Trustivum:ComplianceLedger
The asset inventory your auditor can actually trust.
Every framework starts with the same question: what do you have, who owns it, and where does the sensitive data go? ComplianceLedger is the living answer. Devices, systems, applications and data stores, each with an owner, a protection posture and a history, plus a data-flow map and certified snapshots you can hand to an auditor.
Built for small regulated teams. Clinics, practices, their vendors, and any growing company that keeps its inventory in a spreadsheet nobody trusts.
The point is not to pass an audit. The point is to be secure.
You cannot protect what you do not know you have. An inventory kept for the auditor is a document. An inventory kept for yourself is how you notice the unencrypted backup path, the laptop nobody owns, and the drive that left the building without being wiped. ComplianceLedger is built for the second kind. The audit evidence is the side effect of actually knowing, and fixing, what is on your network.
The inventory is the first thing every framework asks for. It is usually the weakest.
SOC 2, HIPAA, ISO 27001, CIS and NIST all begin with knowing what you have. Recent HHS corrective action plans have required an asset inventory and data-flow mapping in every case. Most small businesses have a spreadsheet, and the spreadsheet has none of what an auditor needs.
Devices nobody owns
A laptop appears on the network and is not on the list. A server has no named owner. Nobody can say which of them touch patient data.
No proof of disposal
Old drives left the building. Were they wiped? By whom? With what method? The spreadsheet row was just deleted.
No history
The auditor asks whether the inventory was kept current over the review period. A file with a "last modified" date is not an answer.
Keep the register as part of running the business. The evidence takes care of itself.
Trustivum:Compliance tells you which controls need an inventory and a data-flow map. ComplianceLedger is where your team actually maintains them. Connect the two and your assets appear in the platform's register, and every certified snapshot lands on the right control as evidence.
Things change
A laptop is issued. A SaaS app is adopted. A scan turns up a new device. A server is retired. The quarterly inventory review comes due.
An auditable register
Owner, data classes, criticality and protection posture per asset. Lifecycle events with sanitization enforced at disposal. A hash-chained history and certified snapshots.
- Data-flow map, exportable
- Imports reconciled by a person
- Verifiable by anyone with the link
Register and evidence
Assets sync into the platform's asset register. Each certified snapshot uploads as evidence on the mapped control, with its hash.
Everything an inventory control actually asks for.
The register
Workstations, laptops, servers, mobile, network gear, medical and IoT devices, cloud resources, SaaS apps, data stores and removable media. Required owner, unique identifiers, data classes and criticality. Saved views for "ePHI assets," "missing encryption," "stale posture" and "unapproved software."
Protection posture
Encryption at rest, MFA, endpoint protection, patch level and backup coverage per asset. Each value carries its source and date, and goes stale automatically so an old "yes" does not pass as a current one.
Data-flow map
An interactive map of where sensitive data lives and moves. Filter to ePHI only, see unencrypted links highlighted, and export it as a dated PDF or image for the auditor.
Lifecycle with a gate
Planned, in service, in repair, lost or stolen, retired, disposed. Disposal is impossible without a sanitization record: method, who did it, when, and the certificate. Lost or stolen raises an incident.
Imports, reconciled by a person
Bring in spreadsheets or network scan results. Known devices update; unknown or uncertain ones wait in a queue for someone to accept, link, ignore or flag as unauthorized. Nothing merges silently. Devices that stop appearing are flagged "verify or retire."
Access map
Who can reach which system, at what level, since when. This is the population for access reviews and the checklist for terminations, and it is what ComplianceDesk reads when someone leaves.
Reviews and certified snapshots
Run an inventory review, confirm each asset, and certify. The result is an immutable snapshot with a hash and a PDF. Compare any two snapshots to see what was added, removed or changed.
Tamper-evident history
Every change appends to a hash chain that cannot be edited or deleted. A one-click integrity check reports intact, or exactly where the chain broke.
Serious sign-in
Two-factor authentication is required for admins, custodians and reviewers. Sessions, rate limits and lockouts are built in. History and snapshots are kept for at least six years.
Hand over a snapshot, not a spreadsheet.
Create a read-only link to the live register or to specific certified snapshots. It expires when you say, can be revoked instantly, and every view is logged.
- Certified snapshots with a hash, a PDF report and the full data behind it
- The data-flow map, dated and tied to the snapshot it came from
- Sanitization records on every disposed asset
- The integrity check runs live in the auditor's view
One compliance program. Companion tools that fit into daily work.
Trustivum:Compliance is the program of record. The companions are standalone tools that make your team more secure in daily work. They happen to put evidence into the program automatically.
Guided SOC 2 and HIPAA readiness. Weekly check-ins, evidence vault, policies, auditor portal.
Core productSecurity work as tracked workflows. Every closed ticket is control-mapped evidence.
Add-on · standaloneThe auditable record of every device, system and data store, and how your sensitive data moves.
Add-on · standalonePenetration testing and security validation. Tests scoped from the Ledger, findings tied to the assets they affect.
Add-on · standaloneStraight answers.
Do I need Trustivum:Compliance to use ComplianceLedger?
No. ComplianceLedger works fully on its own. Connecting it to Trustivum:Compliance syncs your assets into the platform's register and uploads each certified snapshot as evidence automatically. It never becomes a dependency.
We already have a spreadsheet. Why change?
A spreadsheet has no owner, no history, no record of how patient or customer data moves, no proof devices were wiped before disposal, and no way to show it was kept current. ComplianceLedger records all of that and lets an auditor verify none of it was changed afterward.
Does it discover devices on my network?
It accepts network scan results and spreadsheet imports and reconciles them against the register. Known devices are updated; unknown or uncertain ones go to a review queue for a person to confirm. Nothing is silently merged, and a device that stops showing up in scans is flagged for you to verify or retire.
What does an auditor see?
A time-limited, read-only link to the register or to specific certified snapshots, with the integrity check. They can download the snapshot PDF, the data behind it and the data-flow map. Every view is logged, and you can revoke the link at any time.
Does a good inventory mean we will pass our audit?
No tool can promise an audit outcome, and passing is not the goal. The goal is to be secure, and that starts with knowing what you have, who owns it and where your sensitive data goes. ComplianceLedger gives you a complete, current and verifiable inventory so you can find and fix the gaps. The audit evidence follows from that, not the other way around.
Bring your spreadsheet. Leave with a register.
Twenty minutes, your own inventory. We will import it, show you the gaps it has been hiding, and walk through what a certified snapshot looks like to an auditor.