A ready-made SOC 2 program
One click creates a dedicated compliance space with 24 policy templates and 15 recurring activities, mapped to the Trust Services Criteria. Already have policies? Import them.
For Confluence Cloud
Run your SOC 2 program in Confluence.
Compliance in a Box turns one Confluence space into your compliance system of record: policies, approvals, employee acknowledgements and recurring evidence, all bound to exact page versions and ready for your auditor.
Free for up to 10 users, every feature included. Runs on Atlassian.
Acme Compliance Program
SOC 2
DashboardMy TasksPoliciesActivitiesAcknowledgements
Information Security PolicyApproved
Access Control PolicyAwaiting approval
Incident Response PlanApproved
Vendor & Third-Party ManagementChanges pending
Backup PolicyDraft
Policies acknowledged87%
- Runs on Atlassian
- Mapped to the SOC 2 Trust Services Criteria
- Data residency supported
- No external services
Why Compliance in a Box
Your wiki is already where policies live. Now it can prove it.
Spreadsheets and screenshots don't survive an audit well. Compliance in a Box keeps the work in Confluence and records who approved and acknowledged exactly what, and when.
Evidence auditors trust
Approvals and acknowledgements are bound to the exact page version and a hash of its content, so any later edit is detected. An append-only audit log backs every action.
Nothing leaves Atlassian
Built on Atlassian Forge with no external services. Reminders are Confluence tasks, and people are stored only as Atlassian account IDs. Your evidence stays in your own space.
How it works
From install to audit-ready in four steps
Policy text is written with the normal Confluence editor. The app handles the workflow, the state and the evidence.
-
Set up your space
Choose your employee and admin groups, your fiscal year and the Trust Services categories in scope. The app creates the compliance space and its page tree.
-
Assign owners and approvers
Each policy and activity gets an owner and approvers. Managed pages are locked so only the owner and Compliance Admins can edit them.
-
Approve and acknowledge
Owners submit a version, approvers approve that exact version, and employees acknowledge with one click. Material changes ask for acknowledgement again.
-
Keep evidence on schedule
Access reviews, scans and tabletop exercises open their own dated evidence pages on schedule, with due dates, reminders and approvals.
Features
Everything a compliance program runs on
Version-bound approvals
Every approver signs off on a specific page version. Edit the page before it's approved and the submission is cancelled automatically.
One-click acknowledgements
Employees acknowledge from the policy page. Target all employees or specific groups, with due dates and completion tracking per policy.
Recurring activities
Monthly, quarterly, semi-annual or annual controls, aligned to your fiscal year, each opening an evidence page for its period. Skips need a written reason.
Dashboard and My Tasks
Admins see overdue items, upcoming reviews and acknowledgement completion. Everyone else sees exactly what's waiting on them.
Status right on the page
A byline on every policy and evidence page shows its approval status and lets people acknowledge, submit or approve without leaving Confluence.
Reminders through Confluence
Reminders arrive as Confluence task notifications, plus a weekly summary for admins. No email integrations to configure.
Audit-ready reports
A policy approval log, acknowledgement report, activity completion report, audit log and controls matrix, generated as Confluence pages and kept up to date daily.
Bring your own policies
Import existing Confluence pages into the program, add custom policies, and retire the ones you no longer need, with history intact.
Auditor access
Give an optional Auditors group view-only access to the evidence and report pages, and nothing else.
Self-approval flagged
Work approved without an independent approver is highlighted on the dashboard, so separation of duties is visible before your auditor asks.
What's in the box
A complete SOC 2 starting point
Choose the Trust Services categories you're audited on: Security, plus Availability, Confidentiality, Processing Integrity and Privacy as needed.
24policy templates
15recurring activities
5Trust Services categories
1generated controls matrix
Policies include
- Information Security
- Acceptable Use
- Code of Conduct
- Access Control
- Asset Management
- Data Classification & Handling
- Data Retention & Disposal
- Encryption & Key Management
- Risk Management
- Vendor & Third-Party Management
- Change Management
- Secure Software Development
- Vulnerability Management
- Logging & Monitoring
- Incident Response Plan
- Business Continuity & DR
- Backup
- Privacy
- and more
Recurring activities include
- User Access Review
- Risk Assessment
- Annual Policy Review
- Security Awareness Training
- Vendor Risk Review
- Penetration Test
- Vulnerability Scan Review
- Incident Response Tabletop
- Business Continuity / DR Test
- Backup Restore Test
- Asset Inventory Review
- Firewall Config Review
- Management Security Review
- and more
The policy templates and control mappings are a starting point, not legal or audit advice. Have them reviewed by your auditor. SOC 2 is first; more frameworks are planned.
Security & privacy
A compliance tool should be easy to put through compliance
Compliance in a Box runs entirely on Atlassian's Forge platform. There is no Auralite backend, and we have no access to your data.
Runs on Atlassian
No external domains, no remote servers and no third-party subprocessors. Data lives in Forge hosted storage for your site, with data residency supported.
Minimal personal data
People are stored only as Atlassian account IDs, never names or emails. When an Atlassian account is closed, the app erases it from its records.
Your evidence is yours
Policies, evidence and generated reports are ordinary Confluence pages in your space. They stay there even if you uninstall the app.
Pricing
Start free. Pay through Atlassian as you grow.
Billing is handled by Atlassian on the Marketplace, alongside your Confluence subscription.
Every feature
Free
$0 up to 10 users
For small teams preparing for their first audit.
- Full SOC 2 program and templates
- Approvals, acknowledgements and activities
- Reports, audit log and controls matrix
- Email support, first response within 8 hours
Paid
Per user over 10 users
The same app, for growing teams. Pricing follows your Confluence user tier and is shown on the Atlassian Marketplace listing.
- Everything in Free
- Billed by Atlassian, monthly or annually
- Free trial through the Marketplace
- Email support, first response within 8 hours
FAQ
Questions, answered
Which Confluence plans does it work with?
Confluence Cloud. Page locking and restricted report pages need Confluence Standard or above. On Confluence Free the app still works, but it warns you during setup that pages can't be restricted.
Does it use my existing space?
The app creates one dedicated compliance space for your site, and every framework lives in it. If your organization prefers, an admin can create an empty space and hand it to the app instead. You can import policies from other spaces into it.
Does any of my data leave Atlassian?
No. The app runs on Atlassian Forge and calls no external services. Its records are kept in Forge hosted storage for your site, and your policies and evidence are ordinary Confluence pages.
What happens to my evidence if I uninstall?
Your policies, evidence pages and generated reports stay in your Confluence space. The app keeps the Evidence & Reports pages refreshed daily and tries a final refresh when it is uninstalled. Its internal records are deleted by Atlassian after a retention period.
What happens if my license lapses?
The app becomes read-only: everyone can still see their records and admins can still refresh the report pages, but approving, acknowledging and creating new content stop until the license is active again. Your Confluence pages are unaffected.
Are the templates legal or audit advice?
No. The policy templates and control mappings are a well-structured starting point. Tailor them to your company and have them reviewed by your auditor.
Will you support ISO 27001, HIPAA or other frameworks?
SOC 2 comes first. The app is designed so that more frameworks can be added as content, and they are on our roadmap. Tell us which one matters to you at support@auralitesolutions.com.
Put your compliance program in a box.
Install free for up to 10 users, or ask us anything first.