Telemetry Sources
t2e connects to every telemetry source your team produces — out of the box, with no code changes. Deploy the collector once, and evidence starts flowing immediately.
Kubernetes
Workload inventory, security context violations, RBAC changes, network policy drift, pod security standards enforcement, ingress TLS coverage, and secret metadata tracking.
- Privileged container detection
- RBAC & ClusterRoleBinding changes
- Network policy drift monitoring
- Pod Security Standards enforcement
OpenTelemetry
Service discovery from OTLP spans, error-rate alerting with auto-incident creation, latency SLO monitoring, and telemetry coverage reports per service.
- OTLP span enrichment with control metadata
- Auth span → SOC 2 CC6 evidence
- Error rate → CC7 / A.17.1 mapping
- No raw span storage — privacy-safe
GitHub
PR merge records with full reviewer lists, branch protection monitoring, release change management, secrets scanning alerts, and unapproved-merge detection.
- PR reviews & approvals → CC8.1
- Branch protection rule monitoring
- Release change management
- Unapproved merge detection (GH-001)
AI / GenAI
Model inventory via OpenTelemetry GenAI semantic conventions, token usage aggregates per model, unapproved model detection, and AI risk register auto-population.
- LLM request/response logging with PII detection
- Model version pinning & drift detection
- ISO 42001 Annex A compliance
- AI risk register auto-populated
Platform
From telemetry to evidence in minutes
No spreadsheets. No manual screenshots.
Compliance evidence generated continuously from the systems you already run.
Append-only evidence
Every record is immutable with a SHA-256 payload hash. Auditors get a tamper-evident chain of custody — no gap risk, no manual edits, ever.
Multi-tenant isolation
PostgreSQL row-level security enforced at the DB layer. Each org's data is invisible to every other tenant by construction — not by convention.
Rules-driven risk register
YAML rules like K8S-001 and GH-001 auto-open and auto-resolve risks as your infra changes. Zero manual triage — every risk has an audit trail.
Compliance coverage
Four frameworks, one platform
Evidence automatically mapped to controls across all four frameworks — simultaneously, with every event.
Control Mapping Examples
Architecture Overview
Three components working together to turn telemetry into evidence.
Collector
A lightweight Go agent deployed via Helm. Watches Kubernetes events, intercepts OTLP spans, and ingests GitHub webhooks. Batches and sends events to the backend.
Backend API
FastAPI-based multi-tenant REST API. Ingests events, runs risk rules, maps evidence to controls, generates reports, and manages organizations.
Dashboard
Next.js dashboard for viewing assets, risks, incidents, changes, evidence, and reports. Built for both engineers and auditors.