Private beta · invite only · SOC 2 and ISO 27001
Tiomsu runs a SOC 2 or ISO 27001 engagement end to end — requests, samples, tests, review, findings, report and binder — with every result traced to a test, a sign-off and a document. No spreadsheet. No Word assembly.
§ 01 · How it works
Evidence lives in requests, not controls. Samples are drawn, confirmed and sent. Review is a signature on a version. The report is generated from the records, never typed over.
One request links to many controls, so HR sends one leaver list instead of answering six people. Each request has a kind — population, sample or document — a title, a detailed description, an owner and a due date. Merge or split them to match what the client can actually provide.
Your sample-size table by control frequency. Tiomsu suggests a size, draws items at random with a stored seed, and the preparer confirms or overrides with a reason. The exact items go to the client as a sample request linked to its population — and never roll forward to next year.
Every sign-off records who, when, and which version of the record it covers. An edit after sign-off clears it. Nobody reviews their own work, and the report cannot be approved while a required checklist step is unsigned.
Your DOCX templates, letterhead, opinion variant and boilerplate. Regenerate after a change and read the diff; an approved report is immutable. The binder is a ZIP of every document, test and sign-off, with a manifest.
§ 02 · Connections
A request goes out from the engagement; the answer comes back as a pinned copy — file, digest, version, collection date, submitter. Where the client answers from is up to them.
Clients who run their program in AuditBadger see your requests in an auditor inbox there and answer without a second login. A client admin approves the connection — one account, one project, one period — and can revoke it at any time. Obsolete evidence is labelled, never hidden.
If several of your clients live on another compliance platform, tell us which one. The connector is a small, well-defined contract and we would rather build the next one with a firm that needs it. Platform teams who want their customers' auditors in Tiomsu: same door.
Everyone else gets a deliberately small portal: their requests, the exact sample items, last period's answer, upload and comments. Works on a phone. It is not a GRC tool and does not try to be.
Your tests, notes and findings never leave Tiomsu — only what you deliberately share for a client response.
§ 03 · The model
Fixed objects, fixed fields, fixed lifecycles. You change wording, templates and your own checklist steps — never the data model. No form builder, no custom columns, nothing to configure before the first engagement.
SOC 2 Type 1 and Type 2 first. ISO 27001:2022 follows during the beta.
§ 04 · Private beta
We're inviting a small number of firms to run one SOC 2 Type 2 engagement in Tiomsu alongside their current tool. Same client, same period, no risk to the issuance. At the end you tell us where it saved time — requests, testing, review, report — and what got in the way.