Free Release Evidence Readiness Check
Send one recent production release and ForgeStack will return a one-page evidence pack showing what evidence is present, missing or ambiguous, plus a coverage summary mapped to the change-control requirements relevant to your organisation.
The check uses exported metadata only. ForgeStack does not need access to your systems and does not make changes to your pipelines.
You can judge the output against what your auditor asked for last time before deciding whether to buy anything.
Initial environments
- Azure DevOps — pipeline runs, approvals, linked repositories, tests and deployment history.
- GitHub Actions — workflow runs, pull requests, reviews, checks, environments and deployments.
- AWS-native CI/CD — CodePipeline execution history, CodeBuild results, CodeDeploy deployment records, manual approval evidence and relevant CloudTrail events.
Not every field exists in every configuration. Missing evidence is recorded as a gap, not filled in.
One record for every production release
- Release identifier and timestamp
- commit and pull request
- reviewers and approvers
- build and test results
- security checks
- deployment environment and time
- linked change ticket
- exceptions and missing evidence
Evidence can be mapped to your organisation's interpretation of PCI DSS 6.5.1, DORA Article 17 or ISO 27001 A.8.32 with your compliance owner or auditor.
Fixed-scope release evidence service
Onboarding, £2,500
pipeline and repository baseline, evidence mapping with your compliance owner or auditor, hardening backlog, and the first 30 days of release evidence.
Ongoing, £1,500 a month
- one CI/CD environment — Azure DevOps, GitHub Actions or an AWS-native release pipeline — up to 30 production releases a month
- evidence pack per release
- emergency-change log
- quarterly auditor sample export
- hardening changes delivered as pull requests or customer-controlled configuration changes
- monthly report
- one audit-support call
Three-month minimum, including the onboarding month.
Audit Sample Rescue — included
When your auditor asks for a sample of production changes, ForgeStack prepares the requested release-evidence export from the records already maintained through the service.
Included once per quarter, for up to 10 releases.
What ForgeStack is, and isn't
ForgeStack provides technical release-evidence collection and pipeline hardening. We don't provide legal advice, certify compliance or replace your auditor, Vanta, Drata or other GRC platform. We focus on the release-level evidence those systems often leave inside engineering tools.
ForgeStack is cloud-neutral at the evidence layer. The first supported delivery environments are Azure DevOps, GitHub Actions and AWS-native release pipelines.