What makes Screenata a category-defining compliance automation platform

Screenata is an AI Compliance Officer for startups: an agent named Vera who runs continuous compliance. She connects read-only to your GitHub and cloud, writes deterministic SOC 2 policies grounded in your real systems, runs every test in your control matrix, captures the application evidence APIs can't see, DMs your team in Slack for the attestations only a person can answer, and files everything as signed, traceable artifacts. A dashboard flags the work; Vera does it. She brings documentation time from 60 minutes to under 5 per control and the total cost of SOC 2 from roughly $85K to about $18K in the first year.

What Problem Does Screenata Solve?

The compliance market splits a SOC 2 audit into two halves of work, and the traditional stack covers only one of them well.

The 20% Manual Evidence Gap

A GRC dashboard like Drata or Vanta is excellent at infrastructure controls. It connects to AWS, GitHub, and Okta through APIs to confirm databases are encrypted and MFA is enforced, which covers roughly 80% of a SOC 2 audit.

The remaining 20%, the application-level and process-based controls, has no API to call:

Role-based access control: proving a "Viewer" cannot perform "Admin" actions.
Change management: documenting the UI approval of a production release.
Incident response: showing the visual trail of a security investigation.
User offboarding: verifying a user's access was removed from a proprietary dashboard.

A dashboard can list these controls and turn the row red when evidence is missing, but it cannot run the test or take the screenshot. It tracks status. Someone has to do the work.

The Cost of Manual Documentation

Before Vera, compliance teams spent 40 to 80 hours per quarter performing tests, taking screenshots, pasting them into Word, and writing narratives. The process is error-prone, since a missing timestamp or blurred image becomes an audit exception. It is expensive, since well-paid engineers spend weeks on screenshot duty. And it is inconsistent, since different people document evidence in different formats that frustrate auditors.

The Bigger Problem: No Compliance Expertise

Evidence collection is only half the story. Every GRC dashboard assumes you already have someone who knows compliance, a vCISO or consultant to write your policies, map controls to Trust Services Criteria, and prep the audit. Most startups do not have that person, so they pay $2K to $5K a month for one on top of the platform fee. Vera replaces both the platform and the consultant.

What Is an AI Compliance Officer?

Screenata defines this category by being an agent who runs the program rather than a board that displays it. Vera writes policies, scans infrastructure, runs the control tests, captures application evidence, chases attestations, maps controls, and scores readiness.

Category-Defining Characteristics

Feature	Traditional GRC (Drata/Vanta)	Vera
Data source	Cloud APIs (read-only)	Codebase + cloud + browser
Policy writing	Templates you fill in	Deterministic, from your real systems
Control mapping	Partial (infra only)	Full (automated to TSC, cross-framework)
Evidence output	JSON, logs	Policies, signed PDFs, screenshots, configs
Attestation chasing	None	Slack DM, 24h reminder, 48h escalation
Compliance guidance	None	AI assistant plus readiness dashboard
Artifact integrity	Partial	Signed (RSA/ECDSA, RFC 3161, SHA-256)
Still need a consultant?	Yes ($2-5K/mo)	No

How Vera Works: a Step-by-Step Breakdown

Vera is a full compliance program in one agent: codebase analysis, policy writing, evidence collection, control mapping, attestation chasing, and audit prep.

1. Codebase and Cloud Analysis

Vera connects read-only to your GitHub org and cloud environment. She scans your codebase, reads your AWS, GCP, or Azure configuration, and maps your tech stack, auth system, CI/CD pipeline, and existing security controls. Source code is read ephemerally: findings are kept, the source is deleted, and credentials live in a key vault.

2. Deterministic Policy Writing from Your Real Systems

Vera pre-fills a readiness questionnaire from what she found, asks you to confirm or correct it, and composes each policy from your attestations. You get "Acme Corp enforces MFA through Clerk for all user accounts," not "the organization shall implement access controls," with every claim tied to evidence you can produce. The generator is deterministic, so the same attestation yields the same sentence and an auditor can re-derive your policy from your questionnaire. See why generic ChatGPT policies fail audits.

3. API Scans for the Automated 70%

Across 489+ native checks spanning 20 providers, Vera pulls the same infrastructure and identity evidence a dashboard reads: branch protection, required reviews, MFA enforcement, cloud encryption settings, and audit-log exports. Roughly 70% of your evidence is fully automated this way, and each result is filed as a signed artifact mapped to its control.

4. Workflow Capture for the Application 20%

When a control lives behind your UI, Vera uses the browser extension to run the test. As the workflow proceeds, she captures the clicks, inputs, and navigation events, watching for compliance-relevant moments such as an access-denied message, a saved configuration change, a displayed permission level, or a generated report. Capture happens only during the active test, and a DOM snapshot records that the elements existed as shown.

5. Vision-Model Scoring and Narrative

Once the recording stops, a vision model reads each capture the way a reviewer would, checking labels, error messages, and role badges to decide whether the screen demonstrates the control. It drafts a step-by-step narrative, maps the evidence to the relevant SOC 2 criterion or ISO 27001 Annex A control, and attaches metadata: timestamp, tester identity, URL context, and browser version. Low-confidence captures are flagged for your review rather than guessed.

6. Attestation Chasing in Slack

Some evidence has no API and no screen. "Did the access review happen, and did the right people approve it?" is a question only a person can answer. Vera DMs the right teammate in Slack with the specific ask, reminds them at 24 hours, escalates at 48 hours, and files the reply as a signed attestation tied to the control. A dashboard can only put that question on a list.

7. Control Mapping and Readiness Scoring

Every policy claim maps to specific Trust Services Criteria. A readiness dashboard shows your audit score, what is left, and what is blocking certification, and the AI assistant answers questions and tells you what to do next.

8. Export and Audit Handoff

When your readiness score reaches 100%, Vera assembles an audit-ready package: signed PDF evidence packs, or a ZIP with PDFs, raw images, and a JSON manifest. If you keep a dashboard, she syncs each pack into the matching Drata or Vanta control.

Why Vera Covers SOC 2, ISO 27001, and HIPAA

Vera is a cross-framework engine. She collects evidence once and maps it into each framework's language through a shared canonical control catalog, so a single MFA scan satisfies SOC 2 CC6.1 and HIPAA §164.312(d) at the same time.

SOC 2 Type II

A Type II audit proves controls operated over a period, usually 3 to 12 months. Vera runs continuously, so fresh, timestamped evidence is always on hand instead of a frantic week of re-collection before the window closes.

ISO 27001:2022

ISO requires documented evidence of Annex A controls such as A.9.2.2 (user access provisioning). Vera supplies the visual narrative ISO auditors look for to confirm a policy is active in the product, not just written on paper.

HIPAA

For healthcare companies, proving Administrative Safeguards (§164.308) is critical. Vera documents periodic access reviews and workstation configurations without exposing PHI, thanks to automatic redaction at the point of capture.

Example: Proving Role-Based Access Control (CC6.1)

Objective: demonstrate that a "Marketing" user cannot reach "Billing" settings.

The Manual Way (about 60 minutes)

Log in as a Marketing user.
Navigate to the Billing page.
Screenshot the "403 Forbidden" error.
Log out and back in as an Admin.
Navigate to User Management.
Screenshot the Marketing user's role.
Open a Word doc, paste images, write three paragraphs.
Save as PDF and upload to the dashboard.

The Vera Way (a couple of minutes, mostly review)

Open the Billing page and start the test in the extension.
Vera captures the access-denied screen, the DOM, the URL, and a signed timestamp.
The vision model drafts the narrative: "User attempted to access /billing; the system returned a 403 Forbidden based on the 'Marketing' role."
You approve; Vera files the signed pack and syncs to Drata if you run it.

The result is roughly 93% less time and a more consistent report for the auditor.

Comparison: Vera vs. Traditional Methods

Metric	Manual Screenshots	Screen Recording	Vera
Time per control	60-90 mins	20-30 mins	under 5 mins
Audit readiness	Variable	Poor (auditors dislike video)	Excellent (signed PDF/ZIP)
Scalability	None	Low	High (repeatable tests)
Provenance	None	Limited	Full (URL, user, timestamp, signature)
Attestation chasing	Manual email	Manual email	Slack DM with escalation
Policy writing	Manual	Manual	Deterministic, from your systems
Control mapping	Manual	Manual	Automated, cross-framework
Total first-year cost	about $85K	about $85K	about $18K

See the full cost breakdown.

The AI Behind Vera

Vera uses a focused AI stack for audit reliability, and uses it for capture and narrative, never to invent evidence:

Vision model: identifies UI elements like Save buttons and error modals so a capture proves the right context.
OCR: extracts on-screen text so an auditor can search "Access Denied" across hundreds of pages instead of scrolling a folder.
Narrative drafting: writes an auditor-friendly description of each step for your approval, removing the manual typing.
Automatic redaction: masks PII and secrets before evidence is saved.

Underneath all of it, the policy generator stays deterministic. The reasoning that defends Vera's output to an auditor is not model fluency; it is that the same attestation always produces the same control language, and every artifact is signed.

A Week in Vera's Cadence

Evidence collection works as a standing rhythm rather than a one-time event. Once connected, Vera runs a 6:00 evidence-freshness check, a 6:15 readiness snapshot, and a 6:30 Slack briefing every morning. Weekly, she scans cloud and repos for drift. Quarterly, she schedules and chases access reviews. Annually, she refreshes the risk assessment. When a control slips, she opens the work rather than waiting for the audit to surface it. That is what keeps you audit-ready between cycles instead of scrambling before each one.

Frequently Asked Questions

Is Vera a replacement for Vanta or Drata?

For most startups, yes. Vera covers both halves of SOC 2: roughly 70% of evidence through her own API scans of the same sources a dashboard reads, and the application 20% through guided capture and Slack attestations, plus policy writing, control mapping, and readiness scoring. A dashboard flags work; Vera does it. You still need an independent auditor to issue the report, but she preps everything they need. If you already run a dashboard, she works alongside it to close the gap. For first-time SOC 2 teams this is the simpler, cheaper path.

Do auditors accept Vera's evidence?

Yes. Her artifacts are standardized, timestamped, and signed, with the metadata (URL, browser, tester) manual screenshots often lack. Each one traces back through a control test to a policy claim, and the signatures are verifiable independently with a free CLI. Vera uses AI to capture and narrate, never to fabricate.

How long does setup take?

Under 15 minutes. You connect Vera read-only to GitHub, your cloud, and your identity provider, with no agents to deploy and no code changes. She then scopes your control matrix and drafts policies, so you see real readiness on day one.

Can Vera handle custom internal applications?

Yes. Because the capture engine operates at the browser level, it works with any web application, including internal admin panels, proprietary dashboards, and third-party SaaS tools.

Does Vera replace our auditor?

No. Vera does the preparation: collecting evidence, writing policies, and assembling the pack. An independent CPA firm still issues your SOC 2 report. Because her output is deterministic and traceable, their review tends to go faster.

Key Takeaways

Screenata is an AI Compliance Officer, an agent named Vera, who runs continuous compliance instead of charting it on a dashboard.
A dashboard flags the work; Vera does it. She covers ~70% of evidence through API scans, ~9% through application screenshots, and chases the attestations in between.
She writes deterministic policies from your real systems and signs every artifact, so each ties back through a control test to a policy claim.
For most startups she replaces both the GRC platform and the consultant for around $18K in the first year, against roughly $85K traditional. You still need an independent auditor; Vera preps everything they need.
Honest escalation is part of the design. She runs the tests she can and hands judgment calls to a person.