For auditors
Evidence you can verify without trusting us.
You shouldn’t have to take a vendor’s screenshot on faith. ACSE evidence is a signed, hash-chained record kept in your client’s own account. You check it on your own machine, with an open verifier, no network and no ACSE account.
Independent assurance
Two independent verifiers, in Python and TypeScript, must reach the same verdict on the chain, the signatures and the seal.
The full story of each change
The finding, the policy version, the fix and its testing, the approver and what they saw, the merge and the verification.
Organized the way you test
Audit packages are arranged per framework control, from sealed cases.
Verifying a case
How you check the record
- Receive the bundleYour client exports a case or an audit package from ACSE and hands it to you.
- Run the verifierRun the open verifier on your own machine. It needs no network and no ACSE account.
- Read the verdictIt confirms every record links to the one before, every signature is valid and the seal is intact.
What a record proves
The facts bound into the chain
- Authorized
- The approver’s authenticated identity, step-up MFA, and a hash of the exact view they approved
- Segregated
- The author, requester and approver are different people
- Tested
- The offline plan, the planned-state policy check and the blast-radius judgement
- Reversible
- The recovery plan shown at the time of approval
- Verified
- An independent re-read of the resource after the change, and the observation window
- Tamper-evident
- Hash-chained, signed and stored under Object Lock in the client’s account
Governance records
Decisions not to fix, on the record too
Attestations, exclusions and exceptions are signed records with a second person behind each. Exceptions name an owner, compensating controls and an expiry.
Reports show the governed score beside the never-altered raw score, with the counts that separate them.
Questions
What people ask us
Do I need an ACSE account?
No. Verification is offline. If your client wants to give you access to the portal, the auditor role is read-only: reports, exports and the people list.
Could ACSE have altered the evidence?
The records are chained by hash and written to append-only storage in your client’s account, so a change by anyone, ACSE included, breaks the chain the verifier checks.
Does ACSE decide whether a control is met?
ACSE evaluates checks and records the results and decisions. Your professional judgement as the auditor is yours.
Keep reading
Related
Evidence
ACSE records every step of every fix in a signed, hash-chained, append-only record in your own account, which an auditor can verify offline.
ReadSolutionsAudit readiness
ACSE builds audit evidence as your team works: sealed cases, packages organized by control and a signed chain your auditor can verify offline on their own.
ReadTrustRead-only and keyless
ACSE connects to AWS, Google Cloud and Azure through short-lived, read-only access you create. No long-lived keys, no admin credentials, no cloud writes.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.