Compliance evidence, for MSPs
The evidence your clients' auditors and insurers ask for.
SeatReaper already reads Microsoft 365, your RMM, EDR, backup and training tools. Now it turns that into reports you can hand over: who has access, how leavers were offboarded, which devices lack EDR or backup, who has MFA, and what changed.
Included on Growth and Pro. Connections stay read-only.
| Client | MFA registered | Accounts to review | Active devices without EDR | Stale backups | Staff not in training |
|---|---|---|---|---|---|
| Alder Dental | 16 / 181 admin without MFA | 3 | 2 | 0 | 3 |
| Birch Law | 9 / 9 | 0 | 0 | — | — |
| Cedar Clinic | 22 / 24 | 1 | 0 | 1 | 0 |
Illustration with fictional clients. A dash means that tool is not connected for the client; 0 means checked and none found.
01
Connect what you already run
Read-only connections to Microsoft 365 and the RMM, EDR, backup and training tools you use. Nothing is installed on client machines.
02
See every client's gaps
One overview shows, per client, MFA registration, accounts to review, devices without EDR or backup, stale backups and staff not in training. Each number opens the report behind it.
03
Hand over the evidence
Print or save a report as a PDF with your branding, download it as CSV, share a read-only link, or email it every month or quarter.
Seven reports
Each report lists the safeguards it is usually asked for under each framework, so the person reading it knows why it is in front of them.
Access review
Every Microsoft 365 account, with the ones to review listed: enabled accounts with no recent sign-in, and blocked accounts that still have licenses or seats in other tools. Google Workspace and tool seats with no Microsoft 365 account are listed too.
Evidence for: HIPAA, CIS v8, NIST 800-171, Cyber insurance
Offboarding evidence
Each person offboarded in the period: when it started and closed, each account, license, device and seat on the checklist, and who confirmed each one or whether a sync confirmed it.
Evidence for: HIPAA, CIS v8, NIST 800-171, Cyber insurance
Device inventory and gaps
Every device seen by an RMM, EDR or backup tool, matched by name across tools, with active devices that are missing EDR or backup listed first.
Evidence for: HIPAA, CIS v8, NIST 800-171, Cyber insurance
Backup status
The last successful backup of each device in Cove and Acronis, and which licensed Microsoft 365 users are covered by Datto SaaS Protection.
Evidence for: HIPAA, CIS v8, Cyber insurance
Security training status
Each licensed Microsoft 365 user and whether they have a KnowBe4 account, with their last KnowBe4 sign-in.
Evidence for: HIPAA, CIS v8, NIST 800-171, Cyber insurance
MFA coverage
Each enabled Microsoft 365 account, whether it has registered a method for multifactor authentication and which methods, with accounts that hold an admin role and have no MFA listed first.
Evidence for: HIPAA, CIS v8, NIST 800-171, Cyber insurance
Change log
What changed for this client in SeatReaper during the period, who changed it and when: flags, offboardings, removals and client settings, from the append-only audit log.
Evidence for: HIPAA, CIS v8, NIST 800-171, Cyber insurance
Mapped to the frameworks your clients face
Control names are the frameworks' own, so they match what an auditor or insurer reads.
HIPAA Security Rule (45 CFR Part 164, Subpart C)
For practices and businesses that handle health information: access control, termination procedures, device controls, backups, training and authentication.
CIS Critical Security Controls v8
The 18 control groups many MSPs and insurers use as a baseline, including account inventory, revoking access, MFA, backups and security awareness training.
NIST SP 800-171 Rev. 2 (CMMC Level 2)
The 110 requirements behind CMMC Level 2 for defense contractors, including access control, identification and authentication, and personnel security.
Cyber insurance questionnaires
The questions cyber insurers ask at application and renewal: MFA, EDR on every endpoint, current backups, security training and offboarding.
Evidence, not a certificate
- The reports are evidence from the tools you connect. They are not an audit, legal advice, or a statement that you or your client meet any framework.
- SeatReaper does not sign Business Associate Agreements and is not designed to receive protected health information. It reads accounts, licenses, devices, backups and training sign-ins, not email, files or patient records.
- SeatReaper itself has not been audited or certified against any framework.
- MFA coverage shows who has registered for MFA, not whether MFA is enforced at sign-in.
Built from the tools you already run
Reports use what is connected for each client: Microsoft 365, Google Workspace, N-central, Datto RMM, NinjaOne, CrowdStrike, SentinelOne, Webroot, Huntress, Sophos Central, Cove, Acronis, Datto SaaS Protection, KnowBe4, Duo. A client with fewer tools connected gets a less complete report, and the report says which tools are missing.
Create your account for free. Compliance reports are on Growth and Pro.
Create your account