# Iru Docs: Compliance ## Compliance ### Getting Started - [Getting Started with Compliance](https://docs.iru.com/en/compliance/getting-started-with-compliance.md): Get started with Iru Compliance: frameworks, controls, actions, evidence, sources, and Trust Center. Follow the recommended setup order and core concepts. - [Compliance Permissions](https://docs.iru.com/en/compliance/compliance-permissions.md): Configure role-based access controls for Iru Compliance. Assign permissions to team members for frameworks, actions, evidence, and Trust Center. ### Actions - [Actions Management](https://docs.iru.com/en/compliance/actions-management.md): Create, assign, and track compliance actions in Iru. Link controls to evidence, set deadlines, and monitor completion status across frameworks. ### Frameworks - [Frameworks Management](https://docs.iru.com/en/compliance/frameworks-management.md): Add, configure, and manage compliance frameworks in Iru. Map controls to actions, track progress, and maintain audit-ready documentation. - [Adaptive Compliance](https://docs.iru.com/en/compliance/adaptive-compliance.md): Review and approve Iru AI recommendations that update compliance control and action wording when connected Sources or policy artifacts change. ### Artifacts - [Artifacts Management](https://docs.iru.com/en/compliance/artifacts-management.md): Upload, organize, and manage compliance artifacts and evidence in Iru. Attach files to actions, validate evidence, and prepare for audits. ### Sources - [Sources Management](https://docs.iru.com/en/compliance/sources-management.md): Manage Iru Compliance evidence sources: connector setup, authentication, troubleshooting, and enabling or removing integrations under Compliance Sources. #### Connectors ##### Analytics - [Databricks](https://docs.iru.com/en/compliance/sources/databricks-source.md): Connect Databricks to Iru Compliance with a workspace URL and a read-only access token to collect user and group inventory, workspace permissions, cluster security settings, and secret scope access controls. - [Fivetran](https://docs.iru.com/en/compliance/sources/fivetran-source.md): Connect Fivetran to Iru Compliance using HTTP Basic Auth with your REST API key and secret to collect connector, destination, and group-membership evidence. - [Segment](https://docs.iru.com/en/compliance/sources/segment-source.md): Connect Segment to Iru Compliance with a Public API access token to collect workspace, source, destination, and tracking-plan evidence. ##### Cloud infrastructure - [Google Cloud Platform](https://docs.iru.com/en/compliance/sources/google-cloud-sources.md): Connect Google Cloud Platform to Iru Compliance using a read-only service account and JSON key to collect IAM, storage, logging, and network evidence. ##### Communications - [Aircall](https://docs.iru.com/en/compliance/sources/aircall-source.md): Connect Aircall to Iru Compliance with HTTP Basic auth (api_id and api_token) to collect call activity, user, and team membership evidence. - [RingCentral](https://docs.iru.com/en/compliance/sources/ringcentral-source.md): Connect RingCentral to Iru Compliance with OAuth 2.0 and the platform host that matches your account to collect user, role, and platform configuration evidence. - [Slack](https://docs.iru.com/en/compliance/sources/slack-source.md): Connect Slack to Iru Compliance with a bot token to collect workspace metadata, channel inventory, user and group membership, and Enterprise Grid audit logs. ##### CRM - [Attio](https://docs.iru.com/en/compliance/sources/attio-source.md): Connect Attio to Iru Compliance with a workspace admin access token using least-privilege read scopes to collect CRM workspace, member, and object metadata. - [Freshsales](https://docs.iru.com/en/compliance/sources/freshsales-source.md): Connect Freshsales to Iru Compliance with an API key and bundle alias to collect user roles, permission matrices, and territory-based access controls. - [WordPress](https://docs.iru.com/en/compliance/sources/wordpress-source.md): Connect WordPress to Iru Compliance over the REST API using HTTP Basic Auth with an Application Password to collect site, user, role, and plugin evidence. ##### Databases - [Snowflake](https://docs.iru.com/en/compliance/sources/snowflake-source.md): Connect Snowflake to Iru Compliance with key-pair JWT authentication and ACCOUNT_USAGE access to collect role grants, users, and data-governance evidence. ###### Amazon sources - [Amazon Redshift Data API](https://docs.iru.com/en/compliance/sources/amazon-redshift-data-api-source.md): Use a cross-account IAM role so Iru Compliance can read Redshift Data API statement and schema metadata for clusters and serverless workgroups. - [Amazon Redshift Serverless](https://docs.iru.com/en/compliance/sources/amazon-redshift-serverless-source.md): Connect Amazon Redshift Serverless to Iru Compliance with a cross-account IAM role to collect namespace, workgroup, snapshot, and access metadata. - [Amazon DynamoDB](https://docs.iru.com/en/compliance/sources/amazon-dynamodb-source.md): Connect Amazon DynamoDB to Iru Compliance with a cross-account IAM role to collect table inventory, encryption settings, and control-plane metadata. - [Amazon Relational Database Service (RDS)](https://docs.iru.com/en/compliance/sources/amazon-relational-database-service-rds-source.md): Connect Amazon RDS to Iru Compliance with a cross-account IAM role to collect database instance configuration, cluster, and snapshot inventory metadata. - [Amazon Redshift](https://docs.iru.com/en/compliance/sources/amazon-redshift-source.md): Connect Amazon Redshift provisioned clusters to Iru Compliance with a cross-account IAM role to collect cluster configuration, snapshot, and parameter metadata. ##### Developer tools - [Bitbucket Cloud](https://docs.iru.com/en/compliance/sources/bitbucket-cloud-source.md): Connect Bitbucket Cloud to Iru Compliance with an Atlassian API token using HTTP Basic auth to collect workspace, repository, and pull request review evidence. - [Contentful](https://docs.iru.com/en/compliance/sources/contentful-source.md): Connect Contentful to Iru Compliance with a Content Management API personal access token to collect spaces, content models, environments, and team membership. - [DigitalOcean](https://docs.iru.com/en/compliance/sources/digitalocean-source.md): Connect DigitalOcean to Iru Compliance with a scoped personal access token to collect Droplet inventory, networking, and team-account metadata as evidence. - [Doppler](https://docs.iru.com/en/compliance/sources/doppler-source.md): Connect Doppler to Iru Compliance with a service or personal API token to collect project, environment, and secret-metadata evidence. - [Drupal](https://docs.iru.com/en/compliance/sources/drupal-source.md): Connect Drupal to Iru Compliance over JSON:API using HTTP Basic Auth with a read-only service account to collect site, user, and role configuration evidence. - [Figma](https://docs.iru.com/en/compliance/sources/figma-source.md): Connect Figma to Iru Compliance through OAuth to collect organization, team, file, and library inventory along with member and access-control evidence. - [GitHub](https://docs.iru.com/en/compliance/sources/github-source.md): Connect GitHub to Iru Compliance with a personal access token to collect repository inventory, branch protection, organization membership, and audit logs. - [GitLab](https://docs.iru.com/en/compliance/sources/gitlab-source.md): Connect GitLab to Iru Compliance with a personal access token to collect project inventory, branch protection, group membership, and audit-event evidence. - [Heroku](https://docs.iru.com/en/compliance/sources/heroku-source.md): Connect Heroku to Iru Compliance with a Platform API token to collect app, pipeline, add-on, team-access, and dyno configuration evidence for audits. - [Jenkins](https://docs.iru.com/en/compliance/sources/jenkins-source.md): Connect Jenkins to Iru Compliance using HTTP Basic Auth with a username and API token to collect job configuration, build history, and plugin evidence. - [Microsoft Azure DevOps](https://docs.iru.com/en/compliance/sources/microsoft-azure-devops-source.md): Connect Microsoft Azure DevOps to Iru Compliance with Microsoft Entra ID OAuth to collect project settings, repositories, branch policies, pull requests, pipelines, permissions, and organization audit activity. - [OpenAI](https://docs.iru.com/en/compliance/sources/openai-source.md): Connect OpenAI to Iru Compliance with a Platform API key to collect project settings, API key inventory, usage metrics, and organization metadata. - [PagerDuty](https://docs.iru.com/en/compliance/sources/pagerduty-source.md): Connect PagerDuty to Iru Compliance with a read-only REST API key to collect incidents, services, escalation policies, and on-call evidence. - [Postman](https://docs.iru.com/en/compliance/sources/postman-source.md): Connect Postman to Iru Compliance with an API key to collect workspace inventory, collection metadata, team membership, and audit-log evidence. ###### Amazon sources - [AWS CodeCommit](https://docs.iru.com/en/compliance/sources/aws-codecommit-source.md): Connect AWS CodeCommit to Iru Compliance with a cross-account IAM role to collect repository inventory, branch protection, and pull request history. - [Amazon Elastic Kubernetes Service (EKS)](https://docs.iru.com/en/compliance/sources/amazon-elastic-kubernetes-service-eks-source.md): Connect Amazon EKS to Iru Compliance with a cross-account IAM role to collect cluster inventory, node group configuration, and add-on metadata as evidence. - [Amazon Elastic Compute Cloud (EC2)](https://docs.iru.com/en/compliance/sources/amazon-elastic-compute-cloud-ec2-source.md): Connect Amazon EC2 to Iru Compliance with a cross-account IAM role to collect instance inventory, security groups, and VPC network metadata as evidence. - [Amazon Elastic Container Service (ECS)](https://docs.iru.com/en/compliance/sources/amazon-elastic-container-service-ecs-source.md): Connect Amazon ECS to Iru Compliance with a cross-account IAM role to collect cluster inventory, task definitions, and service configuration evidence. - [Elastic Load Balancing (ELB)](https://docs.iru.com/en/compliance/sources/elastic-load-balancing-elb-source.md): Connect Elastic Load Balancing to Iru Compliance with a cross-account IAM role to collect ALB, NLB, and Classic Load Balancer configuration and listeners. - [AWS Lambda](https://docs.iru.com/en/compliance/sources/aws-lambda-source.md): Connect AWS Lambda to Iru Compliance with a cross-account IAM role to collect function inventory, runtime, IAM role binding, and layer configuration metadata. - [AWS Organizations](https://docs.iru.com/en/compliance/sources/aws-organizations-source.md): Connect AWS Organizations to Iru Compliance with a cross-account IAM role in the management account to collect OU structure, account, and SCP metadata. - [AWS Auto Scaling](https://docs.iru.com/en/compliance/sources/aws-auto-scaling-source.md): Connect AWS Auto Scaling to Iru Compliance with a cross-account IAM role to collect EC2 and Application Auto Scaling group configuration and activity. ###### Microsoft Azure - [Microsoft Azure Authorization](https://docs.iru.com/en/compliance/sources/microsoft-azure-authorization-source.md): Connect Microsoft Azure role-based access control and Azure Policy to Iru Compliance using OAuth and the Azure Resource Manager API. - [Microsoft Azure Key Vault](https://docs.iru.com/en/compliance/sources/microsoft-azure-key-vault-source.md): Connect Azure Key Vault to Iru Compliance via OAuth to collect vault, key, secret, and certificate metadata for audits without exposing actual secret values. - [Microsoft Azure Monitor](https://docs.iru.com/en/compliance/sources/microsoft-azure-monitor-source.md): Connect Azure Monitor to Iru Compliance for diagnostic settings, activity logs, alerts, and Log Analytics workspace configuration via OAuth. - [Microsoft Azure Network](https://docs.iru.com/en/compliance/sources/microsoft-azure-network-source.md): Connect Azure Network management APIs to Iru Compliance for VNets, NSGs, firewalls, routes, load balancers, and public IPs via OAuth. - [Microsoft Azure Storage](https://docs.iru.com/en/compliance/sources/microsoft-azure-storage-source.md): Connect Azure Storage management APIs to Iru Compliance via OAuth to collect storage account and container configuration without reading blob or file contents. ##### HRIS - [BambooHR](https://docs.iru.com/en/compliance/sources/bamboohr-source.md): Connect BambooHR to Iru Compliance using HTTP Basic Auth with your API key as the username to collect employee directory, status, and onboarding evidence. - [Checkr](https://docs.iru.com/en/compliance/sources/checkr-source.md): Connect Checkr to Iru Compliance using HTTP Basic Auth with your secret API key to collect background check report status and candidate workflow evidence. - [Deel](https://docs.iru.com/en/compliance/sources/deel-source.md): Connect Deel to Iru Compliance with a scoped organization API token to collect worker roster, organization structure, and time-off records for onboarding and offboarding evidence. - [HiBob](https://docs.iru.com/en/compliance/sources/hibob-source.md): Connect HiBob to Iru Compliance using HTTP Basic Auth with a service user ID and token to collect employee roster, lifecycle events, and organizational structure evidence. - [Lattice](https://docs.iru.com/en/compliance/sources/lattice-source.md): Connect Lattice to Iru Compliance with an Admin API key used as a Bearer token to collect employee directory, review cycles, and feedback workflow evidence. - [Sage HR](https://docs.iru.com/en/compliance/sources/sage-hr-source.md): Connect Sage HR to Iru Compliance with an API key in the X-Auth-Token header and your account subdomain to collect employee, leave, and team directory evidence. - [Workable](https://docs.iru.com/en/compliance/sources/workable-source.md): Connect Workable to Iru Compliance with a scoped Bearer token and your account subdomain to collect job, candidate pipeline, and recruiter access evidence. - [Workday Report](https://docs.iru.com/en/compliance/sources/workday-report-source.md): Connect Workday Reports as a Service to Iru Compliance using an Integration System User and HTTP Basic Auth to collect employee, role, and report evidence. ##### Marketing - [Klaviyo](https://docs.iru.com/en/compliance/sources/klaviyo-source.md): Connect Klaviyo to Iru Compliance with a scoped read-only private API key to collect account user access, API key inventory with scopes, and list and segment metadata. ##### Monitoring - [Datadog](https://docs.iru.com/en/compliance/sources/datadog-source.md): Connect Datadog to Iru Compliance with API and application key credentials to collect monitor configuration, user inventory, and security-posture evidence. - [Sentry](https://docs.iru.com/en/compliance/sources/sentry-source.md): Connect Sentry to Iru Compliance with an auth token and the correct regional API host to collect projects, issues, releases, and organization audit logs. ###### Amazon sources - [Amazon CloudWatch](https://docs.iru.com/en/compliance/sources/amazon-cloudwatch-source.md): Connect Amazon CloudWatch to Iru Compliance with a cross-account IAM role to collect metric, alarm, and Logs metadata as monitoring evidence for audits. ##### Productivity - [Confluence Cloud](https://docs.iru.com/en/compliance/sources/confluence-cloud-source.md): Connect Confluence Cloud to Iru Compliance with your Atlassian subdomain and an API token to collect spaces, page hierarchy, and access-permission evidence. - [Docusign](https://docs.iru.com/en/compliance/sources/docusign-source.md): Connect Docusign to Iru Compliance using OAuth JWT Grant with an integration key, RSA keypair, and consent to collect envelope and account evidence. - [Envoy](https://docs.iru.com/en/compliance/sources/envoy-source.md): Connect Envoy to Iru Compliance through OAuth to collect visitor logs, invites, locations, and employee directory metadata as physical-security evidence. - [Notion](https://docs.iru.com/en/compliance/sources/notion-source.md): Connect Notion to Iru Compliance with an internal integration token to collect workspace, page, database, and member-access evidence for control assessments. - [Reach 360](https://docs.iru.com/en/compliance/sources/reach-360-source.md): Connect Articulate Reach 360 to Iru Compliance with a Manage API key used as a Bearer token to collect course, training, and learner completion evidence. ##### Project management - [Aha! Ideas](https://docs.iru.com/en/compliance/sources/aha-ideas-source.md): Connect Aha! Ideas to Iru Compliance with a Bearer API key and your account subdomain to collect roadmap, release, and idea evidence for audits. - [Asana](https://docs.iru.com/en/compliance/sources/asana-source.md): Connect Asana to Iru Compliance with OAuth so Iru can collect workspace inventory, team and project membership, and access-control evidence for audits. - [ClickUp](https://docs.iru.com/en/compliance/sources/clickup-source.md): Connect ClickUp to Iru Compliance with a personal API token sent in the Authorization header (no Bearer prefix) to collect workspace, team, and task evidence. - [Jira](https://docs.iru.com/en/compliance/sources/jira-source.md): Connect Jira Cloud to Iru Compliance with OAuth to collect projects, issues, workflows, change tickets, and Jira Service Management request evidence for audits. - [Shortcut](https://docs.iru.com/en/compliance/sources/shortcut-source.md): Connect Shortcut to Iru Compliance with a workspace API token in the Shortcut-Token header to collect story, epic, iteration, and workflow membership evidence. - [Smartsheet](https://docs.iru.com/en/compliance/sources/smartsheet-source.md): Connect Smartsheet to Iru Compliance with a read-only API access token to collect user and license inventory, sheet sharing permissions, and workspace membership. - [Trello](https://docs.iru.com/en/compliance/sources/trello-source.md): Connect Trello to Iru Compliance with a Power-Up API key and user token to collect read-only access to boards, lists, cards, and workspace membership evidence. ##### Security - [Iru Endpoint](https://docs.iru.com/en/compliance/sources/iru-endpoint-source.md): Connect Iru Endpoint to Iru Compliance using the Iru Endpoint API. Select your API region, configure your tenant URL, and authenticate with a Bearer token. - [1Password Business](https://docs.iru.com/en/compliance/sources/1password-business-source.md): Connect 1Password Business to Iru Compliance with a JWT bearer token to collect sign-in attempts, item usage, and audit events as evidence. - [Arnica](https://docs.iru.com/en/compliance/sources/arnica-source.md): Connect Arnica to Iru Compliance with a scoped read-only API key to collect secret-detection findings, repository inventory, developer risk, and security policy status. - [Cloudflare](https://docs.iru.com/en/compliance/sources/cloudflare-source.md): Connect Cloudflare to Iru Compliance with a scoped API token to collect zones, DNS records, security settings, WAF rules, and account membership. - [HashiCorp Vault](https://docs.iru.com/en/compliance/sources/hashicorp-vault-source.md): Connect Vault to Iru Compliance with a client token and least-privilege policy for mounts, policies, and audit configuration evidence. - [JumpCloud](https://docs.iru.com/en/compliance/sources/jumpcloud-source.md): Connect JumpCloud to Iru Compliance with an Admin API key in the x-api-key header and the regional API host to collect user, device, and policy evidence. - [KnowBe4](https://docs.iru.com/en/compliance/sources/knowbe4-source.md): Connect KnowBe4 KMSAT to Iru Compliance with a read-only API token sent as a Bearer token to collect security awareness training and phishing test evidence. - [Okta](https://docs.iru.com/en/compliance/sources/okta-source.md): Connect Okta to Iru Compliance with an API token to collect directory users and groups, application assignments, MFA policies, and System Log audit evidence. - [Semgrep](https://docs.iru.com/en/compliance/sources/semgrep-source.md): Connect Semgrep AppSec Platform to Iru Compliance with a Bearer API token that includes the Web API scope to collect findings, deployments, and policy evidence. ###### Amazon sources - [Amazon Inspector](https://docs.iru.com/en/compliance/sources/amazon-inspector-source.md): Connect Amazon Inspector v2 to Iru Compliance with a cross-account IAM role to collect vulnerability findings, scan coverage, and assessment metadata. - [AWS CloudTrail](https://docs.iru.com/en/compliance/sources/aws-cloudtrail-source.md): Connect AWS CloudTrail to Iru Compliance with a cross-account IAM role to collect management event history, trail configuration, and event selectors. - [AWS Config](https://docs.iru.com/en/compliance/sources/aws-config-source.md): Connect AWS Config to Iru Compliance with a cross-account IAM role to collect Config rules, conformance packs, and resource configuration history evidence. - [Amazon GuardDuty](https://docs.iru.com/en/compliance/sources/amazon-guardduty-source.md): Connect Amazon GuardDuty to Iru Compliance with a cross-account IAM role to collect detector configuration, finding metadata, and threat-intel settings. - [AWS Identity and Access Management (IAM)](https://docs.iru.com/en/compliance/sources/aws-identity-and-access-management-iam-source.md): Connect AWS IAM to Iru Compliance with a cross-account IAM role to collect users, roles, policies, MFA status, and credential-report evidence for audits. - [AWS IAM Identity Center (Identity Store)](https://docs.iru.com/en/compliance/sources/aws-iam-identity-center-identity-store-source.md): Use a cross-account IAM role so Iru Compliance can read IAM Identity Center directory users and groups via the Identity Store API. - [AWS IAM Identity Center (SSO)](https://docs.iru.com/en/compliance/sources/aws-iam-identity-center-sso-source.md): Use a cross-account IAM role so Iru Compliance can read IAM Identity Center permission sets, assignments, and SSO application metadata. - [AWS Key Management Service (KMS)](https://docs.iru.com/en/compliance/sources/aws-key-management-service-kms-source.md): Connect AWS KMS to Iru Compliance with a cross-account IAM role to collect key inventory, rotation status, and grant metadata without decrypt privileges. - [AWS Secrets Manager](https://docs.iru.com/en/compliance/sources/aws-secrets-manager-source.md): Connect AWS Secrets Manager to Iru Compliance with a cross-account IAM role to inventory secrets, rotation schedules, and tags without reading secret values. - [AWS Security Hub](https://docs.iru.com/en/compliance/sources/aws-security-hub-source.md): Connect AWS Security Hub to Iru Compliance with a cross-account IAM role to collect findings, control status, and standard subscriptions as posture evidence. ##### Storage - [Box](https://docs.iru.com/en/compliance/sources/box-source.md): Connect Box to Iru Compliance through OAuth to collect enterprise file and folder inventory, user and group access, and sharing-policy configuration. ###### Amazon sources - [Amazon Elastic File System (EFS)](https://docs.iru.com/en/compliance/sources/amazon-elastic-file-system-efs-source.md): Connect Amazon EFS to Iru Compliance with a cross-account IAM role to collect file system inventory, encryption status, and mount target metadata. - [Amazon Simple Storage Service (S3)](https://docs.iru.com/en/compliance/sources/amazon-simple-storage-service-s3-source.md): Connect Amazon S3 to Iru Compliance with a cross-account IAM role to collect bucket inventory, encryption, public-access blocks, and policy metadata. ##### Support - [Freshservice](https://docs.iru.com/en/compliance/sources/freshservice-source.md): Connect Freshservice to Iru Compliance using HTTP Basic Auth with your API key as the username to collect change approvals, incident resolution times, ticket records, and CMDB asset inventory. - [Intercom](https://docs.iru.com/en/compliance/sources/intercom-source.md): Connect Intercom to Iru Compliance with an access token and the regional API host that matches your workspace to collect admin, team, and conversation evidence. ### Policies - [Policies Management](https://docs.iru.com/en/compliance/policies-management.md): Create, publish, and track security and compliance policies in Iru with the policy library, template generation, drafts, and workforce acknowledgements. ### Trust Center - [Trust Center Management](https://docs.iru.com/en/compliance/trust-center/trust-center-management.md): Manage the Iru Trust Center for sharing your security posture. Publish compliance documents, answer questionnaires, and manage viewer access. - [Trust Center Setup](https://docs.iru.com/en/compliance/trust-center/trust-center-setup.md): Set up and customize your Iru Trust Center. Configure branding, add compliance documents, enable the public portal, and invite viewers. - [Trust Center Accounts](https://docs.iru.com/en/compliance/trust-center/trust-center-accounts.md): Create and manage Trust Center user accounts and viewer access. Control who can view your compliance posture and security documentation. - [Trust Center Answers Questionnaires](https://docs.iru.com/en/compliance/trust-center/trust-center-answers-questionnaires.md): Complete security questionnaires in Trust Center for auditors and customers. Use saved answers, collaborate with team members, and track progress. - [Trust Center Public Portal](https://docs.iru.com/en/compliance/trust-center/trust-center-public-portal.md): Share compliance documentation through the Trust Center public portal. Customize branding, publish certifications, and control public visibility. ### Workflows - [Platform Workflows](https://docs.iru.com/en/compliance/platform-workflows.md): How frameworks, controls, actions, and evidence fit together in Iru Compliance: setup, assignments, sources, readiness, and audit-ready reporting.