Release evidence for regulated software teams
Every production release should leave its own evidence trail.
ForgeStack turns CI/CD and deployment metadata from Azure DevOps, GitHub Actions and AWS release pipelines into a structured record of what changed, who approved it, what was tested and what reached production, so audit samples don't become screenshot projects.
One recent production release. You send exported pipeline metadata. No access, no installation, no obligation.
The pipeline knows what happened. The audit trail is usually somewhere else.
Release evidence is often spread across pipeline runs, pull requests, approvals, security checks, tickets and deployment history. When an auditor samples a change months later, engineers end up reconstructing that story manually. ForgeStack turns those existing records into a consistent release evidence pack while they're still easy to verify.
One record for every production release
- Release identifier and timestamp
- commit and pull request
- reviewers and approvers
- build and test results
- security checks
- deployment environment and time
- linked change ticket
- exceptions and missing evidence
Evidence can be mapped to your organisation's interpretation of PCI DSS 6.5.1, DORA Article 17 or ISO 27001 A.8.32 with your compliance owner or auditor.
Free Release Evidence Readiness Check
Send one recent production release and ForgeStack will return a one-page evidence pack showing what evidence is present, missing or ambiguous, plus a coverage summary mapped to the change-control requirements relevant to your organisation.
The check uses exported metadata only. ForgeStack does not need access to your systems and does not make changes to your pipelines.
You can judge the output against what your auditor asked for last time before deciding whether to buy anything.
Fixed-scope release evidence service
Onboarding, £2,500
pipeline and repository baseline, evidence mapping with your compliance owner or auditor, hardening backlog, and the first 30 days of release evidence.
Ongoing, £1,500 a month
- one CI/CD environment — Azure DevOps, GitHub Actions or an AWS-native release pipeline — up to 30 production releases a month
- evidence pack per release
- emergency-change log
- quarterly auditor sample export
- hardening changes delivered as pull requests or customer-controlled configuration changes
- monthly report
- one audit-support call
Three-month minimum, including the onboarding month.
Audit Sample Rescue — included
When your auditor asks for a sample of production changes, ForgeStack prepares the requested release-evidence export from the records already maintained through the service.
Included once per quarter, for up to 10 releases.
What ForgeStack is, and isn't
ForgeStack provides technical release-evidence collection and pipeline hardening. We don't provide legal advice, certify compliance or replace your auditor, Vanta, Drata or other GRC platform. We focus on the release-level evidence those systems often leave inside engineering tools.
ForgeStack is cloud-neutral at the evidence layer. The first supported delivery environments are Azure DevOps, GitHub Actions and AWS-native release pipelines.