Book a walkthrough
New A copilot that cites its sources, or doesn't draft at all A copilot that cites its sources

Let the record stand.

Stetfolio is the internal audit platform where every change is chained, every sign-off is sealed, and every conclusion leads back to its evidence — from the audit universe to the board pack.

Book a walkthrough Try to tamper with it

stet /stɛt/ verb — the proofreader's mark for let the original stand.

  • SHA-256 sealed sign-offs
  • Hash-chained activity log
  • Void, never delete
  • Row-level tenant isolation
  • Malware-scanned evidence
  • OIDC · SAML 2.0 · SCIM 2.0
  • 362 API operations
  • Self-hostable
  • AI off until you turn it on

§ 02 Why it exists

Why Stetfolio exists

Audit work is judged twice. Once when it's done — and again, months later, when someone asks you to prove it. Stetfolio is built for the second time.

Chained

Every change to the audit record lands in the activity log in the same transaction, linked to the entry before it by hash. Alter an entry after the fact and verification fails at that entry.

activity_log · prev_hash → row_hash

Sealed

A sign-off stores a hash of exactly what was signed. Changing the work afterwards means reopening it with a reason, which voids the sign-off in plain sight instead of overwriting it.

REV-02 · SHA-256 · VOIDED, NOT DELETED

Traced

Findings cite the procedure and evidence behind them. Issued reports carry the hash of their own bytes. Export the whole file — workpapers, evidence, hashes, voided sign-offs — as one archive.

ENG-2026-014 · AUDIT FILE · SHA-256 PER FILE

§ 03 The record

Go on. Try to change the past.

This is a real SHA-256 hash chain, computed in your browser. It works on the same principle as Stetfolio's activity log: each entry's hash covers its own content and the hash of the entry before it.

Six events from one procedure. Every link verifies.

Computing hashes… activity_log · Meridian Bank · ENG-2026-014
    sha256(prev_hash ‖ entry) — computed live, nothing is precomputed

    § 04 Workflow

    From universe to board pack. One continuous record.

    01

    Universe & risk

    Map every auditable unit, score it on your own model, and see coverage against each unit's audit frequency. Whoever scores an assessment can't approve it.

    • Weighted risk models
    • 5×5 heat map
    • Four-eyes approval

    02

    Plan

    Build the annual plan from risk, check it against real team capacity, and roll it forward over years. Once the plan is approved, every move carries a reason.

    • Committee approval chain
    • Multi-year coverage
    • Capacity feasibility

    03

    Fieldwork

    Programs come from your library; procedures get rich workpapers and evidence that's scanned before anyone opens it. A readiness list says what's missing before you submit.

    • Program library
    • Malware-scanned evidence
    • Readiness checks

    04

    Review

    Preparer and reviewer are never the same person. Open review notes hold the review until they're cleared, and every sign-off is sealed with a hash of what it covers.

    • Segregation of duties
    • Review notes that gate
    • Sealed sign-offs

    05

    Findings

    Condition, criteria, cause, effect and recommendation, rated on your own scale. Management responds from the portal; finalising locks the finding into the record.

    • Five Cs
    • Your rating scale
    • Responses from the portal

    06

    Report

    Your Word template, your approval chain. The issued PDF carries the hash of its own bytes, and issuing it creates the management actions.

    • Word templates
    • Sequential approvals
    • Byte-hashed PDF

    07

    Actions

    Owners post updates, attach evidence and ask for more time. You verify and grade the fix. Aging, reminders and escalation run on their own.

    • Verification grades
    • Extension requests
    • Automatic reminders
    01 / 07

    § 05 Copilot

    Draft and cite. People decide.

    The copilot drafts findings, executive summaries, control-test tie-outs, planning memos and walkthrough narratives from the record, with a source for every field. When the evidence isn't there, it says so instead of guessing.

    Draft finding from procedure A.3 · Cash reconciliation
    Condition2 of 14 reconciling items in the March bank reconciliation were more than 30 days old and had not been escalated.
    CriteriaTreasury policy TP-4.2 requires reconciling items older than 30 days to be escalated to the Head of Treasury.
    CauseEscalation depends on a manual reminder, which lapsed when the preparer role changed in February.
    EffectUnresolved differences of 184,300 could hide errors or misappropriation in reported cash balances.
    RecommendationAutomate the 30-day escalation and add a monthly sign-off by the Head of Treasury.
    ✦ Drafted with your configured model · 4.2 s · 7 citations
    • Off until you turn it on. An admin enables it per workspace, and a kill switch turns it off.
    • Your model, your call. Pick the provider, including one you host yourself.
    • Drafts only. It never signs, approves, finalises or issues anything.
    • Scoped to the asker. It's grounded only in records the person asking can open.
    • On the record. Every draft is logged with its sources and exported with the audit file.
    • On a budget. Monthly token limits per workspace, with adoption measured.

    ⌘K Ask

    Questions answered from the record, with the receipts.

    Ask in plain language. Counts come from the database, not the model, and every answer links to what it counted.

    § 06 The whole function

    Everything the function runs on. In one place.

    Multi-year planning

    A coverage matrix of units by year, projected from frequency, last audit and risk, and checked against real capacity.

    Capacity & scheduling

    Chargeable hours after holidays and leave, week by week. Over-allocation shows up before it happens.

    Continuous monitoring

    Saved tests run on a schedule against your controls. A breach opens an alert that a person decides on.

    C-001 · Breached → alert

    Analytics & CAATs

    Benford, duplicates, gaps, thresholds and SQL. Each run is frozen and hashed, and its exceptions become findings.

    Sampled requests

    The request is the sample: rows are items, columns are documents. Files find their row by name.

    Quality (QAIP)

    Rate all 15 principles of the 2024 Standards. The conformance statement is sealed with a content hash.

    Your Word templates

    Upload a real .docx with merge tags and loops. Unknown tags are refused before anything is issued.

    Your vocabulary

    Rename objects, rating scales and fields to match your methodology. Every screen follows.

    Controls & the RCM

    Risks link to controls, and control tests run through the same procedure engine. An ineffective control raises its finding in the same transaction.

    And the rest of the job

    • Time, expenses & timesheets
    • Budget vs actual
    • Review queue
    • Walkthroughs via the portal
    • Roll-forward with lineage
    • Scheduled report delivery
    • Committee snapshots
    • Setup guide & importers
    • Email digests
    • Exportable audit file

    § 07 For the business

    For the business, it's a short to-do list.

    Document requests, observations to answer and actions to update, in plain language, on a phone. Business owners see only what's theirs.

    • Sampled requests show each sample item as a row; drop a folder and files find their rows by name.
    • Every upload is scanned for malware before anyone can open it.
    • Reminders and digests do the chasing, so nobody chases by email.
    • A management response is given once, then it's part of the record.

    § 08 Platform

    Built like infrastructure.

    Every screen runs on a published API, and the server enforces every rule. The build fails if an acceptance criterion loses its test.

    362 API operations in a published OpenAPI contract, gated for drift
    168 acceptance criteria, each traced to a test in CI
    36ms p95 across the read-path smoke test
    19MB the entire API server, one static binary
    Illustrative. Keys and ids are placeholders. 
    curl "$STETFOLIO_API/findings?engagement_id=$ENG" \
  -H "Authorization: Bearer ak_…"

# 200 OK
{
  "data": [{
    "ref_code": "F-02",
    "title": "Reconciling items not escalated",
    "status": "FINAL",
    "rating": 4,
    "ai_interaction_id": "…"
  }],
  "page": { "next_cursor": null, "has_more": false }
}
    • Single sign-onOIDC and SAML 2.0 through your identity provider.
    • SCIM 2.0Users and groups provisioned, groups mapped to roles.
    • Tenant isolationRow-level security on every tenant table, enforced by the database.
    • Malware scanningEvery upload scanned before anyone can open it.
    • Scoped API keysKeys carry scopes; permissions are checked on every call.
    • Signed webhooksHMAC-SHA256 on every delivery.
    • Self-hostablePostgres, S3-compatible storage, ClamAV and Gotenberg.
    • The audit fileWorkpapers, evidence, hashes and voided sign-offs in one archive.

    § 09 What changes

    Less trust required. More proof available.

     The usual wayWith Stetfolio
    Where the work livesSpreadsheets, shared drives and emailOne record, from the universe to the board pack
    The audit trailA log you're asked to trustA hash chain anyone can verify
    After sign-offEdits overwrite what was signedReopen with a reason; the old sign-off stays, voided
    ReportsCanned layouts, rebuilt by hand in WordYour own Word template, issued with a byte hash
    The businessChasers and attachments by emailA portal with a short to-do list
    AIA writing assistantDrafts grounded in the file, with sources — or no draft at all
    DeploymentInstallers, add-ins and upgrade projectsA browser, continuous releases, or your own servers

    § 10 Questions

    What evaluators ask first.

    Short answers here. The walkthrough goes deeper.

    Do we have to use the AI?

    No. The copilot is off until an admin turns it on for your workspace, and every AI control disappears while it's off. When it's on, you choose the model provider, including one you host yourself, and every draft is logged with its sources.

    Can we run it on our own servers?

    Yes. Stetfolio runs on Postgres, S3-compatible storage, ClamAV and Gotenberg, and signs people in through your identity provider over OIDC or SAML 2.0.

    How do we move off spreadsheets or our current tool?

    Import your audit universe and your open issues from CSV. Every import runs as a dry run first, lists the errors row by row, and then commits all or nothing. A setup guide takes you through the rest.

    Can it follow our methodology and our words?

    Rename objects to match your methodology, define your own rating scales and custom fields, keep work programs in a library, and issue reports from your own Word templates.

    What do business owners see?

    Only what's theirs: the documents requested from them, the observations they need to answer and the actions they own, in a separate portal written in plain language.

    How is our data kept apart from everyone else's?

    Every workspace is isolated in the database with row-level security, and restricted audits are visible only to the people on their access list. Evidence is scanned for malware before anyone can open it.

    What happens when someone changes signed work?

    They have to reopen it with a reason. Reopening voids the sign-offs that covered the work — they stay on the record, struck through — and the change lands in the hash-chained activity log.

    Can we get our records out?

    Yes. Export any audit as one archive — workpapers, evidence, hashes and voided sign-offs — and reach everything else through the REST API.

    Let it stand.

    Put your next audit on a record you can defend. Thirty minutes on a demo workspace, one audit end to end:

    1. 01A procedure prepared, reviewed and sealed
    2. 02The tamper test on a live activity log
    3. 03The portal, from the business owner's side
    Book a walkthrough Security & platform

    Or write to [email protected]

    fol. 11 · this page's text · sha256 ········

    esc
    ↑↓ move↵ chooseAnswers use Meridian Bank sample data