Support Case #8811 - Blackridge Investments Custom Compliance Template

Absolutely, no that's — unusual is fine, we love those. So I've got the case here, case number 8811, and it looks like you're coming in with a feature request around custom compliance templates in Aegis Comply. Is that the right starting point?

That's exactly it. So, you know, we upgraded to Comply v2 — gosh, what was it, like mid-April? — and honestly the on-demand reporting has been phenomenal. The SOC 2 and the PCI DSS reports especially, our audit team is basically over the moon.

+2Praises on-demand reporting as 'phenomenal' and audit team as 'over the moon'. · compliance reporting

Oh that's great to hear, we launched v2 on April 7th so yeah you're right around that mark. And yeah the on-demand piece was a big lift for our engineering team so I'm glad it's landing well.

Yeah it really has. But here's the thing — we're a financial services firm, right, so on top of the standard frameworks we've got some internal control requirements. Blackridge-specific stuff that our board and our regulators kind of expect us to track. And I'm wondering if there's any way to build a custom template inside Comply that maps to those internal controls.

Right, so like a bespoke framework essentially — where you define the control categories, the evidence requirements, all of that, rather than using one of the out-of-the-box frameworks we ship with.

Exactly, yeah. We're not trying to replace SOC 2 or anything like that, we still need those. But we want something that can sit alongside them. Like maybe a Blackridge Internal Controls Report — something I can hand to our board quarterly.

So I want to be transparent with you — it's not in the current GA release of v2, what you have today is the four supported frameworks. But it is something that our product team has been actively scoping. I don't want to give you a hard date because I genuinely don't have one, but it is on the near-term roadmap.

Ha, well I'll take that! And look, what I can do — and this is something I'd really encourage — is I can formally log this as a feature request with the product team and tag it with your account specifically. That kind of direct customer attribution actually does carry weight internally when they're prioritizing.

A hundred percent, and that's actually something I can set up. We have a customer advisory track where we bring in, um, customers who are willing to provide detailed requirements and potentially participate in early access. You'd be a perfect fit for that honestly.

That's the idea, yeah. Obviously it depends on how the scoping shakes out and your environment, but typically the way our early access program works is we identify a handful of design partners, you get preview builds, you provide feedback, and in exchange you get the feature earlier and you get to shape it. So it's kind of a win-win.

I mean that sounds — yeah, that sounds excellent. What do I need to do to opt into that?

+1Warren calls the early access offer 'excellent'. · product capability

So I'll send you a follow-up email after this call with a short intake form — it's not long, maybe ten minutes to fill out. It covers your use case, the types of controls you'd want to define, your reporting cadence, stuff like that. And then I'll flag your account to our product liaison and they'll reach out to schedule that conversation.

Yeah, actually — so this isn't perfect but there are a couple of things. One is that within the existing framework reports, you can add custom control annotations and notes to individual line items. So if some of your internal controls map partially to SOC 2 criteria you could tag those. It's not a standalone report but it does let you document against those controls.

Huh. Okay that's — yeah I'm going to look at that this afternoon actually. That might buy us some time until the custom template feature is available.

Yeah exactly, and the other thing — if you want to get really creative — you could export the report data via our API and pipe it into whatever internal reporting tool your board uses. Our Comply v2 API docs have the endpoint for pulling structured control data. Might be worth a look if your team has some dev bandwidth.

We do have an internal data team, yeah. I'll rope them in on that. That could actually be really useful even beyond the compliance reporting — we pull a lot of our security data into our internal dashboards.

+1Warren finds the API possibility 'really useful' beyond compliance. · product capability

Right, right. That's a good point. Okay so — to summarize where we landed: you're going to log the feature request, send me the intake form for the early access program, and I should look at the annotation feature and potentially the API. Is that right?

That's exactly right, yeah. And I'll also include links to the API docs in that follow-up email so you don't have to go hunting for them.

Awesome. Priya this has been genuinely one of the more productive support calls I've had in a while — usually I call support expecting to be told no, so, you know, this is a nice change.

+2Warren says it was 'genuinely one of the more productive support calls' and a nice change from being told no. · support experience

Will do, I'll pass that along. Alright Warren, I think we've covered everything on case 8811. I'll get that email out to you within the hour. Is there anything else before I let you go?