Built this after watching engineering teams lose weeks before every SOC 2 audit rebuilding the same evidence trail from scratch — screenshots, PR links, spreadsheets — for work that was already documented in GitHub.

EvidentTrail connects via GitHub App and captures PR approvals, branch protection changes, CI results, and AI-assisted commits as structured, tamper-evident evidence mapped to specific controls (SOC 2 CC8.1, ISO 27001 A.8.32, etc.).

A few things that might be interesting to this crowd:

- AI-assisted code detection: we identify co-authored-by trailers, bot authors, and PR labels to flag AI-generated code, then verify a human reviewed it before merge - Branch protection drift: hash-based snapshots detect when someone quietly reduces required reviewers or removes a required status check - Evidence packs: SHA-256 manifest + PDF/CSV/JSON export so the evidence is tamper-evident at export time, not just at capture time

First launch, no users yet. Happy to answer questions about the implementation or the compliance angle.