deixic
Log inRequest a demo

← Docs

Docs · How-to

Run compliance execution

Dex, working through a task

Deixic changes the settings behind a failing SOC 2 control, reads each one back, uploads the evidence to your compliance platform, and re-runs the tests there.

1Connect the systems

Connect the systems in scope: for most companies Google Workspace or Microsoft 365, GitHub, AWS or GCP, and the HR system, plus any of hundreds more. If your company already uses a compliance platform, connect it too. Deixic reads that platform’s failing tests, and later uploads evidence to it and re-runs the tests there. Connection steps and health checks are on Connect tools.

2Set the authority policy

The policy assigns every change to one of four classes. Observe is reading only. Change is a low-risk change that runs without a person, within the policy the company grants. Sensitive waits for a named approver. Outside authority is refused, or sent to the company as a decision it has to make. Decide for each connected system which changes belong in which class before the first run.

3Review the plan for a failing control

For each failing control, Deixic evaluates the SOC 2 control and lists the settings it would change, each marked with its authority class. Read the target and the policy decision on every line. Changes in the observe and change classes proceed under the policy. Sensitive changes stop and wait. Outside-authority items are refused or sent to the company.

4Approve sensitive changes

A sensitive change waits in the app queue or in Slack until its named approver decides. The approver reads the request and approves or denies it; the decision, the approver, and the reason are recorded. Steps are on Approve or deny.

5Read the receipt

After each change, Deixic reads the setting back from the system and compares it with the intended value. The per-action record keeps the result next to the before and after state.

6Export evidence

Export an evidence report as PDF, HTML, or JSON. Deixic re-verifies the report against the record at export. Set a report schedule to receive it daily, weekly, or monthly. The same evidence goes to your compliance platform, where the tests re-run.

What the record holds for each action

  • Who acted and on whose behalf.
  • The target resource.
  • The policy decision and the policy reference.
  • For sensitive changes: the approval request, the decider, the reason, and the time.
  • The state before and after the change.
  • The result, and any redactions.

Actions are kept in an append-only, hash-linked activity history, so edits after the fact are detectable. Governed tool calls also carry signed receipts.

Gates and approvalsHow to approve or denyEvidence and activity