As a small team, we achieved ISO 27001:2022 certification and a SOC 2 Type 2 report in the same year, with Scrut as our single source of truth for controls, policies and evidence. What I like best is how much of the evidence collection is automated: the integrations with Google Workspace, GCP and GitHub, plus the monitors and continuous tests, show gaps early instead of right before the audit. The policy templates gave us a solid starting point. Our customer success manager was a big help throughout, from setting up the SOC 2 engagement to coordinating with the auditor. We also use the Scrut MCP server, which lets us query controls and evidence and upload evidence directly from our AI tooling. The Trust Vault gives us an easy way to share certificates and reports with customers.

They are cost effective and quick to respond.

Scrut helps keep our compliance work organised by bringing policies, evidence, risks and vendor assessments into one place. I’ve found it particularly useful for reviewing vendor documentation, recording assessments and tracking outstanding actions. Having that information together makes it easier to see what still needs attention and follow up throughout the year. The support team has also been helpful and responsive. When we recently encountered an issue with automated document collection, they investigated, resolved the problem and followed up with a clear explanation.