Audit evidence at merge time,
not audit time.
MergeWhy captures cryptographic evidence from every pull request — reviews, CI, tickets, deploys — into a tamper-evident chain anchored to Sigstore's public transparency log. Your auditor verifies without trusting us. Your engineers stop hunting for screenshots.
Click any container.
See the chain back to the PR.
Verify against Sigstore Rekor.
Every binary running in production has a signed, unbroken chain back to the PR that created it, the human who approved it, the tests that passed, and the controls it satisfies. Auditors with zero MergeWhy account verify against the public log in one command.
- Artifact → PR → reviewer → tests → vault → Rekor — every link Ed25519-signed
- Runtime drift detection — unauthorized digests trigger alerts within 15 min
- Public verifiable— auditor doesn't have to trust MergeWhy, only Rekor + Ed25519 math
Evidence gaps are audit failures waiting to happen.
Screenshots, self-attestations, and policy binders are already failing. Cryptographic evidence captured at merge time is the only thing auditors actually trust.
Engineering hours per SOX cycle
Teams spend entire quarters taking screenshots, exporting Jira tickets, and assembling evidence binders — instead of shipping features.
SOC 2 packages contain material errors
35% of SOC 2 evidence packages arrive at auditors with errors. Auditors spot-check samples, not systems.
Fabricated compliance audits exposed in 2026
A $32M YC-backed compliance tool was caught fabricating audit evidence for major tech companies. A PNG of a checkmark is not evidence.
Defence contractors not CMMC-ready
CMMC enforcement is live. 80,000+ DoD contractors must verify 110 NIST 800-171 controls. 99% are not ready. Primes will fail DFARS.
Five things your auditor can verify without trusting us.
Tamper-evidence, public anchoring, and auditor-controlled sampling are usually three different vendors. MergeWhy ships them in one GitHub App.
Tamper-evident audit log
Every audit row links to the prior via SHA-256. Altered, deleted, or out-of-order rows surface in the verifier instantly.
Anchored to Sigstore Rekor
Chain head signed and submitted to the public transparency log. Auditors verify inclusion without ever trusting MergeWhy.
Auditor-controlled sampling
Your audit firm pulls a stratified random sample directly from the auditor portal. We can't pre-pick which changes they review.
Named substitutes for missing primary controls
Define the substitute control your auditor will accept. Apply it to a gap, attest the evidence, get an immutable record.
Author / Reviewer / Approver / Deployer matrix
Cross-role overlap detection on every change. Author-also-deploys is flagged with citations to SOC 2 CC6.1 and SOX ITGC.
Three steps. Then it runs quietly, forever.
MergeWhy sits downstream of your existing flow. Engineers never see it. Compliance teams see everything.
Install
One-click GitHub App (GitLab + Bitbucket Q3). Read-only scopes on PR metadata, check runs, review events. SAML/SSO ready.
Merge
Engineers merge as normal. MergeWhy captures the full context at merge time and emits a signed evidence record. No pipeline changes, no CI latency.
Prove
Export OSCAL / CSV, or grant auditors read-only portal access. Each record is SHA-256 hashed and ed25519 signed — independently verifiable.
From merge to auditor-ready, in one continuous chain.
Every change flows through five automated stages. No manual screenshots. No end-of-quarter fire drill.
Six signals, one signed record.
Each record is a Merkle-linked bundle. Change a byte after the fact and the signature breaks.
PR intent
Title, description, linked tickets. What changed and why.
Review & SoD
Approvals, self-approve detection, reviewer identity.
Ticket linkage
Jira, Linear, GitHub Issues — bound, not inferred.
CI & coverage
Check runs, durations, artifacts, coverage delta.
Security scans
Snyk, Semgrep, CodeQL — SAST/SCA/secrets at merge.
Deploy attestation
Which commit reached which environment, when.
Every artifact, every environment, one trail.
When an auditor asks how a line of code reached prod, you hand over a chain — not a folder.
- GPG ok
- author signed
- sast ok
- sca ok
- 412/412
- smoke ok
- perf ok
- approved
- canary 10m ok
- rollback ready
- PAY-8821
Auditors type a question.
MergeWhy answers with evidence.
Grounded retrieval over your signed evidence vault. Every answer cites the underlying DER — PR, reviewer, CI run, ticket — so there's nothing to hallucinate and nothing to debate.
- Natural-language queries across SOC 2, SOX, FedRAMP evidence
- Citations back to signed DERs (no hallucination)
- Read-only auditor access via scoped portal tokens
One evidence layer. Twelve frameworks.
Capture once, map anywhere. Every framework card shows the specific articles and controls MergeWhy evaluates on your merges.
Works with the tools you already run.
CLI. SDK. Terraform. OpenAPI.
Configure as code, ship in minutes.
No procurement-review surprises. Every surface is open, documented, and scriptable. Wire MergeWhy into your stack in under an hour.
10+ commands: login, attest, ders, bundles, oscal, waivers, verify-chain, auditor-sample, compensating-control, sync.
7KB single-file ESM+CJS. Zero runtime deps. Typed MergeWhyClient + ApiError. Custom-fetch injection.
Codegen-ready spec covering 19+ public operations. Try-it-out playground at /api/v1/docs.
Manage frameworks, repos, webhooks, waivers as IaC. Go-based provider; ready for registry.terraform.io.
Per-event control evaluation. Not daily polling.
Most compliance tools snapshot your cloud posture once a day and call it monitoring. MergeWhy evaluates every code change against every enabled framework at the exact moment it merges — and gives each control an uptime % so auditors can see "this control passed 99.4% of changes in Q1" instead of a static checkmark.
Evidence that survives a real audit.
MergeWhy cryptographic evidence | Screenshot GRC legacy SaaS | Spreadsheets folder of PNGs | |
|---|---|---|---|
| Cryptographic proof | |||
| Merge-time capture | |||
| OSCAL export | |||
| Tamper detection | manual | ||
| Self-hosted option | |||
| SOX sampling engine | partial | ||
| Evidence reproducibility | manual |
Hosted, or entirely inside your perimeter.
SaaS
We host. 30-second install. US or EU data residency, 99.9% SLA on evidence capture.
- GitHub App, read-only scopes
- Regional data residency (US/EU)
- Append-only vault with hourly signed rollups
- 99.9% SLA on evidence capture
Self-hosted
Runs inside your VPC. Docker Compose, Kubernetes Helm, or Nomad. Source never leaves your network.
- Docker Compose / Kubernetes Helm / Nomad
- Air-gapped mode, offline licence
- BYO KMS: Vault, AWS KMS, GCP KMS
- FedRAMP High reference architecture
Four ways in. No seat fees. No evidence overages.
Try free, start with a founding-customer Sprint, or jump to a subscription. Every plan includes the same cryptographic evidence model.
14-day evidence sprint. We assemble 90 days of audit-ready evidence from your existing PRs. Sprint fee due on auditor sign-off. Lifetime price lock on subscription.
Apply for a founding seatStop explaining to auditors.
Start showing them.
Install on a repo this afternoon. Hand over a signed evidence bundle next week.