Compliance automation software for every device
trio.so turns compliance frameworks into device checks. Turn on the frameworks you answer to, see which laptops, desktops and phones fail which controls, fix the settings with policies, see each fix confirmed on the next check, and export the evidence your auditor asks for. One console for Windows, macOS, Linux, iOS/iPadOS and Android.
Endpoint compliance › Frameworks| Framework | Status | Score | Failing controls | Devices |
|---|---|---|---|---|
| SOC 2TSC 2017 (rev. 2022) | Active | 92.6% | 9 | 418 |
| ISO/IEC 27001:2022 | Active | 91.8% | 11 | 418 |
| PCI DSS v4.0.1 | Active | 94.0% | 7 | 212 |
| NIST SP 800-53 Rev. 5 | Active | 89.4% | 14 | 418 |
| GDPRArt. 32 evidence | Active | 95.1% | 4 | 418 |
| NIST SP 800-171Rev. 3 | Active | 90.2% | 12 | 418 |
| CIS Benchmarks | Available | — | — |
Compliance work stops at the device
Most compliance tools track policies, vendors and people. The controls auditors test most often live on the devices themselves: is the disk encrypted, is the screen lock on, are critical patches in. trio.so is the device layer of your compliance program. It sets those controls, checks them on a schedule and keeps the record.
- Same basicsEvery framework asks for the same device basics, from SOC 2 to PCI DSS.
- Settings driftA firewall switched off for a quick fix stays off until someone notices.
- Stale spreadsheetsSpreadsheets go stale the day after an audit.
- Proof per deviceAuditors ask for proof per device, not a policy document.
How it works
How compliance automation works in trio.so
The compliance engine is on from the start. You choose the frameworks, and trio.so maps its device controls to them and checks every enrolled device on the schedule you set: hourly, daily or weekly.
- Turn on a frameworkPick SOC 2, ISO 27001, PCI DSS, NIST SP 800-53, NIST SP 800-171, GDPR or CIS, and the platforms it covers.
- See what failsFindings rank each failing control by severity and devices affected, with an owner and a due date.
- Fix and confirmFix the setting with a policy. A finding counts as resolved only after the next evaluation passes.
Frameworks
Frameworks you can check devices against
One library of device controls maps to every framework, so one fixed setting counts everywhere it is asked for.
SOC 2
Access, encryption, malware and change records for the Trust Services Criteria.
Learn moreISO 27001
Annex A endpoint, malware, vulnerability and configuration controls.
Learn morePCI DSS v4.0.1
Devices in or connected to your card data environment.
Learn moreNIST SP 800-53 and 800-171
Configuration, access, patching and encryption controls.
Learn moreGDPR
Device evidence for security of processing (Article 32).
Learn moreHIPAA
Safeguards for laptops and phones that hold patient data.
Learn moreCIS Benchmarks
Hardening checks for each operating system.
Learn moreNCA ECC (Beta)
Template for organizations regulated by Saudi Arabia's NCA.
Learn moreSAMA CSF (Beta)
Template for banks, insurers and finance companies in Saudi Arabia.
Learn more
Monitoring
Continuous compliance monitoring for every device
trio.so checks devices on a schedule, not once a year. Each policy reports back device by device: applied, pending or failed. When a device falls out of line, it shows up as a finding before your next audit does.
- Six checksScreen lock, disk encryption, firewall, Secure Boot, OS up to date and anti-malware active.
- Status per deviceEach policy reports applied, pending or failed on every device.
- Grouped findingsFindings grouped by control, by device or by owner.
- AlertsAlerts to Slack or Microsoft Teams, with each event type routed to its own channel.
Hardening
Endpoint hardening you set once
The controls frameworks ask for are policies in trio.so. Set them once and they go out to every enrolled device, company owned or personal.
Encryption
BitLocker, FileVault, Linux disk encryption and encryption on phones.
Screen lock
Auto-lock time, passcode length and lockout after failed attempts.
Firewall
Firewall on, confirmed by a check.
OS updates
OS updates current, confirmed by a check.
USB and Wi-Fi
USB storage blocked on Windows and Linux, and WPA2 or WPA3 Wi-Fi.
Patching
OS and third party apps, ranked by CVSS, EPSS and the KEV list.
See your own compliance findings today
Start a free trial, enroll a few devices and turn on a framework. Your first findings appear after the first evaluation.
- 5
- platforms: Windows, macOS, Linux, iOS/iPadOS and Android
- Hourly
- checks, or daily or weekly, as you set
- $5
- Plans start at $5 per device.
- 14 days
- free trial, no credit card
Every OS
Device compliance on every platform
Checks go as deep as each operating system allows. macOS reports the deepest checks, Windows and Linux report posture signals, and phones report policy state.
- Windows
- macOS
Windows and macOS
Encryption, screen lock, firewall, Secure Boot, OS updates and anti-malware, plus Microsoft Defender for Endpoint alerts per device on Windows
- Linux
Linux
Disk encryption, firewall, OS updates and USB storage block
- iOS/iPadOS
- Android
- ChromeOSComing soon
iOS/iPadOS and Android
Passcode, encryption and OS version as policy state, with lost mode, remote lock and wipe
Evidence
Audit evidence without screenshots
Every check, finding, policy change, resolved finding and exception leaves a record. When the auditor asks, you export it instead of collecting screenshots.
- Findings per controlFindings per control, device by device.
- Audit trailFramework changes, policy updates, evaluations and resolved findings, with who did what and when.
- ExceptionsExceptions per control and device, each with an expiry date.
- ExportsDevice and member lists as CSV, and evidence exports for your auditor.
Why trio.so
Compliance checks in the same console as your devices
One place
The console that enrolls and patches your devices also checks them, so there is nothing to sync.
Fixes you can verify
You fix the setting with a policy, and a finding counts as resolved only after the next evaluation passes.
Works with your GRC tool
trio.so connects to Vanta, so policies and vendors stay where they are.
Published pricing
Compliance is included from the Secure plan up. Plans start at $5 per device.
Integrations
Works with the tools you already use
Connect Vanta, send alerts to Slack or Microsoft Teams and events to Splunk, and pull users from Microsoft Entra ID or Okta. Microsoft Defender for Endpoint alerts show per device.
Vanta
Microsoft Defender
Splunk
Slack
Microsoft Teams
Microsoft Entra ID
Okta