Evidence-First Delivery
for Regulated Industries

Every mutation to features, stories, and security events is recorded with who, when, from and to. CSV/JSON export from workspace and organisation Audit Log pages. Configurable retention (default 365 days).

Automated user provisioning via SCIM Users and Groups. OrgAdmin, Developer, Admin, and Stakeholder groups map to RBAC personas. Bearer token rotation in Organisation Security.

ISO 27001, SOC 2 and GDPR control register with coverage status, owner and links to features, epics and release sign-offs. Starter catalog included.

Named approval stages at feature or epic level with approver, deadline, and rationale. Sign-offs are immutable once recorded.

Workspace risk register with impact, likelihood, score, owner, mitigation and heatmap UI. Linked to features and epics; changes appear in the audit trail.

Generate evidence bundles for a feature or release — audit entries, control mappings, risks, policy exceptions and sign-off records. Client JSON download or server-assembled export to encrypted S3 with 24-hour presigned URL.

Per-release sign-off checklist on Release Notes with named approver roles, checklist items and immutable record once signed. Complements feature/epic approval gates.

RBAC matrix per workspace persona, MFA enforcement (TOTP), org-level SSO (SAML/OIDC), SCIM provisioning, step-up auth for destructive actions, and configurable session max age.

Define approved IP and CIDR ranges at organisation and workspace level. Policy is recorded in Security settings; platform-wide enforcement is being extended.

Structured policy exception requests with justification, named approver, expiry date and immutable record once approved. Linked to features and control mappings.

One evidence record per work package and per release: every gate item, both sides of each decision, the evidence behind it, CI results at the assessed commit, provenance and exceptions — assembled from an append-only, hash-chained evidence ledger and downloadable as JSON. It names what it does not know rather than assuming it.

Definition of Ready and Done items name the controls they are evidence for — ISO 27001 A.8.25–A.8.32, SOC 2, NIST SSDF, SLSA or your own. Each passport shows every control as satisfied, waived, not satisfied, not needed or unknown, and never shows one as satisfied without evidence.

A waived checklist item and an override of the reviewer agents are one record: who granted it, under which authority, why and until when. Once expired or voided the item is unmet. An Enterprise organisation sees every exception across its Studios in one register.

Enterprise organisations set checklist items, release rules and separation of duties once; every linked Studio enforces them and may tighten, never loosen. Each activation is a frozen version that work packages and their passports cite.

Approving a release issues its passport: frozen, signed with a platform key and kept as an immutable version. The public keys are published, so an auditor can verify the file offline. A GitHub Actions pipeline the Studio generates verifies the signed passport before each deploy and reports where the release went; the studio owner chooses, per environment, whether a check that does not pass holds the deploy or only warns. A pipeline written by hand is not held until it carries the same job.

Framework × status matrix (ISO 27001, SOC 2, GDPR) with verified percentage and not-started gap list — fed from the Control Mapping register.

On-demand secure export to encrypted storage with time-limited download links from workspace and organisation audit log pages.

Automated health monitoring, public status page, and performance telemetry for operational visibility.

Audit log export is available today. Broader self-service data portability and erasure workflows are in development — contact privacy@productivityworkbench.com for subject access requests.