Your AI agent writes your code.
Now make it write your compliance evidence.

Throughproof is a free, portable skill for Claude Code, Cursor, Copilot & Gemini that writes your audit logging, access control & encryption the right way — as you code. Write the control once; it counts toward SOC 2, ISO 27001, PCI-DSS & HIPAA at the same time. The Pro verifier then proves it to your auditor.

Get the free skill See it work

The problem

Vanta and Drata tell you what's failing and collect evidence from systems you already built. None sit in your editor and help you write the compliant code in the first place — which actions need an audit trail, how to log failures (not just successes), and how to keep secrets and PII out of your logs.

One line of code. Every framework's control.

Guided

The skill guides your agent to write the audit trail correctly, as you type — for sensitive actions only.

Secured

No secrets, tokens, or PII ever land in your logs. Hygiene enforced at authoring time.

Approved

The verifier emits control-to-code evidence — log.audit ↔ SOC 2 CC7.2 + ISO 27001 A.8.15 + PCI-DSS Req 10.2 + HIPAA §164.312(b) — your auditor can accept. Deterministic, no LLM.

See it work

Without the skill, code like this ships every day — no audit trail, PII + token in logs:

@router.post("/users/{user_id}/delete")
def delete_user(user_id, request):
    db.delete_user(user_id)
    logger.info(f"Deleted user {user.email}")   # PII in log, no audit trail

The Pro verifier catches exactly that — deterministically, mapped to every framework at once:

$ throughproof-verify user_service.py

✗ findings:
  [HIGH] user_service.py:8   log.audit  missing-audit-event
         sensitive action 'delete_user' (data.delete) emits no audit event
         ↳ gap affects: SOC 2 CC7.2 · ISO 27001 A.8.15 · PCI-DSS Req 10.2 · HIPAA 164.312(b)
  [med ] user_service.py:11  hygiene.no-secrets  pii-in-log
         possible PII in log (identifier 'email') — log an id reference instead

Once it's fixed, one satisfied path proves all four frameworks at once:

$ throughproof-verify user_service.py

✓ no findings

✓ control-to-code evidence (each path proves multiple frameworks):
  user_service.py:17  delete_user()  ↔  log.audit (data.delete)  [failure, success]
         ✓ soc2        CC7.2        System monitoring
         ✓ iso27001    A.8.15       Logging
         ✓ pci-dss-v4  Req 10.2     Audit logs of all access
         ✓ hipaa       164.312(b)   Audit controls

No dashboards to reverse-engineer, no LLM guesswork — just the line from each framework's control to the code that satisfies it. --json for your evidence pipeline.

Throughproof Pro — be first to the verifier

The free skills write the controls. Pro proves it: continuous, multi-repo, with exportable control-to-code evidence — across SOC 2, ISO 27001, PCI-DSS & HIPAA at once. Drop your email for early access.

Coming soon — agent-native: run the Pro verifier straight from your AI coding agent (Claude Code, Cursor, Antigravity & Gemini) via MCP — find and fix compliance gaps without leaving your editor.

No spam. Just early access and a hand in shaping it.

Your AI agent writes your code.Now make it write your compliance evidence.