---
title: "Automated evidence collection"
canonical: "https://auditbadger.com/features/automated-evidence-collection/"
last-updated: "2026-10-18"
---

# Automated evidence collection

Connect your cloud, developer, workflow, and workspace tooling once and AuditBadger collects compliance evidence mapped to SOC 2 and ISO 27001 controls. It reduces the pre-audit cycle of taking screenshots and exporting configurations by hand.

## Supported integrations

| Integration | Evidence areas |
|---|---|
| **AWS** | IAM, logging, encryption, networking, and security configuration |
| **GCP** | IAM, audit logs, encryption, networking, and security configuration |
| **GitHub** | Organization access, branch protection, security features, and audit logs (audit logs need GitHub Enterprise) |
| **Cloudflare** | TLS, WAF, DNS, and edge security settings |
| **Azure** | Cloud identity and infrastructure evidence |
| **DigitalOcean** | Cloud infrastructure and security configuration evidence |
| **Scaleway** | Cloud infrastructure and security configuration evidence |
| **Linear** | Change and work-tracking evidence |
| **Shortcut** | Change and work-tracking evidence |
| **Google Workspace** | Identity, access, and workspace configuration evidence |
| **FleetDM** | Device management and endpoint configuration evidence |

## Schedules

Evidence is collected on a schedule (monthly by default), plus on demand whenever you want a fresh answer.

## Compliance control coverage

| Framework | Section | Evidence support |
|---|---|---|
| **SOC 2** | CC6: Logical & Physical Access | Access and identity evidence |
| **SOC 2** | CC7: System Operations | Logging and monitoring evidence |
| **SOC 2** | CC8: Change Management | Source control and work-tracking evidence |
| **ISO 27001:2022** | A.5 Organizational Controls | Policy, vendor, and governance evidence |
| **ISO 27001:2022** | A.8 Technological Controls | Cloud, identity, and repository evidence |
| **ISO 27001:2022** | A.8.25 to A.8.28 Secure Development | Secure development evidence |

A single evidence source can satisfy controls across both frameworks; mapping is done once.

## Auto-verification

Each evidence sample is checked against compliance rules (e.g. "S3 buckets must have encryption at rest enabled" → fails if any bucket is unencrypted). Failed collections notify you, and failing checks go to the top of your dashboard; auditors see both the raw evidence and the verification result.

## Security model

- Read-only, scoped access for cloud, code, and device integrations
- External ID protection against confused-deputy attacks (AWS)
- Scoped API tokens where supported by the source system
- AWS and GCP calls show up in your own logs (CloudTrail, Cloud Audit Logs)
- Single-click access revocation

## Useful links

- Sign up: [auth.auditbadger.com/signup](https://auth.auditbadger.com/signup)
- All features: [/features](/features)
- SOC 2 deep dive: [/compliance/soc2](/compliance/soc2)
- ISO 27001 deep dive: [/compliance/iso27001](/compliance/iso27001)