Auditor
Plan, run and close audits.
Plan and run audits, track findings and evidence requests to close — the tool auditors use for ISO 27001, NIS2 and DORA engagements, with the evidence trail the certification body expects.
Free while in beta
In beta: open to invited organisations and not billed yet. Write to us and we add yours.
What it does
- Audit plan and scope per framework
- Findings with severity, evidence and owner
- Evidence requests with deadlines and reminders
- Report export for the certification body
How this tool bills
Today's list prices in EUR, read from the qzila price list when this page was built. You are billed monthly for what you used.
In beta: open to invited organisations and not billed yet. Write to us and we add yours.
The API
Every qzila tool is a GraphQL API first; the web UI is one client of it. Anything you can do in the browser you can do from a script, a CI job or the Asign platform.
https://auditor.qzila.com/graphqlPOST · application/json · { "query": "…" }
Requests are authenticated with your qzila session (the same sign-in as the browser). For automation, sign in once at identity.qzila.com and reuse the session cookie; API keys for service accounts are on the roadmap.
Whatever this tool detects — a verdict flip, a regression, a change, an incident — is emitted as a signal to the qzila alert hub, which forwards it to email, Slack, a webhook, SMS or Jira, and to ServiceWatch. Each signal carries the asset it belongs to, so you can correlate it back to your own inventory (or to an Asign asset).
Main operations
createAuditmutationOpen an audit for a framework and scope.
mutation { createAudit(input: { framework: ISO27001, name: "2026 internal audit" }) { id } }findingsqueryFindings with severity, evidence and owner.
query { findings(auditId: "a_1") { control severity status } }requestEvidencemutationAsk an owner for evidence with a deadline.
mutation { requestEvidence(input: { auditId: "a_1", control: "A.5.1", owner: "ciso@example.com", due: "2026-10-15" }) { id } }
Send requests to https://auditor.qzila.com/graphql
Questions about Auditor
Which frameworks are supported?
ISO 27001, NIS2, GDPR, SOC 2 and custom checklists. Controls, evidence requests and findings follow the framework structure so the report reads the way an auditor expects.
How is evidence collected?
You request it from an owner with a deadline; they upload or link it, and the audit trail records who supplied what and when. Signals from the other tools attach as evidence automatically.
How does it relate to Asign?
Auditor runs the audit; Asign manages the risks and controls between audits. Findings flow into Asign as risks with owners and deadlines.
Where do alerts go?
Every tool reports through one alert hub. You choose per destination: email, Slack, a webhook, SMS or a Jira ticket — and ServiceWatch shows the same signals on one board.
Where is my data kept?
The tools run on AWS in the EU (Frankfurt), operated by adcore s.r.o., a Slovak company. A few services they rely on sit outside the EU — Stripe for card payments, Google for analytics after your consent, the threat-intelligence lookups behind SafeCheck — and the privacy policy lists each one.
Start with one tool. Add the rest when you need them.
In beta: open to invited organisations and not billed yet. Write to us and we add yours.