Jede Änderung an devguard, datiert und in klarer Sprache. Wir migrieren Ihr zertifiziertes ISMS, ohne Ihre Nachweise zu zerstören – und halten die Plattform darunter stabil, sicher und stetig besser. Hier ist der Nachweis.
Starten Sie kostenlos – jede Verbesserung landet automatisch in Ihrem Arbeitsbereich, ohne Upgrades, ohne Migrationen.
ISO 9001 joins the framework catalog.
Most evidence is a file someone exported once and uploaded. A year later, it still says what it said the day it was made, and nobody notices until an auditor asks. The new devguard CLI changes that: it runs the checks you already have (npm audit, Trivy, Terraform plans, any command) on a schedule and pushes their output straight into an Evidence record, so what an auditor opens is days old, not a year.
Run devguard init, and a wizard writes a devguard.yml describing your collectors. From then on, devguard evidence push runs them, scans every artefact for secrets before anything leaves your environment, and uploads the results. Each collector replaces its previous file, so an Evidence record always holds exactly one current artefact, badged as automated in the app. Every file carries a freshness window, and if it lapses without a refresh, the file is flagged on the deadlines view. There is also a devguard scan, which detects an installed vulnerability scanner such as Trivy or osv-scanner and pushes its report in one step.
The CLI is available today: run npx @devguardch/cli, install it globally with npm install -g @devguardch/cli, or grab a standalone Linux binary from the GitHub releases. Create an API key under Settings → Tokens, and the new guide in the Evidence section walks you through setup with a live connection test.
This release connects the app to the new devguard CLI, reworks the evidence workspace, brings tasks to more record types and puts our own Trust Center on the website.
Compliance is a long list of small jobs, and until now devguard told you what was missing without telling you what to do about it. Tasks and Roadmap change that. Every framework you adopt now seeds a guided journey of tasks, each with its own instructions, owner, deadline and history, so the work is laid out before you have to invent it.
Tasks live in a personal worklist you can switch between "assigned to me" and everything in the organization, and they attach to the record they belong to, whether that is a control, a policy, a risk, an asset, a vendor or a person. The Roadmap draws the same tasks as a timeline with a swimlane per framework, so you can see the sequence at a glance. Pick a target certification date and devguard plans the deadlines backwards to meet it.
Because tasks now carry the work, coverage is calculated from them rather than set by hand. A control counts as covered when the evidence behind it actually exists, and controls that do not apply to you can be marked as not relevant. Tasks and Roadmap replace the previous Onboarding section, and everything you had there has been carried over.
Customer security questionnaires arrive as spreadsheets and PDFs, and answering them by hand is one of the least rewarding jobs in compliance. Upload the file to devguard, confirm which columns hold the questions and the answer fields, and the questions are imported as a working list.
From there devguard drafts the answers for you. It searches your policies, controls and evidence, writes a response per question and streams them in as they are ready, with the sources it used. You review them side by side in a split view, edit anything that needs your judgement, approve the rest and export the questionnaire back in its original structure.
Answers you approve feed an answer library, so the next questionnaire starts from what you already said rather than from a blank sheet. You can curate, reuse and archive those entries as your positions change. Available on the Business plan, with per-plan limits shown on the pricing page.
Our largest release so far: five new modules, a notifications center, custom branding and a completely reworked way of tracking coverage.
Every security review starts with the same questions about which certifications you hold, who your subprocessors are and where your policies live. The Trust Center lets you answer them once, publicly, instead of once per prospect. You choose what to show, in what order, and devguard publishes it as a hosted page.
Certifications come straight from the frameworks you have adopted, with their own colour and validity dates, and certificates can be attached from your evidence library in one click. Subprocessors, documents and contact details sit alongside them. A live preview shows exactly what visitors will see before you flip the publish switch, and drag and drop reordering means you control the emphasis.
The same content is available as a public JSON API, so you can render the trust page inside your own website with your own design instead of linking away to ours. The in-app guide includes a working reference implementation you can copy.
Organizations can now carry their own visual identity.
Every framework now ships a guided roadmap, so adopting one gives you a sequence of tasks with instructions rather than a bare list of controls.
A small polish release across the dashboard, evidence library, search, and organization tools, plus a handful of fixes.