Probo

Preparing a first SOC 2 or ISO 27001 audit

Create the organization, add the framework and review which controls apply in the Statement of Applicability. Link each control to the internal control the team actually runs, assign owners and collect evidence as files or URLs. Before the auditor arrives, check that every in-scope control has current evidence and an owner, and that open findings from earlier reviews are resolved or explained. The first framework guide walks through the setup.

Running a quarterly access review

Connect providers under Settings, add them as access sources, then create a campaign that names the sources in scope. Starting the campaign snapshots the accounts; reviewers record a decision for each entry and the campaign completes only when every entry has one. Revocations must still be carried out in the source system. Check that blank MFA or last-login fields are understood as missing data, not as a pass, and keep the completed campaign as audit evidence.

Publishing a trust page for sales and procurement

Use the compliance portal to publish the frameworks, reports and policies a prospect usually asks for. Mark audit reports as restricted, require an NDA for exports and review access requests as they arrive. Add the subprocessor list from the vendor inventory so it stays consistent with internal records. Verify the custom domain certificate and confirm that unpublished documents are not reachable before sharing the link.

Collecting policy signatures and device posture from staff

Approve policies through a quorum, publish them and request electronic signatures from employees through the employee portal. Roll out the Device Agent with the signed macOS and Windows packages, or the install script on Linux and FreeBSD servers, and enroll each device with a one-shot token. Check the notification schedule so reminders reach people who have not signed, and review devices that fail disk encryption or screen lock checks.

Automating evidence and records from CI or an AI client

Use prb with a purpose-specific token in CI to upload evidence or list open risks, with --json output and non-interactive mode. For AI clients, connect to the MCP endpoint with a scoped token, start with read-only questions and require approval before write or destructive tools run. Give each client its own token so it can be revoked separately, and paginate list tools until no cursor remains when a complete answer matters.

Running Probo on your own infrastructure

Start with Docker Compose for evaluation or a small internal deployment, then move to the Helm chart with managed PostgreSQL 18 and S3 when you need separate scaling or rolling updates. Store the generated secrets safely, since changing them later can invalidate sessions or make stored data unreadable. Test sign-in, file upload, email delivery, backups of database and files as one set, and an upgrade to a pinned image tag before inviting users.