Clause Eight runs proven open-source scanners, and its own for personal data and Terraform plans, in your CI and writes, next to every finding, the ISO 27001, PCI DSS, NIS2, DORA, Cyber Resilience Act and GDPR controls it weakens. Evidence your auditor can re-check, from the pipeline you already have.
Supporting evidence for technical controls, not a compliance assessment. Every report names each scanner and its version.
Security teams in regulated companies translate scanner output into controls by hand, every audit cycle.
Scanners say what's wrong with a line, not which ISO 27001, PCI DSS or DORA control it weakens. Someone translates by hand.
Exports, screenshots and spreadsheets, assembled each cycle and out of date the day after.
Why a finding was accepted, by whom and until when is hard to show an auditor a year later.
Clause Eight doesn't invent findings. It runs well-known scanners at pinned versions and adds the part they leave out.
Pick the problems to look for, not the tools: leaked secrets, personal data, vulnerable dependencies, unsafe CI pipelines. Twelve scanners run only where the repository has something for them, each at a pinned version with its download checked against a SHA-256.
Each rule lands in a plain-language category, and the category lists the controls it weakens in six frameworks, cited the way each standard writes them.
On a pull request, Clause Eight comments on the line that introduced the problem and fails the check when the finding is in the gate's scope.
A report written for the person who signs, and a manifest for the person who has to believe it: the commit, every scanner's version and a hash of every file.
c8 verify re-runs a scan from its manifestcheckov · CKV_AWS_24SSH open to 0.0.0.0/0 · infra/main.tf:7c8-card-data-in-log-context · supporting evidence, not a compliance assessment{
"commit": "49533f8932…",
"catalog_sha256": "a3c775e3…",
"scanners": [
{ "tool": "checkov", "version": "3.3.27" },
{ "tool": "semgrep", "version": "1.180.0" },
… bandit, gitleaks, trivy
],
"files": {
"report.html": "sha256:…",
"findings.json": "sha256:…",
"results.sarif": "sha256:…"
},
"complete": true
}
$ c8 verify c8-report/manifest.json
The developer gets a note on their line. The security lead gets a gate. The auditor gets evidence they can reproduce.
ISO 27001 Annex A, PCI DSS v4.0.1, NIS2 Article 21(2), DORA and its RTS, the Cyber Resilience Act Annex I and the GDPR.
Every control Clause Eight can cite in ISO 27001, shaded by how many demo findings weaken it.
Record a baseline once. After that, the gate counts what a change introduced.
Fail on high and above in PCI DSS or DORA, and always on leaked secrets.
Accept a risk with a reason, an owner and a review date. It counts again when it expires.
EU national IDs, IBANs and card numbers in code, fixtures and logs, confirmed by their check digits, and schema fields that hold special-category data. Mapped to the GDPR.
Read from the saved Terraform plan before it's applied: data stores replaced, wider IAM, public exposure, encryption turned off.
Essentials by default. Add Infrastructure, or Supply chain and CRA for malicious packages, an SBOM and repository practices, when Clause Eight suggests it.
A scanner that didn't run makes the scan incomplete and exits 3. A failed scan never passes as no findings.
One review per push, at most 25 comments, each with the controls and a fix. When the fix lands, the same comment says so.
From the Clause Eight catalog in the current release: exact rule mappings for Checkov and Semgrep, plus the rules the other ten scanners carry.
The CI job, every stage of the scan, what arrives in Clause Eight Cloud, and the exception that changes the next build. It plays on its own; click any chapter. Findings and numbers come from real scans of the demo app.
c8 upload sendsclosed, versioned schemaNever sent: source code, code snippets or secret values. The token can upload to this project and read its settings, nothing else.
A finding is marked fixed only when a complete scan of main no longer reports it and the scanner that found it ran. Findings fixed inside a pull request never reach main's history.
The 48 findings are a recorded scan of the demo app, made before personal data and CI workflows joined the Essentials checks; the job and the stages are today’s. Hover a dot inside the scan to read it; findings outside the files shown above are counted but not detailed.
The CLI runs in your CI. The Cloud keeps every scan, follows each finding from first seen to fixed, and holds the settings your pipelines fetch. It receives findings metadata only.
Every scan of the default branch moves the history. A finding counts as fixed only when a complete scan no longer reports it and the scanner that found it ran.
Pick a severity, narrow it to the frameworks you answer to, and switch on what must always fail. A live preview names each finding that would block, and why.
Accept a risk, exclude a path or tune a rule from the finding itself. Each one is saved as a settings version, so an auditor can see what was decided, by whom and until when.
Every control of the framework you pick, with its open findings, accepted risks and recent fixes, and the scan behind the numbers: commit, versions and catalog hash. No findings is never presented as the control being met.
c8 verify
Start from Essentials and add a package when the repository calls for it. Clause Eight reads what the repository holds and suggests one: Infrastructure for Terraform plans, Supply chain and CRA for lock files and Dockerfiles.
Screens from a demo organisation. The findings come from real scans of the demo app; the scan history is simulated.
Sign-in, single sign-on, who can join, what each role can do, and the repositories that follow. It plays on its own; click any chapter.
Single sign-on over OpenID Connect, with a setup guide for each provider's own menus.
Sign in with the account you code with. Members of a GitHub organisation, GitLab group or Bitbucket workspace can join on their own.
Connect a GitHub organisation through the Clause Eight app and add repositories with their CI ready to paste.
A demo organisation, Northwind Payments, with made-up people. The screens are drawn from Clause Eight Cloud and simplified; the rules are the product's own.
It keeps the scanner's precision and speaks the compliance platform's language. The evidence report can feed the platform you already use.
| What you need | Developer security scanners | Compliance platforms | Clause Eight |
|---|---|---|---|
| Finds issues in code and infrastructure | Yes | Through integrations | Yes, with proven open-source scanners |
| Cites the control each finding weakens | Rarely | Per control, not per finding | Per finding, six frameworks |
| Fails a build on a framework's findings | By severity | No | Severity per framework, live preview |
| Finds personal data in code and logs | Secrets, rarely personal data | No | EU identifiers and special-category fields, mapped to the GDPR |
| Exceptions with owner, reason and expiry | Varies | Yes, outside the code | Next to the finding, versioned |
Typical capabilities by category; individual products vary.
It reads untrusted code on every pull request, so it is built to trust nothing it reads.
The Cloud receives findings metadata only, under a closed schema: never source code or secret values.
Planned for Frankfurt (eu-central-1), encrypted at rest, with backups.
OpenID Connect with Entra ID, Okta, Google Workspace or Keycloak, plus GitHub, GitLab and Bitbucket sign-in. Require one method for everyone but admins.
Admins, members, viewers, and auditors whose access ends on a date. Every sign-in and settings change is recorded.
Scanner plugins never load from the folder being scanned, because a plugin runs a command.
Downloads are checked against a pinned SHA-256, and every scanner runs from an argument list, never a shell.
Saying this plainly is part of the product.
No. The reports are supporting evidence for technical controls. Whether you meet a standard is your auditor's call.
No. Training, supplier contracts, risk registers and incident response are out of scope by design.
The scan is marked incomplete, names the scanner and the reason at the top of every report, and exits 3, not 0.
No. The demo's sanitizer masks card_number while the payload says cardNumber, so card numbers still reach the log. No pattern rule sees that; the opt-in semantic check is being built for it.
No. It reads code and configuration, not live cloud accounts or running applications. Pair it with a cloud-posture tool and a pentest.
Yes, as an auditor: read-only, for 1 to 90 days you choose. They see projects and the evidence per control, not tokens, people or settings, and their access stops on the date.
People you invite, people whose verified email is at a domain you've added, and members of a GitHub organisation, GitLab group or Bitbucket workspace you've shown you belong to. Public email providers can't be added.
GitHub Actions, GitLab CI and Bitbucket Pipelines, or any CI through the container image. Python, JavaScript, TypeScript, Java, Kotlin, Go, C#, Ruby and PHP; Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and GitHub Actions; lock files for npm, pip, Go, Maven, Gradle, Cargo, Composer, NuGet and Bundler.
For engineering and security teams in EU financial services and their suppliers, preparing for DORA, NIS2, PCI DSS or the Cyber Resilience Act.
Connect your GitHub organisation, add two repositories and turn on single sign-on.
Set the gate together, record a baseline and turn known issues into owned, dated exceptions.
The evidence report for your auditor and a plain read-out of what changed.
Success looks like: the gate running on both repositories, every open finding mapped to a control, and an evidence report your auditor accepts.
Security leads and auditors use Clause Eight too, so you never count heads. Every plan has all six frameworks, every check and single sign-on.
The plan that fits is highlighted below, with what it adds.
A fintech or a supplier with its first audit coming.
€590€590a month
Billed monthly, cancel any time
Up to 10 repositories
Several teams, or a regulated firm that answers to an auditor every year.
€1,550€1,550a month
Billed monthly, cancel any time
Up to 50 repositories
Everything in Team, plusBanks, payment firms and critical ICT suppliers.
From €30,000a year
Annual contract
Unlimited repositories
Everything in Business, plus| Feature | Team | Business | Regulated |
|---|---|---|---|
| Scanning | |||
| Repositories | 10 | 50 | Unlimited |
| All six frameworks and every check package | ✓ | ✓ | ✓ |
| Gate with live preview, comments on pull requests | ✓ | ✓ | ✓ |
| Exceptions with an owner, a reason and a date | ✓ | ✓ | ✓ |
| People and sign-in | |||
| Single sign-on, GitHub, GitLab and Bitbucket sign-in | ✓ | ✓ | ✓ |
| Admins, members and viewers; join by domain or group | ✓ | ✓ | ✓ |
| Auditor access for 1 to 90 days | – | ✓ | ✓ |
| Evidence | |||
Evidence report and manifest, c8 verify | ✓ | ✓ | ✓ |
| Evidence per control in the Cloud, with PDFs | – | ✓ | ✓ |
| Signed evidence packs | – | ✓ | ✓ |
| Hosting and contract | |||
| EU hosting, planned for Frankfurt | ✓ | ✓ | ✓ |
| Your own instance, ours or in your AWS account | – | – | ✓ |
| Data processing agreement with DORA clauses | Standard | Standard | Agreed with you |
| Support | Standard | Priority | Service level agreement |
Every plan starts with the four-week pilot: €2,500, credited against your first year if you stay.
Founding customers get 40% off their first year on yearly billing, in return for a case study and a monthly feedback call.
Prices exclude VAT. Extra repositories are €30 a month each.
Pick two repositories. In four weeks you'll have the gate in CI, the history in one place and evidence your auditor can re-check.
contact@clauseeight.eu