Stop hand-rolling
audit evidence.
GLBA, SOX, NYDFS 23 NYCRR 500, SOC 2 — and you're hand-rolling audit evidence every cycle. Attestree records each promotion and decision as a signed audit event and exports them as a bundle that verifies offline; evidence packs mapped to those frameworks are where we're heading.
-
install Microsoft.PowerToys0.81.1 sig:9c4f…
-
promote Mozilla.Firefox → broad ringapproved sig:1ab2…
-
halt Vendor.Tool · signer changedheld HALT
-
block Unsigned.Installer (policy denied)denied sig:0fa9…
-
install choco/firefox125.0.1 managed · not attested
On our horizon. Attestree is pre-GA and onboarding design partners. This page describes where we're heading for fleets at this scale — not a shipping product today. If that's you, come build it with us .
Three things regulated buyers ask us about first.
Auditor-ready evidence
Signed audit events as a side effect of normal operations, exported as a bundle that verifies offline. Evidence packs mapped to GLBA, SOX, NYDFS 23 NYCRR 500.15 and SOC 2 are on the roadmap, not built.
Stream into your SIEM
Sentinel and Splunk forwarding is on the roadmap, not built. Until then, the signed audit spans export as a bundle your auditor can verify offline.
On-prem appliance, on the roadmap
An on-prem appliance that binds keys to the vTPM, with air-gapped evidence sync, is on the roadmap and not built. Today the commercial tier is a dedicated instance in your own Azure subscription.
The products that map to your control catalog.
FinServ engagements start with the products below.
Winget Enterprise
Attested install gate for winget; Chocolatey managed.
Read productInventory
One inventory across your package managers — winget and Chocolatey managed, Scoop inventoried.
Read productTransforms
MSI/MST transforms generated from declarative policy.
Read productCommercial — request access.
FinServ design partners get a 90-day proof-of-evidence engagement. An on-prem appliance that binds keys to the vTPM is on the roadmap. We'll come back within two business days.
"Design partner pipeline open. Be first to be quoted."