Hetzner Cloud integration for self-hosted deployments — built and ready to contribute
The public integrations catalog lists Hetzner (2 checks), but the check DSL is intentionally excluded from the catalog sync and there is no code manifest — so self-hosted deployments get the catalog entry without the integration. We run Comp self-hosted (EU company, all production infra on Hetzner) and built the integration as a validated dynamic-integration JSON: 9 checks against the hcloud API with a read-only token — firewall attached per server, no management ports open to 0.0.0.0/0, backups enabled + recent, delete protection, LB https + health checks, certificate expiry, labeled-inventory evidence, SSH-key allowlist — each mapped to ISO 27001 / SOC 2 via taskMappings, with Spanish names/remediations (but we can provide an engilish version too). It runs daily against our real infrastructure and already surfaced a genuine finding on day one. We'd like to contribute it upstream so every self-hosted user gets Hetzner out of the box. Two possible paths — maintainers' choice: Code manifest under packages/integration-platform/src/manifests/hetzner/ (PR to dev per the writing-integrations docs). Caveat: code manifests take precedence over dynamic slugs, so this would shadow the production dynamic hetzner — happy to coordinate merging the two check sets. We donate the validated dynamic JSON so it lands in the production catalog for cloud and self-hosted alike. While building it we found and reported two runtime bugs with proposed fixes (GitHub issues: page pagination breaks on envelope APIs; buildUrl drops baseUrl path segments) plus a UX papercut (post-connect redirect goes to /cloud-tests, which is hardcoded to aws/gcp/azure and can never show the provider just connected). Happy to open the draft PR or hand over the JSON — whichever the team prefers.
Eudald Arranz about 1 month ago
Hetzner Cloud integration for self-hosted deployments — built and ready to contribute
The public integrations catalog lists Hetzner (2 checks), but the check DSL is intentionally excluded from the catalog sync and there is no code manifest — so self-hosted deployments get the catalog entry without the integration. We run Comp self-hosted (EU company, all production infra on Hetzner) and built the integration as a validated dynamic-integration JSON: 9 checks against the hcloud API with a read-only token — firewall attached per server, no management ports open to 0.0.0.0/0, backups enabled + recent, delete protection, LB https + health checks, certificate expiry, labeled-inventory evidence, SSH-key allowlist — each mapped to ISO 27001 / SOC 2 via taskMappings, with Spanish names/remediations (but we can provide an engilish version too). It runs daily against our real infrastructure and already surfaced a genuine finding on day one. We'd like to contribute it upstream so every self-hosted user gets Hetzner out of the box. Two possible paths — maintainers' choice: Code manifest under packages/integration-platform/src/manifests/hetzner/ (PR to dev per the writing-integrations docs). Caveat: code manifests take precedence over dynamic slugs, so this would shadow the production dynamic hetzner — happy to coordinate merging the two check sets. We donate the validated dynamic JSON so it lands in the production catalog for cloud and self-hosted alike. While building it we found and reported two runtime bugs with proposed fixes (GitHub issues: page pagination breaks on envelope APIs; buildUrl drops baseUrl path segments) plus a UX papercut (post-connect redirect goes to /cloud-tests, which is hardcoded to aws/gcp/azure and can never show the provider just connected). Happy to open the draft PR or hand over the JSON — whichever the team prefers.
Eudald Arranz about 1 month ago
identify what requirements are satisfied by policy/evidence/integration via tag
it would be a huge help to be able to identify what policies or evidence are tied to which compliance requirements and a way to be able to keep track which requirements have not been satisfied
lravelo 6 months ago
identify what requirements are satisfied by policy/evidence/integration via tag
it would be a huge help to be able to identify what policies or evidence are tied to which compliance requirements and a way to be able to keep track which requirements have not been satisfied
lravelo 6 months ago
Show in trust page when the security audio was run
The goal is to show that on top of SOC 2 we also had an external audit. and the date and maybe some ranking or overview of it
Martin DONADIEU 12 months ago
Show in trust page when the security audio was run
The goal is to show that on top of SOC 2 we also had an external audit. and the date and maybe some ranking or overview of it
Martin DONADIEU 12 months ago
show on trust page that our SOC 2 compliance report is only available for a certain plan
The goal is to use the trust page as sales material for our enterprise plan and explain clearly how to get it.
Martin DONADIEU 12 months ago
show on trust page that our SOC 2 compliance report is only available for a certain plan
The goal is to use the trust page as sales material for our enterprise plan and explain clearly how to get it.
Martin DONADIEU 12 months ago
Ensure user has actually reviewed policies and security training videos
Feedback on the policy review and training, an employee doesn't actually have to read the policies or watch the videos, they can just mark them off as reviewed. There should be some more controls around ensuring the employee has actually done the review of the documents or played the videos.
wthomson 12 months ago
Ensure user has actually reviewed policies and security training videos
Feedback on the policy review and training, an employee doesn't actually have to read the policies or watch the videos, they can just mark them off as reviewed. There should be some more controls around ensuring the employee has actually done the review of the documents or played the videos.
wthomson 12 months ago
Ability to track policy todos
One of the biggest holdups for me is that I’ve been going through each policy and making a checklist of the claims within each policy and determining if it's currently done, an easy to-do, if it needs a process update, or something else. I’d love to have some sort of way to track/manage those within each policy (and have it on an account level). Having that built into the policies would actually be SUPER helpful. Right now, I'm doing that manually.
Zack Gilbert 12 months ago
Ability to track policy todos
One of the biggest holdups for me is that I’ve been going through each policy and making a checklist of the claims within each policy and determining if it's currently done, an easy to-do, if it needs a process update, or something else. I’d love to have some sort of way to track/manage those within each policy (and have it on an account level). Having that built into the policies would actually be SUPER helpful. Right now, I'm doing that manually.
Zack Gilbert 12 months ago
Email invites for employees for the employee portal
Shoot an invite to employee emails with the link for the employee portal.
Dustin Turska about 1 year ago
Email invites for employees for the employee portal
Shoot an invite to employee emails with the link for the employee portal.
Dustin Turska about 1 year ago
Integration with SentinelOne
monitor for: device status threat detection events security configurations (ensuring that they match what is required from the compliance framework in question)
lravelo about 1 year ago
Integration with SentinelOne
monitor for: device status threat detection events security configurations (ensuring that they match what is required from the compliance framework in question)
lravelo about 1 year ago
Integrate with MDMs (i.e., JumpCloud, Intune, Endpoint Central) to pull user endpoint info
As an alternative to installing the CompAI agent, would be great to just leverage existing MDMs and their API’s to pull end users’ device data to find out if their machines are encrypted, have an anti-virus, etc.
lravelo about 1 year ago
Integrate with MDMs (i.e., JumpCloud, Intune, Endpoint Central) to pull user endpoint info
As an alternative to installing the CompAI agent, would be great to just leverage existing MDMs and their API’s to pull end users’ device data to find out if their machines are encrypted, have an anti-virus, etc.
lravelo about 1 year ago
Integration with Bitbucket for automated evidence
check for things like MFA, repo visibility, etc. Would also be nice to check if accounts of terminated personnel still exist in BitBucket in order to terminate.
lravelo about 1 year ago
Integration with Bitbucket for automated evidence
check for things like MFA, repo visibility, etc. Would also be nice to check if accounts of terminated personnel still exist in BitBucket in order to terminate.
lravelo about 1 year ago
Automated testing of Cloudflare config & security via API
Test for certain things: MFA enforcement is enabled Notifications are enabled IP Access rules are enabled Unwanted traffic is filtered Zone level rules are configured
lravelo about 1 year ago
Automated testing of Cloudflare config & security via API
Test for certain things: MFA enforcement is enabled Notifications are enabled IP Access rules are enabled Unwanted traffic is filtered Zone level rules are configured
lravelo about 1 year ago
Non-Admin should not show up on policy/tasts drop-dows
When wrapping up a task I wanted to assign it to another admin but the list displays both admins and employees. Only admins should be in the lists as they’re in charge of the process, not regular employees.
Francisco Saez about 1 year ago
Non-Admin should not show up on policy/tasts drop-dows
When wrapping up a task I wanted to assign it to another admin but the list displays both admins and employees. Only admins should be in the lists as they’re in charge of the process, not regular employees.
Francisco Saez about 1 year ago
Completed
Policy Table Filter
The table should have quick filters by department (missing field, added as feature request) and by admin. that way I can quickly review wchich ones I need to approbe.
Francisco Saez about 1 year ago
Completed
Policy Table Filter
The table should have quick filters by department (missing field, added as feature request) and by admin. that way I can quickly review wchich ones I need to approbe.
Francisco Saez about 1 year ago
Add Department Row on Policy Table
As a COMP customer I’d love to see on the main policy table the field “Department” to quickly see which policlies belong to which department on this overiew table. Right now I can only see the department when the specific policy is open
Francisco Saez about 1 year ago
Add Department Row on Policy Table
As a COMP customer I’d love to see on the main policy table the field “Department” to quickly see which policlies belong to which department on this overiew table. Right now I can only see the department when the specific policy is open
Francisco Saez about 1 year ago
Automatic task assignment by role
As a Comp user I’d like to add the critical team members during onboarding so the different tasks are automatically split between them. Tech goes to CTO HR gos to HR/Legal Etc.etc
Francisco Saez about 1 year ago
Automatic task assignment by role
As a Comp user I’d like to add the critical team members during onboarding so the different tasks are automatically split between them. Tech goes to CTO HR gos to HR/Legal Etc.etc
Francisco Saez about 1 year ago
New portal themes not working
My system theme is dark, but the portal doesnt adopt it. Also when i change it to dark manually, nothing happends:
Markus Palm about 1 year ago
New portal themes not working
My system theme is dark, but the portal doesnt adopt it. Also when i change it to dark manually, nothing happends:
Markus Palm about 1 year ago
More branding controls in the Trust Center
Our Trust Center is embedded directly into our website and plays a key role in shaping how large customers perceive our brand. Since it’s a touchpoint designed to build confidence, it’s important that it visually aligns with our brand identity. Right now, customization options are quite limited, which creates a mismatch with our otherwise consistent brand experience. Some things I’d like to do: Color customization – Ability to set primary, secondary, and background colors. (Example: we’d like a dark background theme to match our website.) Customize the header - add a description, contact email, and external links More subtle ‘Monitored by Comp AI‘ - should be at the bottom of the page. While I totally get its value, being a fellow startup, it should be a bit more discreet, especially on a site whose whole goal is to ensure trust. I don’t want to market another startup overly on it. I think that at the bottom of the page is equally good, as someone who’s interested will scroll there to check it out anyway. I think Intercom’s Trust Center is a good example of what we’d like to achieve with branding and customizations:
Markus Palm about 1 year ago
More branding controls in the Trust Center
Our Trust Center is embedded directly into our website and plays a key role in shaping how large customers perceive our brand. Since it’s a touchpoint designed to build confidence, it’s important that it visually aligns with our brand identity. Right now, customization options are quite limited, which creates a mismatch with our otherwise consistent brand experience. Some things I’d like to do: Color customization – Ability to set primary, secondary, and background colors. (Example: we’d like a dark background theme to match our website.) Customize the header - add a description, contact email, and external links More subtle ‘Monitored by Comp AI‘ - should be at the bottom of the page. While I totally get its value, being a fellow startup, it should be a bit more discreet, especially on a site whose whole goal is to ensure trust. I don’t want to market another startup overly on it. I think that at the bottom of the page is equally good, as someone who’s interested will scroll there to check it out anyway. I think Intercom’s Trust Center is a good example of what we’d like to achieve with branding and customizations:
Markus Palm about 1 year ago
Category tabs in the Trust Center
Would be crucial to be able to have different category tabs in the Trust Center for all of your relevant security & privacy documents and questions. E.g. Resources, Controls, Subprocessors, FAQ, Updates, etc. The AI chat in the future could also use them as additional data sources based on which ones the user has access to. The goal is for us to have this stuff as much self-serve as possible, so it’s important that everything security-related is in one place - which for us is Comp.
Markus Palm about 1 year ago
Category tabs in the Trust Center
Would be crucial to be able to have different category tabs in the Trust Center for all of your relevant security & privacy documents and questions. E.g. Resources, Controls, Subprocessors, FAQ, Updates, etc. The AI chat in the future could also use them as additional data sources based on which ones the user has access to. The goal is for us to have this stuff as much self-serve as possible, so it’s important that everything security-related is in one place - which for us is Comp.
Markus Palm about 1 year ago
Resources support in Trust Center
It would be nice to have support for all kinds of resources we want to provide our customers in the Trust Center, including all of our security reports (SOC 2, etc.). It should be possible to make them ‘Request access’ only. The AI chat in the future could also use them as additional data sources based on which ones the user has access to. The goal is for us to have this stuff as much self-serve as possible, so it’s important that everything security-related is in one place - which for us is Comp.
Markus Palm about 1 year ago
Resources support in Trust Center
It would be nice to have support for all kinds of resources we want to provide our customers in the Trust Center, including all of our security reports (SOC 2, etc.). It should be possible to make them ‘Request access’ only. The AI chat in the future could also use them as additional data sources based on which ones the user has access to. The goal is for us to have this stuff as much self-serve as possible, so it’s important that everything security-related is in one place - which for us is Comp.
Markus Palm about 1 year ago