Stop bracing for the audit
Integration inventory, owners and approved changes, regenerated on every deploy. Every integration in your configured scope is either governed or flagged, so you never again spend a week reconstructing it for the auditor.
In your tenant · full change history with approver · a dated evidence pack on every run
Every audit cycle, the same week disappears
The auditor asks three questions. Which integrations touch customer data? Who owns each one? How did they change this year and who approved each change? Someone then reassembles the answer from memory, old spreadsheets and Teams threads. It takes a week. It’s never quite complete. And “never quite complete” is the part that gets written up.
Everything your auditor asks for already generated
IT auditors ask for the same artefacts every year. This produces them continuously, so they exist before anyone asks.
A diagram of how your systems integrate, auto-generated architecture and message-flow diagrams.
An inventory of integrations per system an Integration Catalog, current as of your last deploy.
Who owns each integration, business owner and support contact on every page.
What data each one handles, four-tier classification, exposure surfaced on the dashboard.
The accounts integrations run as, the run-as identity (managed identity or service principal) recorded per integration.
How changes were controlled, change history from Git and pull requests: who changed what, when, approved by whom, via which pull request.
The questions auditors ask about integrations
“Show me your inventory of integrations.”
An Integration Catalog discovered from Azure and your code, including integrations nobody registered
“Who owns this integration?”
Owner and data classification on every integration page. Missing owners are flagged as Incomplete
“Were changes reviewed and approved?”
A change history per integration with author, approver, pull request and build
“Which integrations transfer data, and between which systems?”
Source, target and flow diagrams for each integration
“Can you show me this as of a date?”
A dated audit export (ZIP and CSV) produced on every pipeline run
Evidence for the frameworks you answer to
TrueStateRegistry provides evidence. Whether you are compliant is your auditor’s decision.
ISO/IEC 27001:2022
Evidence for controls 5.9 (inventory of assets), 8.32 (change management) and 5.14 (information transfer), with support for 5.12 (classification of information).
NIS2
NIS2 is the EU’s cybersecurity law for companies in critical sectors. It asks you to know which systems you run and how data flows to your suppliers. TrueStateRegistry gives you that list for your integrations: what each one connects to, what data it moves and who owns it.
DORA
For financial entities. Article 8 asks you to identify, classify and document your ICT assets and map how they depend on each other. TrueStateRegistry does that for your integrations.
GDPR
Source, target and data classification for each integration support the integration part of your record of processing under Article 30.
Not a point-in-time guess. Your posture as of the last deploy.
The dashboard shows how many integrations are fully governed, which touch Restricted or Confidential data, and every open gap with the exact missing field. Gaps show up on the next deploy, not in audit week.
Segregation-of-duties evidence, generated automatically
Because every change to an integration goes through a reviewed pull request, each page’s change history shows the date, the author, the approver’s name, the PR number, and, when the change references a ticket, a link straight to it in your ITSM. That completes the chain from request to change to approval, generated as a by-product of how your team already works.
Your ITSM still holds the business approval, which an auditor opens to confirm. What you’ll never do again is hunt for what changed through your pipeline, when, by whom, which ticket authorised it, and who signed it off.
Every deploy leaves a dated, self-contained evidence pack
Every pipeline run produces a point-in-time audit record: a flat CSV of every integration owner, classification, criticality, run-as identity, governance state plus a date-stamped archive containing that CSV and every manifest. A self-contained record you can attach to an audit report or hand directly to an auditor.
How it works
Live in three steps, then automatic
Step 1
Add one pipeline to your Azure DevOps project and point it at your resource groups and repos. No platform to host, no agents.
Step 2
It discovers your Logic Apps, Functions and repos, and opens a pull request with draft manifests. About five minutes each to complete.
Step 3
It runs on every deploy, regenerates the catalog, dashboard, diagrams and pages, and flags anything ungoverned.
Runs where your data already lives
In your tenant
Everything runs in your Azure environment. Customer data sent to TrueStateRegistry-hosted services is zero. No telemetry, no licence-server calls.
Keeps secrets out of its output
It does not read Key Vault, app settings or access keys. Every published page, diagram and CSV passes through redaction: known secret patterns and internal hostnames are replaced. You can also set the build to fail when one is detected.
Least privilege
Read-only on Azure: Reader on the resource groups in scope, and read access to the repos. By default it writes only your wiki pages and pull requests for new manifests.
Verifiable
Every page carries the build ID, commit SHA and timestamp that produced it.
A snapshot is out of date by the next deploy
Evidence assembled by hand goes stale with the next release. TrueStateRegistry regenerates it on every deploy, so the answer is current as of your last deploy and the same every time you ask.
FAQs
Founding pilot
Find out what your auditor would find. Before they do.
Add one pipeline. TrueStateRegistry discovers your Logic Apps and Functions, compares what it finds with your current integration list, and you get a dated audit pack.
Free. No contract. You keep what it finds.
Your effort: one pipeline and two short check-ins.
Hands-on setup with the engineer who built it, and a direct say in the roadmap.
Prefer to see it first? Book a 30-min walkthrough