For auditors

Your client uses StandardOS. Here is what you can ask them for.

Written for certification bodies and internal auditors, so it answers your questions rather than ours. Everything below is checkable in the time it takes to read it.

Read-only access, from your client

Ask them to invite you as an auditor, with the dates of the audit. That role can open every record and change none of them: not a justification, not a date, not a status. It is enforced in the database rather than the interface: every write path in the product tests membership against the roles owner, admin and member, and auditor is not among them. And it ends on the date they set, in the database, so your access does not outlive the engagement because somebody forgot to remove it. If the audit overruns, they move the end date; nothing has to be re-issued.

Nothing you do in a client's workspace can alter their evidence, which means you do not have to take our word for that when you write your report.

The export, if you would rather work offline

Any owner or admin can export the whole management system as a single JSON file. It carries 42 record types: the Statement of Applicability and its revisions, risks and their treatments, documents and every version, internal audits and findings, nonconformities, management reviews, competence and awareness records, suppliers, assets, the compliance calendar and the evidence register.

It is deliberately the whole system rather than a report. A partial export is worse than none, because it invites the reader to assume the rest exists.

Verify the audit trail without trusting us

Every record change is written to a hash-linked chain, and the export carries it. You can check that chain yourself, on your own machine, with a script we publish and no dependency on StandardOS being online or honest:

node verify-chain.mjs standardos-export.json

Node's built-in crypto and nothing else. No install, no network. The format specification is published so you can implement it yourself if you would rather not run ours, and that page also states plainly what a verified chain does not prove. A tamper-evident log shows that records were not altered after the fact; it says nothing about whether they were true when written. That is your job, and no software changes it.

What this tool cannot do for your client

We publish a clause-by-clause register of where each of the 26 ISO/IEC 27001 management-system clauses lives in the product, including the places where no software can help. Clause 5.1 is the clearest: every demonstration it asks for is assembled from records held elsewhere, and none of it shows that top management personally did any of it. You establish that by interviewing them, and no tool in this market changes that.

Two things worth knowing before you sample:

A generated Statement of Applicability arrives pre-drafted. Every justification is written by the product and says so in its own text. Each row records whether its justification is still the generated draft, was written by a person, or came from a suggestion, so "reviewed" means a human read it, and you can tell the difference.
Control titles are our words, not ISO's. We do not republish the standard's text, so the wording your client sees will not match your copy of ISO/IEC 27001 verbatim. The clause and control references are exact.

Read the clause register. One clause carries an explicit note about the limits of any software, and each clause has its own anchor so you can cite one directly.

Where the data sits

EU region, with the subprocessor list and its last-reviewed date published on our trust page rather than available on request. RMS Systems is a registered Danish entity, CVR 34282668.

Something here not true?

This page exists because an auditor is the reader most likely to catch us overstating, and we would rather hear it from you than have you discount the rest. security@getstandardos.com reaches a person.