ZeroAudit

• 

  Landing page — "SOC 2 compliance, automated by AI"

• 

  Onboarding — set up in under a minute, no credit card required

• 

  Dashboard (pre-scan) — ready to run, shows data sources and estimated time

• 

  Integrations — GitHub connected, real repo selected for scanning

• 

  Terminal agent — live AI scan across GitHub, AWS CloudTrail, PagerDuty

• 

  Trust Service Criteria — 11 categories with evidence coverage bars

• 

  Compliance Dashboard — real-time readiness score, Trust Service Criteria coverage

• 

  Evidence Map — every artifact timestamped and sourced from real API data

• 

  Audit Reports tab — both SOC 2 and ISO 27001 reports in one click

• 

  SOC 2 Report — AI-generated audit-ready PDF with control coverage and gap analysis

• 

  ISO 27001 Crosswalk — same evidence mapped to ISO 27001 Annex A automatically

Inspiration

SOC 2 audits take 6-12 months and cost $50k. The tooling to automate this exists — nobody connected the dots.

What it does

AI agent that connects to GitHub, AWS, and PagerDuty, collects compliance evidence automatically, and generates an audit-ready SOC 2 report in 2 minutes.

How we built it

Next.js on Vercel, AWS DynamoDB single-table design with two GSIs, Grok AI for evidence classification. GitHub OAuth, AWS CloudTrail, and PagerDuty API for real data. Fire-and-forget background agent with polling because Vercel functions timeout at 10s.

Challenges we ran into

DynamoDB GSI key design took the most thought — getting the schema right so every query is org-scoped without table scans. Switched from Gemini to Grok mid-build when Gemini hit daily quota limits.

Accomplishments that we're proud of

Real data from real APIs — not mocked. CloudTrail IAM events, GitHub branch protection rules, PagerDuty incident metrics all feeding into actual AI classification.

What we learned

Design DynamoDB access patterns before writing a single line of code. Also: fire-and-forget with polling is the right pattern for long-running AI tasks on serverless.

What's next for ZeroAudit

Okta integration for real user provisioning data, scheduled scans via Vercel Cron, and CSV export for auditors.

Built With

• awscloudtrail
• awsdynamodb
• githuboauth
• grokai
• next.js
• pagerdutyapi
• tailwindcss
• typescript
• vercel