs
- Every download recorded in the account history, with who downloaded it
# manifest.sig signs the exact bytes of manifest.json (ECDSA P-256)
openssl dgst -sha256 -verify key.pem \
-signature manifest.sig manifest.json
# Verified OKKnow where card numbers and secrets flow
Discovery samples your traffic and finds the fields carrying card numbers, secrets, government ids, health, student and personal data, inbound and outbound. For each one it shows whether the value is redacted and which vendors receive it. Only where the field is and what it holds are stored, never the value.
- Validated, not guessed: card numbers pass the Luhn check, IBANs their checksum
- A map by endpoint and destination, with secrets in credential headers set apart
- An alert when payment, secret, health or government id data shows up unredacted in production
What ApiTraffic covers, and what it doesn’t
Compliance covers the controls ApiTraffic can see in your APIs: the firewall, vulnerabilities in the packages your services run, outbound vendors, certificates, change detection and sensitive data. Your framework has many more, such as policies, HR, physical security and your infrastructure. Your auditor or your compliance platform tracks those, and every control in ApiTraffic says what you still need.
See your SOC 2 evidence before your auditor asks.
Turn on Compliance, run the checks, and see which controls already pass and which need attention.
Free trial · No credit card · Set up in minutes