Integrations

Your systems, tested every hour

Connect Microsoft 365, Google Workspace, GitHub, Slack, Zoom and Jira in minutes. 73 automated tests check MFA, encrypted devices and leavers’ accounts, and link every result to the right control in ISO 27001, NIS2 and SOC 2. Included in every agreement.

integrations
11
automated tests
73
sync of every integration
Hourly
settings changed in your systems
None

Available integrations

GitHub

Code

Included

Checks two-factor authentication, owners and base permissions, branch protection and code review, and Dependabot, secret scanning and code scanning across your GitHub organization.

13 automated tests ready to run

Google Workspace

Identity

Included

Checks 2-Step Verification, administrator accounts, unused and unowned accounts, temporary passwords, leavers and mobile devices in your Google Workspace, and computers with your own Google Cloud app.

12 automated tests ready to run

Microsoft Azure

Cloud

Included

Checks that storage accounts require secure transfer, block public blob access, restrict network access and stay in your data region, that Defender for Cloud protects every subscription, and that activity logs are exported.

6 automated tests ready to run

Microsoft Entra ID

Identity

Included

Checks MFA registration and strength, MFA and legacy authentication policies, Global Administrators, unused, guest and unlinked accounts, and leavers in Microsoft Entra ID.

11 automated tests ready to run

Microsoft Intune

Devices

Included

Checks that computers and phones are compliant, encrypted, password protected, supported and checking in, that policies require a strong password on every platform, that Microsoft Defender protects them and their vulnerabilities are fixed on time, and that employees have a managed device and leavers none.

16 automated tests ready to run

Microsoft Teams

Messaging

Included

Checks that every team has an owner and that guests do not own teams, and delivers reminders as Teams chat messages to people who choose instant messages.

2 automated tests ready to run

Slack

Messaging

Included

Checks two-factor authentication, workspace owners, leavers and unowned accounts in your Slack workspace, and delivers reminders as direct messages to people who choose instant messages.

4 automated tests ready to run

Zoom

Messaging

Included

Checks two-factor authentication, account owners and admins, leavers, unused and unowned accounts and meeting security in your Zoom account, and delivers reminders as Zoom Team Chat messages to people who choose instant messages.

6 automated tests ready to run

Jira

Work tracking

Included

Records security incidents from Jira in the incident register and posts its decisions back, tracks remediations and failing tests as Jira issues, and checks leavers’ accounts and the time taken to fix security issues.

3 automated tests ready to run

Creates issues and comments Connect

Claude

AI

Included

Ask Claude about your compliance record from claude.ai, Claude Desktop or Claude Code: progress, controls, failing tests, risks, vendors and policies.

claude.ai, Claude Desktop and Claude Code

ChatGPT

AI

Included

Ask ChatGPT about your compliance record through a connector: progress, controls, failing tests, risks, vendors and policies.

ChatGPT connectors, approved once by an administrator

How it works

Connected in minutes, checked every hour

  1. 01

    Connect with limited access

    An administrator connects each system. Microsoft and Google go through the same directory connection Compeas uses for single sign-on; GitHub and Slack take one token each, Zoom an app you create in your Zoom account, and Jira an API token with scopes from a dedicated account.

  2. 02

    Synced every hour

    Compeas syncs right after connecting and then every hour, and runs the tests again on the fresh data.

  3. 03

    Results where the work is

    A failing test shows which account, device or repository it concerns, who owns the test and how to fix it, next to the control it gives evidence for.

  • Never changes a setting. Compeas reads settings and never changes them. In Jira it only creates issues and posts comments, in the projects the account is given.
  • Encrypted tokens. Stored encrypted and never shown again.
  • Disconnect any time. An administrator can remove a connection whenever needed.
Every test

73 tests and the controls they cover

Each test gives evidence for one or more ISO 27001 Annex A controls. NIS2 and SOC 2 requirements that follow those controls are covered through Compeas’ control mapping.

GitHub 13 tests
  • GitHub members use two-factor authenticationA.5.17A.8.5
  • GitHub organization requires two-factor authenticationA.8.5
  • GitHub outside collaborators use two-factor authenticationA.5.17A.8.5
  • GitHub base permission is read-only or noneA.5.15A.8.3
  • GitHub organization owners are limitedA.8.2
  • Default branches are protectedA.8.4A.8.32
  • Approvals are dismissed when new commits are pushedA.8.32
  • Branch protection applies to administratorsA.8.32
  • Status checks must pass before mergingA.8.29A.8.32
  • Dependabot alerts are turned onA.8.8
  • Critical and high Dependabot alerts are fixed on timeA.8.8
  • Secret scanning is turned onA.5.17A.8.12
  • Critical and high code scanning alerts are fixed on timeA.8.28

Connects through: A read-only access token from an organization owner.

Google Workspace 12 tests
  • Google Workspace users use 2-Step VerificationA.5.17A.8.5
  • Google Workspace enforces 2-Step Verification for every userA.8.5
  • Google Workspace administrators have 2-Step Verification enforcedA.8.2A.8.5
  • Google Workspace super administrators are limitedA.8.2
  • Google Workspace administrator accounts are in useA.8.2
  • Unused Google Workspace accounts are suspendedA.5.16A.5.18
  • Leavers have no active Google Workspace accountA.5.18A.6.5
  • Google Workspace accounts belong to people in your organisationA.5.16
  • Google Workspace temporary passwords are replacedA.5.17
  • Mobile devices with Google Workspace data are encrypted and lockedA.8.1
  • Computers in Google endpoint management have a screen lock passwordA.8.1A.8.5
  • Apps users sign in to with Google are in the software registerA.5.9A.5.23

Connects through: The same directory connection Compeas uses for single sign-on. The computer test needs your own Google Cloud app, since Google does not share computers with the Compeas app.

Microsoft Azure 6 tests
  • Azure storage accounts require secure transferA.8.24A.5.23
  • Azure storage accounts do not allow public blob accessA.8.3A.5.23
  • Azure storage accounts restrict network accessA.8.20A.5.23
  • Defender for Cloud protects every Azure subscriptionA.8.7A.8.16A.5.23
  • Azure activity logs are kept outside the portalA.8.15A.5.23
  • Azure storage stays in the organisation's data regionA.5.23A.5.34

Connects through: The Microsoft Entra ID directory connection.

Microsoft Entra ID 11 tests
  • Microsoft Entra ID users are registered for MFAA.5.17A.8.5
  • Microsoft Entra ID administrators are registered for MFAA.8.2A.8.5
  • Microsoft Entra ID administrators use a strong MFA methodA.8.2A.8.5
  • Microsoft Entra ID requires MFA for all usersA.8.5
  • Microsoft Entra ID blocks legacy authenticationA.5.17A.8.5
  • Microsoft Entra ID has fewer than five Global AdministratorsA.8.2
  • Unused Microsoft Entra ID accounts are disabledA.5.16A.5.18
  • Unused Microsoft Entra ID guest accounts are removedA.5.18A.5.19
  • Leavers have no enabled Microsoft Entra ID accountA.5.18A.6.5
  • Microsoft Entra ID accounts belong to people in your organisationA.5.16
  • Apps users sign in to with Microsoft are in the software registerA.5.9A.5.23

Connects through: The same directory connection Compeas uses for single sign-on.

Microsoft Intune 16 tests
  • Devices meet Intune compliance policiesA.8.1
  • Intune devices are encryptedA.8.1A.8.24
  • Intune devices check in regularlyA.8.1
  • Devices run a supported operating systemA.8.8
  • Phones and tablets are not jailbroken or rootedA.8.1A.8.7
  • Microsoft Defender Antivirus protects Windows devicesA.8.7
  • Antivirus definitions are up to date on Windows devicesA.8.7
  • Antivirus scans run on Windows devicesA.8.7
  • Devices require a password to unlockA.8.1A.8.5
  • Intune policies require a strong password on every platformA.5.17A.8.1A.8.5
  • Computers are onboarded to Microsoft Defender for EndpointA.8.7A.8.16
  • Critical and high device vulnerabilities are fixed on timeA.8.8
  • Devices do not have a high exposure levelA.8.8
  • Intune devices have a primary userA.5.9A.8.1
  • Employees use a device managed by IntuneA.8.1
  • Leavers have no devices in IntuneA.5.11A.8.1

Connects through: The Microsoft Entra ID directory connection.

Microsoft Teams 2 tests
  • Every Microsoft Teams team has an ownerA.5.9
  • Guests do not own Microsoft Teams teamsA.8.2

Connects through: The Microsoft Entra ID directory connection.

Slack 4 tests
  • Slack members use two-factor authenticationA.5.17A.8.5
  • Slack workspace owners are limitedA.8.2
  • Leavers have no active Slack accountA.5.18A.6.5
  • Slack accounts belong to people in your organisationA.5.16

Connects through: A Slack app you create in your workspace, with one token.

Zoom 6 tests
  • Zoom requires two-factor authentication for every userA.5.17A.8.5
  • Zoom account owners and admins are limitedA.8.2
  • Leavers have no active Zoom accountA.5.18A.6.5
  • Zoom accounts belong to people in your organisationA.5.16
  • Unused Zoom accounts are deactivatedA.5.16A.5.18
  • Zoom meetings require a passcode or a waiting roomA.5.14

Connects through: A Server-to-Server OAuth app you create in your Zoom account.

Jira 3 tests
  • Jira accounts belong to employeesA.5.16
  • Leavers have no active Jira accountA.5.18A.6.5
  • Security issues in Jira are fixed within targetA.8.8

Issues labelled security-incident are recorded in the incident register, with the reporting deadlines that apply, and Compeas posts its decisions back as comments. Remediations and failing tests can become Jira issues, and their status is read back. A closed Jira issue is never proof on its own. Jira Cloud only.

Connects through: An API token with scopes (read:jira-work, write:jira-work and read:jira-user) from a dedicated Jira account.

Claude 10 tools

The AI assistants read your compliance record through ten read-only tools. An administrator approves the connection once. The assistants never see the names or email addresses of people, and data read directly from Google Workspace is left out. The approval lasts 90 days, and every question ends up in the audit trail.

  • Compliance summary
  • Frameworks
  • Controls
  • One control in detail
  • Evidence
  • Failing tests
  • Remediations
  • Risks
  • Vendors
  • Policies

Connects through: Signing in to Compeas, approved once by an administrator.

ChatGPT 10 tools

The AI assistants read your compliance record through ten read-only tools. An administrator approves the connection once. The assistants never see the names or email addresses of people, and data read directly from Google Workspace is left out. The approval lasts 90 days, and every question ends up in the audit trail.

  • Compliance summary
  • Frameworks
  • Controls
  • One control in detail
  • Evidence
  • Failing tests
  • Remediations
  • Risks
  • Vendors
  • Policies

Connects through: Signing in to Compeas, approved once by an administrator.

Questions about integrations

Do integrations cost extra?

No. All integrations are included in every agreement.

What access does Compeas need?

Read-only for every system except Jira. Microsoft Entra ID, Intune, Azure and Teams read through the Microsoft Entra ID directory connection, Google Workspace through its directory connection, GitHub and Slack through one token each, Zoom through an app you create in your Zoom account, and Jira through an API token with scopes from a dedicated account. Compeas reads settings and never changes them. In Jira it creates issues and posts comments, in the projects the account is given. Slack, Teams and Zoom can also deliver reminders as messages to people who choose that.

Which Microsoft licences are needed?

Most tests work with Microsoft 365 as it is. MFA registration and sign-in activity need Microsoft Entra ID P1 or P2, and the vulnerability tests use Microsoft Defender for Endpoint. When a licence is missing, the test explains what is needed instead of failing.

How often are the tests run?

Compeas syncs every integration right after it is connected and then every hour, and runs the tests again on the new data.

What can Claude and ChatGPT see?

Only what ten read-only tools return: progress, frameworks, controls, evidence, failing tests, remediations, risks, vendors and policies. An administrator approves the connection once. The assistants never see the names or email addresses of people, and data read directly from Google Workspace is left out. The approval lasts 90 days, and every question ends up in the audit trail.

Is a system we use missing?

Tell us which systems you use. We choose the next integrations by what customers need.

Does Compeas integrate with Jira?

Yes, with Jira Cloud. Security incidents tracked in Jira are recorded in the incident register with their reporting deadlines, remediations and failing tests become Jira issues with their status read back, and three tests check leavers’ Jira accounts, that every account belongs to an employee and that security issues are fixed within the target times.

Get started

See your own systems tested

Try Compeas for 14 days, free of charge, with every integration included.

Request a trial Book a walkthrough