Audit season, reduced to a download.

Oditr maps frameworks to live platform controls, checks them continuously and exports auditor-ready evidence packs on demand.

ISO · PDPL · PCIContinuous checksEvidence exports

Talk to us All Compliance

Capabilities

Compliance as a running system

Framework mapping

ISO, PDPL and PCI mapped to concrete controls out of the box.

PDPL, ISO, SOC 2, PCI

Continuous verification

Controls checked on schedule; drift flagged the day it happens.

Checked daily, not annually

Risk-ranked findingsFailures ranked by exposure and routed to the operating team.Worst first

Evidence packsPoint-in-time exports with history — scoped views for auditors.Auditor-ready exports

Live control statusDashboards show control health now, not at the last review.Drift seen same-day

Evidence from sourceConfiguration, logs and access records collected automatically.No screenshot hunts

Multi-entity scopingSubsidiaries and environments assessed separately, reported together.Group view, entity detail

Remediation trackingFindings carry owners and due dates with progress visible.Closure, not lists

Regulator circularsRegional circulars mapped alongside global frameworks.Local rules covered

Read-only assuranceCollectors are read-only with scoped access — themselves evidenced.The auditor’s auditor

Compare the coverage

One framework, many, or continuous

Controls are mapped to live platform evidence in every tier — the difference is breadth and how often it is checked.

ProductionEdgeComing soon

SCOPE 01Start here

Single Framework

Start with the one that matters

Your primary obligation — PDPL, ISO 27001 or a regulator's circular — mapped to platform controls with evidence collected automatically.

Best for

First certificationPDPL programmesRegulator requests

Where it runs

Dubai AZ1Dubai AZ2RiyadhBahrainMumbaiAbu DhabiFrankfurtNairobi

Plans

Framework1 framework mapped · quarterly evidenceSign in →Framework Plus1 framework · monthly evidence · gap trackingSign in →CustomAny framework and evidence cadenceSign in →

SCOPE 02

Multi-Framework

Map once, satisfy many

Several frameworks mapped onto the same control set, so one piece of evidence answers three auditors instead of one.

Best for

Multi-regulated groupsISO plus sector rulesCustomer due diligence

Where it runs

Dubai AZ1Dubai AZ2RiyadhBahrainMumbaiAbu DhabiFrankfurtNairobi

Plans

Multi3 frameworks · shared control mappingSign in →Multi Plus5 frameworks · overlap analysis · gap trackingSign in →CustomAny framework set and mapping depthSign in →

SCOPE 03

Continuous Assurance

Always audit-ready

Controls checked continuously with drift alerting, so a failed control is a ticket this week rather than a finding next year.

Best for

Regulated financial servicesGovernment programmesFrequent audit cycles

Where it runs

Dubai AZ1RiyadhBahrainMumbaiDubai AZ2Nairobi

Plans

ContinuousDaily checks · drift alertingSign in →Continuous PlusDaily checks · board reporting · auditor portalSign in →CustomAny check frequency and reporting modelSign in →

Two ways to run it

Per estate, or per pool

Both produce auditor-ready packs. The difference is whether evidence spans the whole estate or is scoped to each pool.

Per EstateOne programmeControls and evidence mapped across the entire estate, so one compliance programme covers every workload and pool.

Estate-wide control mapping

One evidence pack for all workloads

Single audit programme

Best for:A single regulated organisation

Explore Per Estate plans

Per PoolScoped per poolEvidence and frameworks scoped to each capacity pool, subsidiary or regulated entity — isolated packs, isolated reporting.

Frameworks mapped per pool

Separate evidence pack each

Independent audit trails

Best for:Multi-entity or reseller estates

Explore Per Pool plans

Who decides, who runs it

What each group gets from Oditr

Four groups shape a cloud decision. Pick the one you belong to — the platform reads differently from each seat.

“Audit season stopped consuming the quarter”

The pack is generated rather than assembled, so certification stops pulling engineers off delivery for weeks.

GovernedSovereignPredictable

FAQs

Which frameworks are supported?

PDPL, ISO 27001, SOC 2, PCI DSS and regional regulator circulars, with others mapped on request.

Where does the evidence come from?

Live platform state — configuration, logs, access records and backup results — rather than manual attestations.

Can auditors access it directly?

Yes, through a scoped auditor view on Continuous Plus, or as exported packs.

Does it cover things outside YallaCloud?

Platform controls are automatic; external systems can be tracked as manual controls with owners and due dates.

What happens when a control fails?

It raises a finding with an owner and a due date, and under Compliance Operations we track it to closure.

How is the flat fee different from public cloud pricing?

Everything inside the plan you opt for is included — no additional charge for the components that make it up. Public clouds meter each component on consumption, so the bill moves with usage. Here the plan is reserved for you and the figure you agreed is the figure you pay.

Can we drive it from Terraform and CI?

Yes. Every operation is exposed through the REST API, CLI and a maintained Terraform provider, with scoped API keys per team. If the console can do it, your pipeline can do it.

How do limits and quotas work?

Quotas are yours to shape — carve capacity per team or project and delegate inside it. Hard ceilings are a conversation, not a wall; the estate re-baselines at thresholds you approve.

Can security services be included in my plan?

Yes. Endpoint security, firewalls and WAF are scoped into the same flat fee when you add them — one figure, no separate security invoice.

Better together