CORE Evaluate · SOC 2, HIPAA and FedRAMP readiness
Will your code pass the audit? Find out before the auditor does.
Connect your repository, choose the frameworks that matter to you, and CORE checks whether each control actually exists in your code, your infrastructure and your records. You get a readiness score per framework, the file and line behind every verdict, and fixes ranked by how many controls each one clears.
- Frameworks & scope
- System profile
- Tech stack
- Hosting
- Delivery process
- Code & evidence
- Review & submit
Which frameworks?
Pick any combination. Shared controls are checked once and mapped to every framework you choose.
Frameworks covered
Six frameworks, checked against the same evidence.
Most organizations answer to more than one. CORE checks a control once and shows where it counts in every framework you select.
SOC 2
AICPA Trust Services Criteria
Security, availability, processing integrity, confidentiality and privacy. The standard enterprise customers ask SaaS vendors about first.
HIPAA
Security, Privacy and Breach Notification Rules
Administrative, physical and technical safeguards for protected health information, including access, audit and transmission controls.
FedRAMP 20x
GSA's automation-first FedRAMP approach
Key security indicators for cloud services selling to US federal agencies, built around machine-checkable evidence rather than narrative.
FISMA
NIST SP 800-53 Rev. 5 controls
The control catalog behind federal information systems and the authorization to operate, from access control to system integrity.
NIST CSF 2.0
Govern, Identify, Protect, Detect, Respond, Recover
A widely used way to describe and improve a security program, often requested by boards, insurers and partners.
CCPA/CPRA
California consumer privacy law
Personal data inventory, consumer rights requests, opt-outs, sensitive data limits and third-party sharing, detected in code where data flows.
How a review works
From choosing frameworks to a higher score.
Follow a review from the first question to self-healed fixes. Each step shows what CORE does and what you get back.
Self-heal. Answers you give once are reused for every framework, so adding a framework later never means starting over.
What you get
- A control set tailored to your system
- An estimate of how much code alone can prove
- The evidence you will need, listed up front
Choose frameworks and scope
Tell CORE what matters, once.
Pick any combination of frameworks, set the purpose and scope of the review, and answer a short set of guided questions about your system. Shared controls are checked once and mapped to every framework you choose.
What CORE does
- Any combination of SOC 2, HIPAA, FedRAMP 20x, FISMA, NIST CSF 2.0 and CCPA/CPRA
- Purpose: a first check, an audit, an authorization or a customer questionnaire
- What is in and out of scope
- Design-only at a point in time, or design and operating over a period
- System profile: users, tenants, data types and AI features
- Tech stack, hosting and delivery process
Self-heal. When evidence is missing, CORE says exactly which file or record would settle the control, instead of guessing.
What you get
- An inventory of the evidence received
- Coverage for technical, program and inherited controls
- A short list of evidence still missing
Connect code and evidence
Read-only access. Nothing leaves your control.
Connect a repository or upload the code, then add whatever evidence you have. Tool connections are read-only, and CORE shows which controls each piece of evidence can prove.
What CORE does
- Repository link or code upload
- Infrastructure-as-code and pipeline configuration
- Cloud configuration exports
- Existing scan and test reports
- Policies, procedures and sample records
- Read-only connections to the tools you already use
Self-heal. Re-run the review at any time; only what changed is checked again, and scores update automatically.
What you get
- A verdict for every control
- Readiness by framework and by domain
- Progress you can watch as the review runs
Every control checked
Each control traced to the code and records behind it.
CORE works through every selected control: reading the code and infrastructure for technical controls, and the policies and records you supplied for program controls. Controls your cloud provider covers are marked as inherited.
What CORE does
- Technical controls checked in code and infrastructure
- 160 program controls checked against your policies and records
- Shared controls checked once, mapped to each framework
- Cloud provider controls marked as inherited
- Operating evidence sampled for period reviews
- Scores by framework and by control domain
Self-heal. Findings that live in code or configuration are queued for self-heal; the rest come with clear next steps.
What you get
- Findings your engineers can act on immediately
- Evidence an assessor can follow
- No rounded-up scores
Verdicts with evidence
The file, the line and the controls it breaks.
Every verdict links to the evidence behind it. Findings show the exact file and line, what the risk is, and every framework control it fails. Anything code cannot prove is reported as not assessed, with what would settle it.
What CORE does
- Five verdicts: Met, Not ready, Cannot verify, Not applicable, Inherited
- File and line references for code findings
- Severity for every gap
- Each finding mapped to all the controls it fails
- Plain-language explanation of the risk
- An honest list of what was not assessed
Self-heal. The top-ranked fixes are the ones self-heal handles first, so the biggest gains arrive soonest.
What you get
- A prioritized fix list
- Projected readiness per framework
- Downloads as PDF, Markdown or JSON
Fix once, clear many
Start with the fixes that move every framework at once.
One problem in code usually fails controls in several frameworks. CORE ranks fixes by how many controls each one clears, so the first few changes raise every score together.
What CORE does
- Fixes ranked by controls cleared across frameworks
- Severity and affected frameworks shown for each fix
- Readiness projected for each framework after the fix
- Grouped by owner: code, infrastructure or policy
- Exports for your tracker and GRC tool
Self-heal. This tab is self-heal itself: find, fix, re-check and re-score, with your team approving every change.
What you get
- A pull request per fix
- Before and after readiness scores
- An audit trail of what changed and who approved it
Self-heal and re-score
Gaps in code come back as reviewed fixes.
For gaps that live in code and configuration, CORE writes the fix, opens a pull request for your team, re-runs the affected checks and updates your readiness score. Nothing merges without your approval.
What CORE does
- Writes fixes for code and configuration gaps
- Opens a pull request with an explanation
- Re-runs the affected checks automatically
- Updates readiness scores for every framework
- Records each change in the audit trail
Readiness assessment of your code, infrastructure and records. Not a certification or attestation.
The readiness report
Know which audit you are closest to, and what stands in the way.
api/src/invoices/invoices.controller.ts:L42api/src/config/payments.ts:L14infra/cognito.tf:L21SOC 2 by domain
| Domain | Readiness | Met |
|---|---|---|
| Access control | 68% | |
| Change management | 84% | |
| Encryption & secrets | 61% | |
| Logging & monitoring | 79% | |
| Vendor management | 72% | |
| Incident response | 88% |
Download the full report as PDF, Markdown or JSON for your GRC tool.
Honest verdicts
Every control gets a verdict, and every verdict has a reason.
CORE does not round up. If code cannot show that a control exists, the report says so rather than guessing.
Beyond the code
160 program controls, mapped to every framework.
Auditors ask about more than code. CORE's program controls cover the policies, processes and records around your software, so one set of answers serves every framework you select.
Two review types. A design and operating review over a period tests samples of real records, closer to a SOC 2 Type II or continuous monitoring. A design-only review checks that policies and controls exist as of a date.
Code & infrastructure
Access, encryption, secrets, logging and configuration, read directly from the repository and IaC.
SDLC & operations
48 controls on change approval, code review, testing, backups and deployment.
Policies & governance
41 controls on written policies, risk assessment and management oversight.
Incident management
18 controls on detection, response, notification and lessons learned.
People, vendors & privacy
53 controls on onboarding and training, third-party risk, and how personal data is handled.
Self-heal closes compliance gaps, not just reports them.
For gaps that live in code and configuration, CORE writes the fix, re-runs the checks, and updates your readiness score. Your team reviews each change before it merges.
- Missing ownership checks added
- Committed secrets moved to a vault
- MFA and logging configuration tightened
- Readiness re-scored after every fix
What this is, and is not. A compliance readiness review is an assessment of your code, infrastructure and program records. It shows where you stand and what to fix before an independent audit. It is not a certification, attestation or legal opinion, and only an accredited assessor can issue those.
CORE's own security posture
How CORE handles your code and data.
You are trusting us with your source code. Here is exactly how we treat it, including what we do not yet hold.
Zero data retention
Arrangements with our AI providers mean your code, requirements and documents are not stored by them or used to train any model.
Checks and balances
Multiple AI providers handle different stages, so one model's output is checked by another before your team sees it.
Encrypted everywhere
TLS 1.3 in transit and AES-256 at rest, with secrets held in dedicated secret stores, never in code or logs.
Post-quantum preparedness
Designed with tomorrow's cryptographic threats in mind, not only today's.
Your data, your clock
Delete project data whenever you like. Anything left is cleaned up automatically after 30 days.
Access and audit
SSO with SAML or OIDC, MFA for administrative access, role-based permissions, and an audit trail naming the person behind every approval.
Read-only by default
Repository and tool connections for reviews are read-only. Changes reach your code only as pull requests your team approves.
Runs in your cloud
Delivered software is standard source code in your repository, deployed in your environment, with no runtime dependency on CORE.
About SOC 2. SSDB Tech does not hold its own SOC 2 attestation and has not applied for one. We would rather say that plainly than have you find it in a security review. We complete standard security questionnaires such as CAIQ and SIG on request. For our security package or to report a vulnerability, email security@ssdbtech.com. Policies: Security policy · Privacy policy · Acceptable use.
Questions about compliance readiness
Which compliance frameworks does CORE check?
SOC 2, HIPAA, FedRAMP 20x, FISMA (NIST SP 800-53), NIST CSF 2.0 and CCPA/CPRA. You can select any combination, and controls shared between frameworks are checked once and mapped to each.
Does a CORE readiness review certify us as compliant?
No. It is a readiness assessment that shows where your code, infrastructure and program records stand against each framework and what to fix before an independent audit. It is not a certification, attestation or legal opinion.
What does CORE need access to?
Read-only access to your repository, or an upload of the code. For deeper coverage you can add infrastructure-as-code, pipeline configuration, cloud exports, existing scan reports, read-only tool connections, policies and sample records.
What happens to controls that code cannot prove?
They are marked Cannot verify or listed as not assessed, with what evidence would settle them. CORE does not guess a control into a pass.
Can CORE fix the gaps it finds?
Yes, for gaps in code and configuration. Self-heal writes the fix, re-runs the checks and updates the readiness score. Each change is raised for your team to review before it merges.
Does SSDB Tech hold a SOC 2 attestation?
No. SSDB Tech does not hold its own SOC 2 attestation and has not applied for one. We complete standard security questionnaires such as CAIQ and SIG on request, and our security package is available from security@ssdbtech.com.
Know where you stand before the audit starts.
Tell us which frameworks matter and when your audit is. We will show you where your code stands and which fixes clear the most controls.