Hey everyone! 👋 I've been using Hyperproof for about six months now to manage our SOC 2 and ISO 27001 compliance workloads, and it's been a solid tool for that. The way it maps controls to evidence and handles task assignments is great.
But I'm curious if anyone has pushed it beyond its typical security/compliance domain. Our dev teams are looking to formalize some internal quality and operational excellence frameworks (think along the lines of standardized deployment checklists, internal SLAs, or even a lightweight ITIL process). Hyperproof's structure *seems* like it could be adapted.
Has anyone tried using Hyperproof for non-security frameworks like:
* **Quality Management Systems (QMS)** or ISO 9001?
* **Internal operational playbooks** (e.g., pre-production deployment gates)?
* **Vendor management workflows** that aren't purely security-focused?
I'm wondering about the flexibility of the control library and proof types. Can you easily define custom "controls" for something like "Post-Deployment Smoke Test Passed" and link it to a CI/CD run log? Or is it too rigid and security-opinionated?
If you've tried, what was your experience? Any major pitfalls or pleasant surprises? I'd love to hear if it's a square-peg-round-hole situation or a hidden gem.
~CloudOps
Infrastructure as code is the only way
Yep, we've done exactly that for ISO 9001! The control library is pretty flexible, so you can definitely create custom controls for things like "Deployment Checklist Verified" or "Customer Feedback Review Cycle Completed."
The main hurdle we hit was the terminology. Everything is framed as "controls," "evidence," and "tests," which feels natural for security but can be a slight mental shift for a quality team tracking, say, calibration records for lab equipment. It works, you just have to translate the framework's requirements into that language.
One pleasant surprise was how well the task assignments and due dates worked for our internal SLA tracking. Setting a "control" for "Initial Support Ticket Response" with proof linking to a ticket screenshot gave us great visibility. The rigidity is in the *categories* sometimes, not the core linking mechanic. Can your CI/CD system spit out a report or log URL? That should work as proof just fine.
Your point about the CI/CD report as proof is exactly where we've seen the biggest operational payoff. We mapped a series of deployment quality gates - think integration test pass rates, performance budget checks, and security scan results - to "controls" with automated evidence collection. The proof links were just permanent URLs to our pipeline run summaries or artifact repository metadata.
The real friction came when we tried to model less binary, more subjective quality criteria. For example, a "code review depth" metric or a "post-mortem action item completion rate" doesn't yield a simple pass/fail artifact. We ended up creating manual "test" steps with attached narrative summaries, which felt clunky and drifted from the tool's apparent strengths in objective evidence.
Did your team establish any pattern for handling those qualitative or process maturity assessments within the controls/evidence model, or did you keep that tracking entirely separate?