VENDOR EVIDENCE DRIFT API

An expired certificate is loud. A narrowed one is silent.

When a SOC 2 report drops a trust services criterion between years, the badge stays, the date stays, and the assurance is smaller than the one you signed off. Vendor Evidence Drift takes the evidence snapshot you captured last quarter and the one you captured today, and returns every change with a stable code, a fixed severity, the controls it bears on and a risk score whose arithmetic is printed beside it.

Get Free API Key See the output

Free tier: 150 evidence checks/month Paid from $499/month No card to run the demo

Live drift check Ready

Two snapshots of one vendor. Put "availability" back in the current scope and watch the risk band move.

Runs the same engine the paid endpoint uses. Nothing is stored and no key is needed. Northwind Software is a made-up vendor; the snapshots are illustrative.

Press “Check this vendor” to call the live API.

The problem

The evidence is public. The changes to it are not.

A vendor publishes current state: this is our certification, this is our subprocessor list, this is version 4.1 of the policy. There is no changelog, no version history and no notification. The only way to know what moved is to have kept the last copy and to compare it, field by field.

A trust page has no diff

The certification badge looks the same whether the report covers five trust services criteria or two. The subprocessor table looks the same whether it gained a row last Tuesday or has been static for a year. Nothing on the page tells you which.

Nobody re-reads an accepted report

A SOC 2 gets read once, at onboarding, by someone with eleven other vendors to clear. The next one arrives a year later and gets filed. The criterion that disappeared between the two is in neither review, because neither review was a comparison.

The clock starts when they publish

Subprocessor objection windows run from the vendor's publication date, not from when your quarterly review comes round. Find the change in month three and the assessment you do is retrospective — you are documenting a transfer, not deciding on one.

What it costs

Nothing fails. The assurance is just smaller than the one you accepted.

There is no incident, no breach and no alert. The vendor did nothing wrong and told you in the only way they were obliged to: they published. The gap opens between what your records say about them and what is now true.

Scope
A report that still says SOC 2 Type II
Current report, reputable auditor, unqualified opinion — and availability is no longer in scope. Everything downstream that cited it, including your own attestation and the questionnaires you have already returned, is now citing something narrower than it claims.
Jurisdiction
A transfer nobody assessed
A subprocessor appears in a country your transfer assessment never covered. The agreement may well permit it; the objection window has certainly closed. It surfaces during a customer's audit, which is the worst possible order to learn it in.
Commitment
Their SLA got weaker while yours stayed the same
99.95% became 99.90%. Over a thirty-day month that is roughly twenty-two extra minutes of permitted downtime, taken out of a budget you had already promised to your own customers on the strength of the old number.

What it returns

Six kinds of evidence, forty-four named changes.

Send the two snapshots your systems already hold. No document parsing, no model guessing at a report — you supply what you collected, and the engine does the set comparison and the day arithmetic that nobody wants to do by hand.

Output	What it answers	Why it is hard by hand
findings	Every change, worst first, with a stable code and a fixed severity.	The change is a set difference between two documents nobody kept.
controls	Which controls each change bears on, in three frameworks.	Means holding NIST CSF, ISO 27001 and SOC 2 in your head at once.
risk	One score and a band, with the arithmetic printed line by line.	A number you cannot reproduce is a number nobody will defend.
expiries	Days until expiry for every dated item, soonest first.	Inclusive last-day arithmetic, in UTC, done the same way every time.
warnings	What the check could not see, and why.	A blind spot is invisible by definition — that is what makes it one.

Snapshot t0 Snapshot t1 Paired Diffed Coded and scored Into your queue

01
You supply both snapshots

This service never fetches a vendor's trust page, never downloads a report and never verifies that a certificate is genuine. You send what you collected; it compares. Every endpoint is stateless — nothing about your vendors is retained here.
02
Pairing before diffing

Certifications pair by framework, subprocessors and policies by name, unless you supply an id. Two items that would pair to the same key are a 400 naming the index, not a coin toss — otherwise array order would decide whether a scope reduction is reported.
03
The asymmetry is the product

A subprocessor added in a country the vendor did not previously use is high. The same subprocessor removed is informational and scores zero. A narrowed audit scope outranks an expired certificate, because an expiry is on the cover page and a dropped criterion is not.
04
Expiry in whole UTC days

expiresAt is the last day covered, so a certificate expiring today is valid today. A certification that lapsed and never came back and one renewed forty-five days late are two different findings with two different codes, because they are two different conversations with the vendor.
05
Controls, then a score

Each finding maps to NIST CSF 2.0, ISO/IEC 27001:2022 Annex A and the SOC 2 criteria. Points come from severity alone — nothing else feeds the number — and risk.derivation prints every line of the addition.
06
Codes, not prose

Branch on code. GET /v1/drift-types publishes the whole catalogue, including the points table and the band boundaries, so a routing rule and a risk score can both be reproduced without calling us again.

Example output

One vendor, six months apart, four findings.

The SOC 2 was renewed on time and cleanly — and dropped availability. A subprocessor appeared in Brazil. The uptime commitment slipped five basis points. This is the response to POST /v1/checks, abridged to the fields that matter.

{
  "vendorId": "vnd-northwind",
  "baseline": false,
  "windowDays": 181,
  "reviewRequired": true,
  "materialChanges": 3,
  "counts": { "critical": 1, "high": 2, "medium": 0, "low": 0, "info": 1, "total": 4 },
  "risk": {
    "score": 95,
    "band": "severe",
    "rawPoints": 95,
    "capped": false,
    "derivation": [
      "points per finding: critical 45, high 25, medium 12, low 4, info 0",
      "certification: 2 findings — scope_reduced (critical, 45) + certification_renewed (info, 0) = 45",
      "subprocessor: 1 finding — subprocessor_added_new_jurisdiction (high, 25) = 25",
      "sla: 1 finding — sla_target_reduced (high, 25) = 25",
      "raw total = 95 across 4 findings",
      "score = 95",
      "band = severe (65-100)"
    ]
  },
  "findings": [
    {
      "code": "scope_reduced",  "severity": "critical",  "points": 45,
      "subject": "soc2_type2",
      "detail": "SOC 2 Type II no longer covers availability. The certification itself is still current, so nothing about its status flags this.",
      "recommendedAction": "Treat the removed scope as uncertified from the new report date…",
      "controls": [ "GV.SC-05", "GV.SC-07", "A.5.20", "A.5.22", "CC9.2" ],
      "data": { "removed": [ "availability" ] }
    },
    {
      "code": "subprocessor_added_new_jurisdiction",  "severity": "high",  "points": 25,
      "subject": "supportly",
      "detail": "Supportly was added in BR. No subprocessor in the previous snapshot operated in BR.",
      "data": { "country": "BR" }
    },
    {
      "code": "sla_target_reduced",  "severity": "high",  "points": 25,
      "subject": "uptime",
      "detail": "Uptime fell from 99.95% to 99.90%, a reduction of 5 basis points.",
      "data": { "previousValue": 9995, "currentValue": 9990, "deltaBasisPoints": 5 }
    },
    {
      "code": "certification_renewed",  "severity": "info",  "points": 0,
      "detail": "SOC 2 Type II was reissued on 2026-02-15 with no gap in coverage."
    }
  ],
  "expiries": [
    { "subject": "soc2_type2", "expiresAt": "2027-02-14", "daysUntilExpiry": 197, "status": "valid" }
  ],
  "warnings": []
}

The renewal was clean. The scope was not.

Two findings on the same certification, from the same pair of snapshots. A tool that reported only the worst one would send someone back for a second look, so the engine collects every finding rather than the first — a review queue needs the whole reason.

95, and you can check the addition

45 for the scope reduction, 25 for the new jurisdiction, 25 for the weaker SLA, 0 for the renewal. The points table is published at /v1/drift-types, so the score can be recomputed from the findings without trusting us for the arithmetic.

It says what it could not see

Omit scope and a scope reduction is undetectable; omit a policy contentHash and a silent edit is undetectable. Those checks do not quietly pass — they land in warnings, because a clean result and a result nobody could compute look identical on a dashboard.

This service is newly launched. We publish no uptime percentage, customer count, logo wall or certification claim until we have the operating history to support one. Northwind Software above is a made-up vendor. This API compares only the evidence you supply: it does not fetch vendor documents, does not verify the authenticity of any certificate or report, and makes no claim about any real vendor's actual posture. The control mapping is editorial, not an official crosswalk, and the output is not legal advice.

How it works

One call per vendor, per cycle

Keep the snapshot you already collect
Certifications, subprocessors, policies, SLA commitments, residency statements, pen-test and insurance documents. Store the one you captured; send it back as previous next cycle. First run? Omit previous and you get a baseline, which is a legitimate answer rather than a degraded one.
POST the pair
One check or up to fifty per request, billed one evidence check per vendor comparison. Back come findings, controls, expiries, a risk score and the list of comparisons that could not be made.
Route on the code, not the prose
Every finding carries material: true at high and above, and reviewRequired summarises the report. Push those into whatever already gets looked at — a GRC queue, a ticket, a digest. Leave info findings in the audit trail.

Rules the engine never bends

Integer comparisons, UTC days, fixed severities

Uptime is basis points. 99.95% is 9995. A committed target is the last place a float belongs, and a fractional one is a 400 naming the field, not a rounding.
Insurance cover is integer minor units with a currency. Two limits in different currencies are not compared — that needs a rate and a rate date, and inventing one manufactures a change out of nothing.
Dates are whole UTC days and expiresAt is the last day covered. A certificate expiring today is valid today, and a replacement issued the next day leaves no gap.
A code's severity never varies by instance. Where one event has two risk profiles there are two codes, so a routing rule keeps meaning what it meant.
An absent field means not observed, never "observed to be empty". Send exceptions: [] to mean none noted; omit it and the comparison is skipped and reported in warnings.
Output is deterministic. Same snapshots, same evaluation instant, same bytes — so this month's report can be diffed against last month's.

Developer integration

Three endpoints, versioned, OpenAPI-first

Authenticate with Authorization: Bearer <key>. Every error returns a stable code and a requestId you can quote, and validation failures name the exact field in details.path — down to the array index.

POST/v1/keysPublic. Issues a free key against your email — 150 evidence checks a month, no card.

POST/v1/checksCompare one vendor or up to 50. Billed one evidence check per vendor comparison.

POST/v1/demo/checkPublic. Real engine, capped at 40 evidence items across both snapshots. No key required.

GET/v1/drift-typesPublic. Every drift code, severity, control mapping and scoring constant.

curl -X POST https://web-production-e514b.up.railway.app/v1/checks \
  -H "Authorization: Bearer $VENDOR_EVIDENCE_DRIFT_KEY" \
  -H "content-type: application/json" \
  -d '{"check":{
        "vendorId":"vnd-northwind",
        "previous":{"capturedAt":"2026-02-01",
          "certifications":[{"framework":"soc2_type2","issuedAt":"2025-02-15",
            "expiresAt":"2026-02-14",
            "scope":["security","availability","confidentiality"]}],
          "subprocessors":[{"name":"Cloudmail","country":"US"}]},
        "current":{"capturedAt":"2026-08-01",
          "certifications":[{"framework":"soc2_type2","issuedAt":"2026-02-15",
            "expiresAt":"2027-02-14",
            "scope":["security","confidentiality"]}],
          "subprocessors":[{"name":"Cloudmail","country":"US"},
                           {"name":"Supportly","country":"BR"}]}}}'

Read the API reference OpenAPI specification

Python and TypeScript SDKs Service health: https://web-production-e514b.up.railway.app/health

Pricing

Priced per evidence check, capped so a portfolio sweep can’t surprise you

One unit is one vendor comparison — two snapshots in, one report out, however many certifications and subprocessors they contain. Every plan includes an allowance, then a per-unit overage that is hard-capped per billing period: your worst-case bill is the base price plus the cap, never more.

Developer

$499 /month

2,500 evidence checks included
$0.30 per additional evidence check
Overage capped at $1,000 per period
Full API access, Python and TypeScript SDKs

Start with this plan

Find the change before your customer's auditor does.

The free tier is 150 evidence checks a month, no card. Create a key, post two snapshots of one vendor, and read what moved between them.

curl -X POST https://web-production-e514b.up.railway.app/v1/keys \
  -H "content-type: application/json" \
  -d '{"email":"you@company.com","name":"Evaluation key"}'

Get Free API Key Run the live demo

An expired certificate is loud. A narrowed one is silent.

The evidence is public. The changes to it are not.

A trust page has no diff

Nobody re-reads an accepted report

The clock starts when they publish

Nothing fails. The assurance is just smaller than the one you accepted.

Six kinds of evidence, forty-four named changes.

You supply both snapshots

Pairing before diffing

The asymmetry is the product

Expiry in whole UTC days

Controls, then a score

Codes, not prose

One vendor, six months apart, four findings.

The renewal was clean. The scope was not.

95, and you can check the addition

It says what it could not see

One call per vendor, per cycle

Keep the snapshot you already collect

POST the pair

Route on the code, not the prose

Integer comparisons, UTC days, fixed severities

Three endpoints, versioned, OpenAPI-first

Priced per evidence check, capped so a portfolio sweep can’t surprise you

Find the change before your customer's auditor does.