Managed lane compliance-evidence-lane · revised 12 October 2026
Managed lane
A managed compliance evidence lane: evidence index, access reviews and policy checks
For one control area of one framework: evidence refreshed each quarter, access reviews recorded, policies checked against systems monthly, and one bounded item a month. Proposed GBP 695 a month.
An enquiry starts a fit and scope conversation, not a contract, payment or reserved place. No logins, customer data or account invitations initially.
What the lane takes off your plate
An audit looks at evidence across a period, and the work of exporting, hashing, indexing and reviewing it never stops. Done in a rush before the audit date, it produces screenshots and gaps nobody can explain. Evidence written afterwards to fit the control proves nothing and can sink an audit.
Who it’s for: Founder or operations lead preparing for, or keeping up, a SOC 2 or ISO 27001 audit without a compliance platform, who wants one accountable monthly arrangement for the evidence.
Usually starts when: An audit period is running, evidence is collected in a rush before each audit date, and nobody owns the regular work.
The result: Each quarter the evidence pack for one control area is refreshed and indexed and the access review is recorded for sign-off, and each month your policies are checked against your system exports. One bounded item a month, from the listed jobs, is delivered and accepted. We write no evidence and make no claim about the framework.
What the lane is made of
Each standing report is checked against its own acceptance tests, and each item has agreed acceptance criteria and an accept-or-revise decision. One item is a monthly ceiling, not a completion guarantee. The arrangement continues only under agreed renewal terms.
Get your audit evidence index refreshed every quarter for one control area Standing service Included
Each quarter the same control area is re-exported, hashed and re-indexed, with new and closed gaps listed. We write no evidence and make no claim about the framework.
Every quarter, one control area
The same standing service you can buy on its own at its listed price.
Get your quarterly access review ready to sign, with decisions and exceptions recorded Standing service Included
Each quarter a review pack per system (user, role, last use) goes to your named reviewer. Their decisions are recorded with dates, exceptions are tracked to closure, and you get a record to sign.
Every quarter, up to 5 systems
The same standing service you can buy on its own at its listed price.
Get a monthly check that your policies are in date and still match what your systems show Standing service Included
Each month a report lists policies past their review date and statements that no longer match your systems, such as "MFA for all" against three accounts without it, with both quotes.
Every month, up to 15 policies
The same standing service you can buy on its own at its listed price.
Get an audit evidence pack for one control area, with dated exports and gaps named Job First
For one control area, such as access control, you get dated, hashed exports from your own systems mapped to the control text, with population, sample and gaps named. We write no evidence.
Bought separately, once, at its listed price
The first pack that the quarterly refresh then keeps current. It is larger than the monthly allowance.
Get security policies drafted from what you really do, each line confirmed Job Each time it fires
Up to 6 short policies, such as access and backup, written from a fact sheet your owner fills in. Every sentence is confirmed as true today; what you do not do becomes a goal, not a claim.
As the only item that month, for up to 6 policies
Find your Cyber Essentials gaps and get the self-assessment answers drafted Job Each time it fires
A gap list against the five Cyber Essentials controls and a drafted answer for each question, tied to evidence, for your director to check and submit. The assessor decides, not us.
As the only item that month, for a UK organisation of up to 50 devices
Get liability, termination and other contract terms in one sheet, each with page and quote Job Optional
Parties, term length, termination, liability cap, assignment, governing law and more for up to 40 contracts in one sheet, each value with page and quote. Dates are a separate job.
As the only item that month, for up to 40 contracts
Get contract clauses checked against your own written positions, with differences flagged Job Optional
Each contract is compared with the positions your own team has written, such as "no uncapped liability". Differences are flagged with page and quote for your lawyer or owner to decide.
As the only item that month, for up to 10 contracts
Get a first draft of your register of personal-data uses and suppliers, each line sourced Job Optional
A first-draft register of where you use personal data and which suppliers are involved, each line sourced from an app list, invoice or note. Unknowns are listed for your owner.
Within the monthly allowance
Get a register of the AI tools your staff use and a draft use policy to edit Job Optional
A register of the AI tools used in your company, found from app lists, expense lines and consent grants, with the data each may touch, plus a draft use policy for your owner to edit.
Within the monthly allowance
Get a subject access request runbook and deadline tracker, tested on a dummy request Job Optional
A runbook, intake form, deadline tracker and search plan for subject access requests, proved end to end on a synthetic request. The legal calls stay with your named handler.
Within the monthly allowance
Get a tool, run on your systems, that lists the documents and emails mentioning one person Job Optional
For one subject access request, an index of candidate documents and emails that mention the named person, built by a tool you run on your own systems. We never see the content.
As the only item that month, for one request, after your handler is named
Get proposed redactions on subject access documents, for your handler to accept or reject Job Optional
For one subject access request, proposed redactions of other people's details in documents your handler selects. Each cites the rule your handler set, and the handler decides every one.
As the only item that month, for up to 300 pages
Keep your contract dates register current, with notice deadlines due in the next 90 days Standing service Optional
Each month new or amended contracts are added to your register with quoted clauses, and you get a list of notice deadlines falling in the next 90 days.
Bought separately
Renewal and notice dates, a standing service of its own, not part of the monthly allowance.
Keep your register of personal-data uses and suppliers current as you add tools Standing service Optional
Each month new suppliers and tools found in your app lists and invoices are added to the register with a source, and ended or changed ones are flagged. The legal columns stay yours.
Bought separately
A standing service of its own, not part of the monthly allowance.
How an engagement works
One framework and control area, one active item at a time and at most one agreed bounded item a month, worth up to GBP 300 at its listed one-off price. One is a ceiling, not a promise of completion, unlimited throughput or a fixed turnaround. Delivery days and monthly capacity are confirmed in writing; none is promised on this page.
How it starts
You send the framework, the control area, the list of systems and your response to the proposed monthly price, without logins or exports.
We confirm fit, the auditor's evidence format, the first pack and who signs the access review.
We agree the monthly scope, delivery days, item sizes, price, payment terms and cancellation terms in writing.
Each quarter we refresh the evidence pack and the access review record, each month we check policies and deliver the chosen item, and we send the summary.
Who decides what
You choose items, sign the access review record and make every change in your own systems. Your auditor, if named, decides what counts as evidence.
Handover
Each accepted item arrives as files and a sheet with its evidence. If the arrangement ends, the packs, records and open gaps are handed back to you.
Sharing your product safely. Initial contact uses the framework, the control area and a list of systems. No logins, exports or policies. Private access follows only after a safe handoff and written terms.
What is included, and what is not
- The quarterly evidence pack and the access review record
- The monthly policy drift report
- Each accepted item with its evidence, and a monthly summary
Included
- One framework, one control area and up to 5 source systems
- The three standing services: the evidence index refreshed (quarterly), the access review record (quarterly) and the policy drift check (monthly)
- One bounded item a month, one active at a time, chosen from the listed jobs. A bounded item is one listed job at no more than its starting scope and worth no more than GBP 300 at its listed one-off price; a larger item is quoted separately
- A written proposal that fixes the delivery days and the monthly capacity
- A written monthly summary of what was refreshed, recorded, delivered and still open
Not included
- Writing evidence, minutes, tickets or test results that did not occur
- Any statement that you meet the framework, or any promise of a certification or pass
- Acting as or replacing your auditor, or legal advice
- Changing, disabling or deleting anything in your live systems: your administrator does that
- Round-the-clock cover or any guaranteed response time
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
Each quarter every export file appears once in the evidence index with system, date, time, scope and hash, and a checker recomputes every hash.
Evidence: The index, the files and the recomputed hashes.
Each quarter every account in each export appears once in its access review pack, and every decision in the record carries the reviewer's name and date.
Evidence: Export row counts against pack rows, and the decision log.
Each month every drift in the policy report cites the policy text and the export row it came from.
Evidence: The monthly drift report checked on every row.
Each month no more than one item was delivered or started, and its listed one-off price is no more than GBP 300.
Evidence: The monthly summary, listing the item with the job it matches and that job's listed price.
Sign-off. You read each report, sign the access review record, accept or send back each item and read the monthly summary.
If it fails. A blocker is raised with a substitute item, revised timing or a stop. Work that does not meet its criteria is not claimed as delivered. Billing for incomplete work is agreed before starting.
When it fits, and when we stop
It fits when
- You have chosen the framework and control area, and an auditor, if named, accepts the evidence format
- Exports can be produced from each source system by you or your IT provider
- A named owner who chooses items, signs the access review record and answers the monthly questions
- Written policies in text
We stop and tell you if
- You ask us to write or edit evidence
- Your auditor refuses tool-exported evidence from a non-platform provider
- Nobody on your side will sign the access review record or make changes
- The agreed items regularly exceed one a month or GBP 300 of listed jobs, so we agree a different scope
What could go wrong
Everything is read-only analysis, indexes and drafts. Ending the arrangement leaves your systems as they are, and you keep every pack, record and file we sent.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| Evidence is changed or written to fit a control | We write no evidence. Every item is a system export with a recorded time and hash, and a checker recomputes the hashes. A gap stays a gap until a real export closes it. |
| An auditor rejects tool-exported evidence | If an auditor is named they confirm the format before we start. If they refuse, the arrangement stops. |
| The allowance is read as unlimited help | The proposal states one bounded item a month worth up to GBP 300 at its listed price, one active at a time. Extra or larger work is quoted. |
| The lane is mistaken for a certification service | Every page and file says that the assessor or auditor decides, and that nothing here states you meet a framework. |
| Your files pass through an AI model provider | The written proposal names the provider type, its country and how long it keeps data before you send anything. Entry items use redacted or synthetic copies, or your own provider account if you prefer. We delete our copies when the arrangement ends. |
A separate automated reviewer checks each report and item before it is sent. Your named owner signs the record and accepts every item. No human supervisor is included unless your proposal names one, and at launch the work is largely automated.
Stays with a person
- Your named owner signs the access review record and accepts every item
- Each named reviewer decides for their own people, and your administrator makes every change
Access we would need
- Exports from up to 5 source systems, or a read-only role that you create and can remove
- Redacted copies of policies, sent by an agreed secure route
Questions
Will this get us SOC 2 or ISO 27001?
No. An auditor or certification body decides. The lane keeps real exports organised, reviews recorded and policies checked so an auditor has something true to test.
Do you fill gaps with documents you write?
Never. A gap is closed only by a real export from the source system.
Can I buy the parts separately?
Yes. Every standing service and listed job is available on its own. The proposed price equals their listed prices at full use, so the lane adds one arrangement with delivery days and capacity confirmed in writing, not a discount.
Do I need the first evidence pack before the lane?
Yes, or an equivalent first index. The first pack is bought separately at its listed price.
Start a conversation
Send us
- Which framework and control area, and which systems hold the evidence
- Whether an auditor is named
- Who would own the arrangement. No exports, policies or logins in the first enquiry
- Your response to the proposed monthly price
Later, once you agree
- Quarterly and monthly exports from up to 5 systems, run by you or your IT provider
- Redacted copies of your policies through a secure route
- A named owner, named reviewers per system, and the control text
- A company-controlled secure handoff agreed before access: no live passwords, keys, private code or customer records by ordinary email.
You keep your systems, policies and the audit. We work on exports you send by an agreed secure route, or a read-only role you create and can remove. We never change a live system and never contact your auditor.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “compliance-evidence-lane” as the subject.