Who had access?
Every privileged member, every access review decision, every revoked seat — with who decided and when.
Evidence
Evidence, not screenshots.
Lojycal connects to the tools you already run, turns every IT action into a write-once record, and maps that record to the framework controls it proves. When an auditor asks, the proof is already there.
The audit question
What auditors actually ask for.
Every framework comes down to the same four questions. Lojycal answers each one with a record, not a spreadsheet someone built the night before.
What changed?
Joiners, movers, leavers, device assignments and returns, each with a timestamp and an owner.
Can it be altered?
No. Audit records are write-once and hash-chained. Not even a workspace owner can edit or delete them.
Where is the proof?
Exported as a signed evidence pack for any period, ready to hand to an auditor, insurer or buyer.
How mapping works
How Lojycal maps evidence to your frameworks.
Most teams collect evidence by hand, once per framework. Lojycal collects it once, while the work happens, and links it to every framework it counts for.
1. Connect
Lojycal reads from the systems you already use: Google Workspace or Entra ID for identity, Jamf, Intune or Kandji for devices, Personio or BambooHR for people, plus your ERP and SaaS licences.
2. Record
Every action becomes a write-once record: a device check-in, an access review decision, a confirmed equipment return, a signed export. Missing data shows as “No data yet”, never as a pass.
3. Map
Each record type is tagged to the controls it proves. One record can count for ISO 27001, NIS2, DORA and CIS at the same time — collected once, reused everywhere.
Worked example: one leaver
A person leaves the company. Lojycal runs the gated offboarding checklist and produces one trail of records:
- 1Kill switch revokes identity and SaaS access
- 2Laptop return tracked against an SLA deadline
- 3Return confirmed, device back in stock
- 4Seats freed and the checklist signed off
That one trail is evidence for:
- ISO 27001 A.5.18 Access rights
- ISO 27001 A.5.11 Return of assets
- NIS2 Art. 21 Access control & asset management
- DORA ICT asset management
- CIS Controls 5 & 6
Framework by framework
| Framework | Control area | Lojycal record that proves it |
|---|---|---|
| ISO 27001 | Annex A — access rights, return of assets, endpoint devices | Access reviews, offboarding checklist, device returns, agent check-ins |
| NIS2 | Art. 21 risk-management measures | Access control records, asset inventory, incident reports |
| DORA | ICT asset and risk management | Reconciled device and SaaS inventory, MDM dispatch log |
| GDPR | Art. 30 records & Art. 32 security | Write-once audit log, retention and access records |
| EU AI Act | Record-keeping and oversight | AI agent activity log, kill-switch events |
| ISO 42001 | AI management — documented information | AI policy records, agent access log |
| CIS v8 | Controls 1, 5 & 6 — assets and accounts | Device inventory, account and access reviews |
| TISAX | Identity & access, asset handling | Access reviews, device custody history |
| HIPAA | Audit controls & access control | Hash-chained audit log, MFA step-up, access reviews |
Mappings show where Lojycal records support a control. Your auditor decides whether a control is met.
What the platform proves
Signed evidence packs
The Trust Center builds an evidence bundle for any period with a detached HMAC signature from a per-workspace key. Every signed export is logged, so you can show who exported what and when.
Tamper-proof logs
The audit log is write-once with a hash chain. Incident reports, MDM dispatch failures and unsubscribe events are also write-once — nobody, including the owner, can edit or delete them.
Access & identity
Access reviews record a keep, reduce or revoke decision per privileged member. Break-glass needs a written reason, a time limit and a review by a different admin. MFA step-up is enforced before admin areas load.
Devices & endpoints
Agent check-ins and health snapshots come from real devices. Equipment returns carry an SLA deadline and only go back to stock after a confirmed return. Missing data shows as “No data yet”, never as a default pass.
Finance
CapEx and OpEx reconcile against inventory. Retired devices drop to zero book value or their sale price, and every exclusion carries a recorded reason. SaaS cost splits exactly across the people who hold a seat.
Joiners & leavers
Onboarding is signed off only when every provision and the welcome packet are done. Offboarding follows a gated checklist; completed people stay in the workflow ledger.
How a signed evidence pack is produced
- 01
Choose a period
Pick any date range — a quarter, an audit window, a single incident.
- 02
Bundle is built
Records from every module are gathered into one pack.
- 03
Signed
The pack is signed with your workspace's own key, so any change is detectable.
- 04
Export logged
The export itself is written to the audit log: who, what, when.
Last verified 4 November 2026
Tested, and the numbers are checked
These figures come from one source, and the build fails if they drift from the real results.
1,895
automated tests
166
tenant isolation checks
345
pentest attacks
What this page is not
Lojycal maintains this page. It describes the records the platform produces. It is not an independent third-party certification, and it doesn't replace your auditor. It gives them better material to work with.
Read the Trust pageQuestions
Can anyone edit or delete the logs?
No. Audit, incident and dispatch records are write-once. Database rules block edits and deletes for everyone, including workspace owners.
Who can export an evidence pack?
Workspace admins with multi-factor sign-in. Every export is itself recorded in the audit log.
What happens when data is missing?
It shows as “No data yet”. Lojycal never fills gaps with a default pass, so a green result always means something was actually checked.
Is Lojycal certified?
This page describes what the platform records. Certification is decided by your auditor; Lojycal gives them signed, mapped evidence to review.
How far back does evidence go?
From the day a workspace connects its tools. Records are kept for as long as the workspace exists, under your retention settings.