Frequently asked questions

iCompaas (Infrastructure Compliance-as-a-Service) is an AI-powered platform that automates cloud cybersecurity compliance. It acts as your always-on security admin, scanning systems continuously to catch and fix issues before they become problems. See Start Here.

It covers globals like SOC 2, ISO 27001, HIPAA, GDPR, DPDP and NIST frameworks, plus regionals such as Germany's BSI C5. See the compliance guides and control libraries.

iCompaas uses AI agents for streamlined workflows, blending security checks with cloud cost optimisation all in one affordable package. See Cost Saving Recommendations.

It pulls real-time evidence like logs and configs automatically, no manual screenshots needed, turning months of prep into days. See running change-evidence scans.

Just read-only access (least privilege principle), so it observes without ever changing or deleting your data. See Cloud Onboarding for each provider's setup.

Yes, it runs full VAPT on apps and networks with expert guidance on fixes and proof-of-remediation documentation. Scope a test in the Web-VAPT and Mobile-VAPT questionnaire.

It's a central dashboard for managing people-related activities such as document signing and security training.

Checklists are static and manual; iCompaas is dynamic, with real-time monitoring, auto-evidence collection, and proactive fixes before audits.

It auto-discovers cloud assets, runs vulnerability scans, creates remediation tasks, and generates verification docs for constant audit readiness. Start with the onboarding overview.

Sign up at icompaas.com/signup/account with your corporate email address; personal addresses are rejected, and your organisation is set up under your email domain. Accept the verification email from the same browser session. See Creating your iCompaas account.

Open Account Settings → Onboarding. Connect at least one cloud account (scans start when you click Save & start scan), fill in Proposal Scoping in the questionnaire, connect your identity provider, then connect your version control system and select repositories. See the onboarding overview.

Step-by-step guides cover Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Utho, Railway, DigitalOcean and Oracle Cloud (OCI), each showing the role, key or token to create in that provider's console. OVHcloud was added in October 2026, along with Supabase, Vercel and Cloudflare integrations. See Cloud Onboarding.

In Account settings & Onboarding → AWS, name the environment, enter your 12-digit AWS Account ID and click Launch CloudFormation stack. In the AWS Console, using an account with administrator permissions, tick the IAM acknowledgement, click Create Stack, wait for CREATE_COMPLETE, then click Finish in iCompaas. See Connecting AWS.

Personnel onboarding connects Google Workspace, Microsoft 365, Zoho Workspace and Okta (added in August 2026), so people, admin roles and 2FA status are tracked. VCS onboarding connects GitHub, GitLab and Bitbucket to collect change evidence from the repositories you select. See Personnel Onboarding and VCS Onboarding.

If Google shows 'Access blocked', a Super Admin must mark iCompaas as Trusted under Security → Access and data control → API controls → Manage App Access; policy changes can take up to 24 hours. If Microsoft 365 says 'Need admin approval', complete the authorization with a Global Administrator account. See Connecting Google Workspace and Connecting Microsoft 365.

Go to Settings → Users → Invite and pick a role: Owner (full control, including billing), Admin (frameworks, policies, evidence and integrations, but no billing), Editor (implements controls, uploads evidence and runs scans, but can't delete) or Auditor (read-only plus evidence export). Invitations are single-use and expire after 7 days. See Inviting your team.

After connecting your VCS, open Compliance Management → Change Evidence, select repositories, click Save selection, then Run scan. The report lists pass, fail or unknown results per control; if the repository list is empty, go back to VCS onboarding and click Sync. See Running change-evidence scans.

The AI Remediation Assistant gives step-by-step guidance (console, CLI or policy updates) for failed controls across AWS, Azure and GCP, with prerequisites, impact on security, cost and availability, and rollback instructions. Because iCompaas has read-only access and never alters your configurations, you apply the changes. See the AI Remediation Assistant update.

A Trust Center is a secure portal for sharing security, privacy and compliance documents with customers and prospects. Public documents are viewable immediately; for Restricted ones, a visitor clicks Request Access and an admin approves or rejects the request, granting access to that requester only. See the Trust Center overview.

It runs 12 checks across Linux, macOS and Windows: disk encryption (LUKS, FileVault, BitLocker), firewall, and malware protection (ClamAV, XProtect, Windows Real-time Protection), plus AppArmor or SELinux on Linux, Gatekeeper on macOS and Controlled Folder Access on Windows. See Device Management.

It creates the IAM role IndependentAuditorAccessRole, secured with an ExternalId condition, with the AWS managed policies ReadOnlyAccess and SecurityAudit attached. iCompaas assumes the role through STS with your Account ID and ExternalId, and the temporary credentials are valid for 1 hour. See Connecting AWS.

Sign in to the AWS account, open the CloudFormation service, select the stack iCompaas created when you connected the account and click Delete. You can revoke any integration at any time, and access stops when it is disconnected. See Deleting the iCompaas stack.

No, Railway tokens have no read-only mode, so create the narrowest token you can (a workspace token for that workspace, or a project token) and treat it like a production secret. To rotate it, delete it in Railway and add a fresh one in iCompaas. See Connecting Railway.

Data is encrypted with TLS 1.2+ in transit and AES-256 at rest, with keys managed and rotated in AWS KMS. The platform is hosted on AWS in the US (us-east-1 and us-west-2) across multiple availability zones. See the Trust Center, which lists every subprocessor and its region.

Per its Trust Center, iCompaas lists an ISO/IEC 27001:2022 certificate (issued March 2026) and a SOC 2 Type II report from an independent CPA firm, and a DPA is available. The report, the certificate and the annual pen test summary are shared under a mutual NDA.

Only as long as it is needed for your compliance objectives or required by law. It is securely deleted or anonymized on your request or when the contract ends. Send privacy questions to [email protected], or see the privacy policy.

No, iCompaas is the readiness and evidence layer: control libraries, continuous cloud checks, policy templates and evidence export. A licensed CPA firm issues the SOC 2 report, and an accredited certification body issues the ISO 27001 certificate. See the SOC 2 guide.

Yes, invite them with the Auditor role, which is read-only and can export audit-ready evidence packs. Auditors can also use the dedicated auditor login at app.icompaas.com/auditor/ to review and approve processes and procedures. See Inviting your team and assigning roles.

A Type 1 report gives an opinion on whether controls were suitably designed and implemented as of a date. A Type 2 also tests whether they operated effectively over a period, and is what customers usually mean by 'your SOC 2'. See the SOC 2 guide.

SOC 2 is a CPA firm's attestation report and dominates North American procurement; ISO 27001 is a certificate from an accredited certification body, valid three years with annual surveillance audits, and is more common elsewhere. The controls overlap heavily, so many companies run one control matrix for both. See the ISO 27001 guide.

There is no HIPAA certification: HHS does not approve any, and customers accept a SOC 2 Type II report or a HITRUST assessment as evidence. GDPR has no mandatory certificate and none makes you 'GDPR compliant' (Article 42 schemes are voluntary); you must be able to demonstrate compliance on request. See the HIPAA and GDPR guides.

No, ISO/IEC 42001 can be certified on its own, but it shares ISO 27001's clause structure, so the two can run as one integrated management system and be audited together. iCompaas ships AIMS templates such as an AI policy, an AI risk register and an AI impact assessment workflow. See the ISO 42001 guide.

Yes, the DPDP Act, 2023 applies to foreign SaaS companies that offer goods or services to people in India, with no establishment or size threshold. It is being phased in, and most Data Fiduciary duties, rights and penalties commence on 13 May 2027. See the India DPDP Act guide.

Testing is manual-led. Web VAPT covers authenticated and unauthenticated testing of the app and its APIs, mapped to the OWASP Top 10:2025; Mobile VAPT is static and dynamic testing of the iOS or Android client and its backend, verified against OWASP MASVS v2.1. See VAPT.

The VAPT page lists seven phases: scoping (1–3 days), recon and threat modeling (1–2), automated and manual assessment (3–7), exploitation and PoC (2–4), risk rating and reporting (2–3), remediation support through your fix window, then a 1–2 day retest. Retesting and the closure letter come at no extra cost. See VAPT.

Yes, iCompaas coordinates the CERT-In security audit that RBI, SEBI and other Indian regulatory bodies require for government and financial applications. The audit itself is conducted by CERT-In empanelled auditors and covers Safe-to-Host certification, alignment with the RBI and SEBI frameworks, and retesting. See VAPT.

Yes, iCompaas LLM VAPT red-teams AI and LLM applications for prompt injection, system prompt and data leakage, excessive agency, unsafe output handling and supply chain integrity. You onboard targets, run automated engagements, review findings with remediation guidance and track a posture score over time. See LLM VAPT.

A passive scan examines your publicly visible footprint without accessing internal systems: subdomains, IPs and hosting, HTTP security headers, TLS, SPF/DKIM/DMARC, open ports, sensitive file and admin exposure, subdomain takeover risk and typosquatting. Findings are rated Critical to Low, with remediation guidance. See Passive Scan.

It depends on how many cloud accounts you need to connect, how many frameworks you're working toward, and whether you want a continuous view or a one-off readiness assessment. To talk it through, use Book a Demo on icompaas.com. See Choosing the right plan.

Upgrades take effect immediately, and the prorated difference for the rest of the billing period is charged on your next invoice. Downgrades take effect at your next renewal, with no proration credits. See Changing your plan.

No. Under the Terms of Use, subscriptions renew automatically at the end of each billing cycle. You can cancel the automatic renewal at any time, but there are no refunds for cancellations partway through a billing cycle.

Enter it at the Plan & Billing step of checkout, or go to Settings → Billing → Manage subscription and choose Have a coupon? Codes are case-sensitive, one coupon applies per subscription at a time, and annual-plan coupons don't work on monthly plans (or vice versa). See How to apply a coupon code.

Common causes: the code has expired, is for a different plan or billing interval, was already redeemed, or has a geographic or currency restriction. AWS and Azure Marketplace discounts are applied in the marketplace, not as in-app coupons. See coupon troubleshooting, or open a ticket with the code and a screenshot.

Open a ticket, then track it with your ticket number and email, or sign in on Track tickets. You can also call or WhatsApp +91 63014 72100; the team is typically available 9 AM to 6 PM IST.

The SLA commits to infrastructure scans every 12 hours, auditor coordination within 14 days of you sharing all necessary details, and VAPT reports within 30 days of scoping; certification timelines depend on you fixing Critical and High gaps promptly. A miss caused by iCompaas's performance extends your service by the delay. Escalate to Customer Success ([email protected]), then the Compliance Manager.