Audit prep
Filter the audit log to the audit window. Export CSV or JSON by date range and action type. Hand it to the auditor. Same export your CFO asks for at quarter-end.
Audit-ready policy attestation without the GRC platform.
Nothing about your policy work counts until you can hand over per-employee, per-round evidence. That is the one thing Listor is for. Renewal sweeps, force-reattestation on change and a full CSV or JSON export come with it. It is built for the single compliance lead at a 50 to 300 person company who has to cover the attestation slice without a Vanta budget.
$2 / user / month. Free for 10 assigned people. No card.SOC 2 and ISO 27001 in flight · No DPA needed · Works alongside Vanta
Per-employee, per-round, IP-stamped. Export it whenever the auditor asks.
The ask
Nobody volunteers for audit prep.
Your auditor wants per-employee, per-round evidence that every policy was acknowledged. You have a folder of PDFs and an inbox of reply-alls. You have six weeks.
Last year you pulled the evidence together by hand. It took four full weeks. This year the company doubled.
Your CFO asks what compliance tools cost. You priced Vanta. Vanta priced you. You declined.
Workflow
Everything an auditor asks for is already sitting there.
Audit prep, renewal and evidence export are the three things a compliance lead does with policy attestation. Listor covers each of them without being asked.
Renewal
Set a renewal interval per policy. Listor opens the next attestation window as each interval comes due. An auditor working back through the cycles finds a window on record for each one.
Evidence export
Per-employee, per-round evidence on demand. Every attestation carries the IP, user-agent, timestamp, and the re-attestation round it belongs to. CSV or JSON, filtered to the window the auditor asked for.
Vanta question
Keep Vanta. Add the attestation piece under it.
Vanta automates the SOC 2 framework and Listor handles the policy attestation underneath it. Teams that run both keep the framework controls in Vanta and let Listor produce the per-employee, per-policy evidence an auditor opens first.
Per-employee evidence is what auditors actually open. Listor produces it on demand.
Two dollars, four dollars, or nothing.
The question that decides your tier is how far back an auditor can reach. Pro keeps two years of audit log at $2 a head. Business makes that retention window unlimited and adds SSO, at $4. At ten assigned people or fewer there is no bill at all.
Free
$0forever
Up to 10 assigned people, 5 documents.
Start freePro
$2/ user / month
Unlimited documents, renewals, audit log.
Start freeBusiness
$4/ user / month
SSO, custom retention, priority support.
Talk to usStart with the SOC 2 one.
Does Listor cover everything a SOC 2 auditor will ask about policy attestation?
Yes. For the policy-acknowledgement piece. The auditor wants per-employee evidence with timestamps, showing each round of acknowledgement; Listor captures that and exports it. SOC 2 has many more controls beyond policy attestation (vulnerability management, access reviews, etc.). Listor is not a full GRC platform.Can we use Listor alongside Vanta or Drata?
Yes. Many teams use Vanta for the SOC 2 framework and Listor for the actual policy attestation piece. Listor exports clean evidence that drops into the auditor's request list.What about ISO 27001 / 9001?
Same answer. Listor handles the per-policy, per-employee attestation evidence ISO controls require. Map each policy to its control reference in the doc title or description; the audit log groups cleanly by document.How does Listor handle policy version control?
Listor does not version your documents. They live in Notion, Drive, or Confluence and keep their own revision history there, which is the point of the link-only design. What Listor versions is the acknowledgement: mark a policy changed, force re-attestation, and a new round opens while the previous round stays intact underneath. You can show exactly who confirmed before the change and who confirmed after. Keep your own copy of what the policy said at each revision; that part is your document system’s job, not ours.Can we restrict who can change policies?
Yes. Listor uses role-based access control per workspace: only Org Admins and Group Owners can edit documents. All changes are written to the audit log with the actor's identity.How long do you retain the audit log?
90 days on Free, 2 years on Pro, unlimited on Business. Audit-log entries are immutable, and deletion is permanent.What does the auditor actually want from this?
Per-employee, per-policy evidence with timestamps, showing each round of acknowledgement. Listor's CSV export delivers exactly that, filtered to whatever window the auditor asked for. Most auditors accept it on the first round.
The next audit can be boring.
Start freeFree for ten assigned people, and the audit log starts collecting on day one.