Answers your auditor can check, not opinions they have to trust
Praxis was designed for regulated teams first: deterministic scoring, mapping to the regulations you answer to, and evidence you can hand over as a signed package.
Mapped to the requirements, not just the name
Praxis lists recommended controls grouped by the requirement they relate to. It does not attest that a requirement is met or unmet, and it does not replace an audit. A signed compliance pack can add per-requirement rationale and evidence hints.
Everything for an audit period, in one signed file
Pick a customer or business unit and a period. Praxis builds one ZIP:
PDF to read; CSV and JSON with every finding, for the state at the end of the period.
New, resolved, applied and reverted controls between the start and the end of the period.
The period’s audit-log entries for that scope, each with the hash that chains it to the full log.
Every file’s SHA-256, signed by the server’s own Ed25519 key. Auditors verify offline with OpenSSL.
The controls a bank expects around the tool itself
Mandatory MFA
E-mail, password and a one-time code (TOTP) for every account, with one-use recovery codes.
Roles and scope
User, Admin and System admin, each limited to the business units or customers they belong to.
Invitations, not passwords
Accounts open with a one-time link; nobody else ever sees a user’s password.
Lockout and sessions
Account lockout after repeated failures, idle and absolute session timeouts, instant revocation.
Tamper-evident audit log
Sign-ins, views, exports and changes in a hash chain; forwarded to your SIEM over syslog or a webhook.
400 days of history
One run per day kept for 400 days, so a quarter or a year can be compared side by side.
Your findings never leave your network
- Install on your own Kubernetes, including fully air-gapped clusters, from a signed offline bundle.
- No telemetry and no licence call-home: the licence is an offline signed file.
- The AI explanation is optional and can run on a local model — or be switched off entirely.
- The collector is read-only and cannot read Secrets.
See your own clusters ranked
Bring one cluster. We run the read-only collector with you and walk through the list it produces.