Observability for auditability
Evitrus continuously collects and correlates evidence across your engineering and AI systems — code, deploys, config, access and reviews. Answer “what changed?” in seconds, and produce SOC 2 evidence without the audit fire drill.
Infrastructure, not another compliance tool — closer to Datadog than to a questionnaire.
When production breaks, nobody can quickly answer “what changed?” — the story is scattered across GitHub, Kubernetes, cloud consoles and Slack. And proving compliance is retrospective, manual and hated: reconstructed after the fact from spreadsheets and screenshots.
Both are the same missing capability: a continuously-collected, queryable record of every change to production and the evidence around it.
Evitrus persists exactly one thing — the Evidence Event — and derives everything else from it: correlated Changes, control coverage, and the AI provenance of each change. Engineers get a faster incident tool; compliance owners get evidence that was already there.
Two strictly separate, purpose-built views
Pick a moment and a tag selector (service:… env:… team:…) and
see the event timeline in that window — with an optional metric overlay on
the same axis, pulled on demand. Deliberately minimal, built for use
between audits, not just during them.
Choose a control or framework and a period. See every change in scope, aggregate coverage, and — most importantly — the exceptions foregrounded. Export it as an evidence package.
How it works
A GitHub App (PRs, reviews, merges, code scanning), a reusable GitHub Actions step (builds with image digests) and a Helm-installed Kubernetes controller (deploy rollouts) emit normalized Evidence Events.
Events are stitched by service, commit and image digest into a single Change — the story of one release as it moves from PR to production.
Open the Incident view during an incident, or hand the Audit view an evidence package at review time. Same data underneath.
Compliance falls out of it
Controls are evaluated as event-based checks over each Change, producing pass / fail results tied to the exact events that justify them. The exceptions are surfaced first — no screenshots, no Slack archaeology, no reconstructing the quarter after the fact.
AI provenance, done honestly
AI involvement is recorded as a first-class ai actor on the events
it touched, linked to the human review that followed. We lead with provenance —
“this change was AI-assisted, here’s the review” — not a fuzzy percentage.
Built for the buyers who scrutinize vendors hardest
Read-only, scoped access. The Kubernetes controller only watches Deployments; CI and GitHub evidence is pushed with a tenant-scoped API key.
Exporters run inside your cluster and CI. Hosted on EU infrastructure (Hetzner, Germany) with data-processing agreements in place.
Every query is scoped to your organization server-side, and permissions are evaluated per role — multi-tenancy and RBAC are not an afterthought.
Closed beta
We're onboarding a small number of design-partner engineering teams. Tell us a little about you and we'll be in touch.