Read the docs

Compliance

Audit-ready diagrams, every day of the year.

Network and data-flow diagrams drawn from your infrastructure code, kept current by a check in CI.

Contact usRead the evidence guide (opens in a new tab)

Evidence for

  • SOC 2Type II
  • ISO270012022
  • PCIDSSv4.0
  • HIPAASecurity
  • NISTCSF2.0
  • GDPREU
plotwork / drift checkChecked on every merge

Passed17 Oct 2026, 06:43 UTC

ok: 1 diagram(s) checked, 0 drifted, 0 error(s)
  • 586fef3docs: regenerate diagrams from their sources
  • docs/infra.diagram
AWS infrastructure: 3 nodes, 2 connections. 5 resources on AWS, nested in the groups, networks, and subnets that hold them, imported from Terraform. An arrow means one resource refers to another, and its label says how: a role, a private link, logs, or a secret.

Diagrams go stale between audits

A drawing made for audit week is wrong by the next merge. A check on every merge keeps it right.

Redrawn by hand

  1. Audit weekRedrawn
  2. A new subnetOut of date
  3. A new queueOut of date
  4. Next auditRedrawn again

With Plotwork

  1. Audit weekChecked
  2. A new subnetRedrawn in the pull request
  3. A new queueRedrawn in the pull request
  4. Next auditAlready current

What auditors ask for

The diagrams these frameworks commonly request, and how Plotwork keeps each current.

  • SOC 2Type II

    SOC 2

    • DC 200
    • CC8.1

    Auditors ask forSystem and data-flow diagrams, and proof changes are reviewed.

    Plotwork keeps it currentRedrawn on every change, merged through review.

  • ISO270012022

    ISO/IEC 27001:2022

    • A 5.9
    • A 8.20

    Auditors ask forThe assets in scope and how their networks are separated.

    Plotwork keeps it currentEvery declared resource, nested in its network.

  • PCIDSSv4.0

    PCI DSS v4.0

    • 1.2.3
    • 1.2.4

    Auditors ask forAn accurate network diagram and data-flow diagram.

    Plotwork keeps it currentCI fails the change that leaves them behind.

  • HIPAASecurity

    HIPAA Security Rule

    • 164.308(a)(1)(ii)(A)

    Auditors ask forWhere electronic health information is stored and moves.

    Plotwork keeps it currentData flows drawn from services and schemas.

  • NISTCSF2.0

    NIST CSF 2.0

    • ID.AM-03

    Auditors ask forMaintained maps of network communication and data flows.

    Plotwork keeps it currentDrawn from the code that defines them.

  • GDPREU

    GDPR

    • Art. 30
    • Art. 35

    Auditors ask forData-flow maps for the processing record and impact assessments.

    Plotwork keeps it currentFlows drawn from your services and schemas.

Plotwork is a tool for producing diagram evidence; your auditor decides what satisfies a control. Plotwork itself is not certified against these frameworks.

Evidence you can hand over

One merge leaves all of this behind, from a real run.

evidence / docs/infra.diagram
  1. Failedinfra: add the session cachefailed: 1 diagram(s) checked, 1 drifted, 0 error(s)a1668bd17 Oct 2026, 06:43 UTC
  2. Passeddocs: regenerate diagrams from their sourcesok: 1 diagram(s) checked, 0 drifted, 0 error(s)586fef317 Oct 2026, 06:43 UTC
drift: docs/infra.diagram (infra, terraform from infra/**/*.tf)  Added 1 node (sessions) and 1 edge (web -> sessions).  ~ header: desc changed: "4" became "5"  + node sessions  + edge web -> sessionsfailed: 1 diagram(s) checked, 1 drifted, 0 error(s)

From a real run of plotwork generate in a test repository.

How it works in CI

Make the check required, and the pull request that leaves a diagram behind cannot merge.

  1. 1Name the sources

    The files each diagram is made from.

    plotwork.config.json

    {  "sources": [    {      "name": "infra",      "from": "infra/**/*.tf",      "format": "terraform",      "out": "docs/infra.diagram"    }  ]}

  2. 2Fail on drift

    The check says which diagram drifted and how.

    plotwork generate --check

    drift: docs/infra.diagram (infra, terraform from infra/**/*.tf)  Added 1 node (sessions) and 1 edge (web -> sessions).  ~ header: desc changed: "4" became "5"  + node sessions  + edge web -> sessionsfailed: 1 diagram(s) checked, 1 drifted, 0 error(s)

  3. 3Merge the redraw

    The Action opens a pull request with the new diagram.

    docs: regenerate diagrams from their sourcesOpen

    plotwork/diagrams

    • docs/infra.diagram
    • docs/infra.svg
    • docs/infra.dark.svg

Diagrams as code (opens in a new tab)

Built for the security review

What a reviewer asks about a tool that reads your infrastructure code.

  • No diagram source stored

    Source is drawn in memory and never stored or logged.

    On every plan

    • Diagram source storedNo
    • Diagram source loggedNo
    • A picture you publish keptYes
    Privacy policy (opens in a new tab)

  • Check mode makes no network request

    The check runs in your CI runner and reads no secret.

    On every plan

    • Runs in your CI runnerYes
    • Reads a secretNo
    • Makes a network requestNo
    Enterprise rollout (opens in a new tab)

  • Releases you can verify and pin

    Signed build provenance for the Action, npm provenance, SHA-256 checksums, and the Action pinned to a commit.

    On every plan

    uses: plotwork-official/plotwork-action@78d7acaf4b673e10187eb9174a60a3da6949ee8a # v1.0.0
    • npm provenance
    • dist/checksums.txt
    • Dependabot
    Pinning and updates (opens in a new tab)

  • Audit log

    Organisation audit log, events kept 30 days. Enterprise: audit log export as CSV or JSON Lines, and audit events and drift sent to Datadog, Dynatrace, Splunk, Microsoft Sentinel or a webhook as they happen.

    Pro and Enterprise

    Audit log (opens in a new tab)

  • Drift dashboard

    Drift dashboard across repositories, runs kept 90 days.

    Pro and Enterprise

    The drift dashboard (opens in a new tab)

  • Reports your tools read

    JSON, SARIF and JUnit from the same run.

    On every plan

    Outputs (opens in a new tab)

  • Roles and locks

    Owner, admin, member and reader, and diagrams nobody can move.

    On every plan

    Organisations (opens in a new tab)

  • Self-hosting

    One container, no outbound request. A self-hosting licence, as an add-on.

    Enterprise

    Self-hosting (opens in a new tab)

  • Single sign-on

    Single sign-on with OpenID Connect, with domains proved by DNS and every sign-in in the audit log. Single sign-on with SAML.

    Enterprise

Keep diagrams current between audits

Roll the drift check out across your repositories.

Contact usRead the rollout guide (opens in a new tab)