Ask most IT managers at small companies or agencies how they would prove their IT is under control right now, and watch the hesitation. The work is being done. SSL certificates get renewed, access gets reviewed, vendors get tracked. But the evidence? It lives in a spreadsheet no one has touched in three months, a registrar dashboard nobody else has access to, and a folder of notes from someone who left last year.
CertPilot is built specifically for this gap. It is an IT governance evidence platform aimed at lean IT teams, MSPs, and agencies who need to prove operational control without buying into a full enterprise GRC suite. The model is deliberately simple: automated public checks plus manually maintained registers, and one click to turn both into a dated PDF a non-technical stakeholder can actually read.
Solo founder Alex built it after running into the same problem repeatedly in IT operations work. The technical jobs were getting done. Assembling the proof of that, though, still meant hours of manual reporting. CertPilot is his answer to that frustration, and it shows in how focused the feature set is.
Key Features of CertPilot
External Footprint Monitoring
CertPilot runs daily public checks across every domain you add. It reads SSL certificate expiry and validity from the public TLS handshake, tracks DNS record changes across A, AAAA, MX, NS, TXT, and CAA records, pulls domain registration expiry via public RDAP, and checks email authentication records including SPF, DMARC, MTA-STS, TLS-RPT, and BIMI. No credentials needed. CertPilot creates a one-time alert when a certificate enters the 30-day window and when a domain registration enters the 45-day window. Certificates become critical below 14 days, while domain registrations become critical below 30 days. You see what changed and when, without logging into a dozen separate tools.
Renewals and Vendor Register
Every SaaS subscription, hosting plan, license, contract, and domain gets a record with an owner, a renewal date, a billing contact, and an annual cost. The register surfaces overdue, upcoming, and incomplete records before they become problems. You can import your existing spreadsheet via CSV and export anytime. The goal is a register reliable enough to feed a report without rebuilding it from scratch each month.
Access Review Register
The access review module gives teams a structured, repeatable way to document who has access to which systems and whether that access still makes sense. It includes a Systems Catalog, a matrix view with rows for people and columns for systems, completion sign-off, and an Access Review Register PDF. Review states like action-required and overdue keep flagged items tracked until they are resolved in the underlying system, so a review produces decisions, not just a tick in a box.
People, Assets, and Vendor Status
Three supporting registers round out the platform. The People and Accounts register tracks employees, contractors, system accounts, roles, and start and end dates. The Assets Register covers hardware and software with ownership, location, serials, license status, and renewal dates. Vendor Status Watch surfaces official vendor-reported incidents and maintenance, helping the team check whether a provider is reporting a broader issue. It does not confirm whether a specific customer account or tenant is affected.
Evidence Reports
Six report types generate on demand: Domain Health, Renewal Risk, Monthly Proof, Weekly Governance, Access Review Register, and the cross-module Governance Evidence Pack. Each is a dated, plain-English PDF. Report recipients do not need access to the CertPilot dashboard. Useful for a board update, a client review, a cyber-insurance conversation, or a quick internal audit prep.
A Monday Morning That Could Have Gone Badly
Priya runs IT for a 30-person digital agency. At 8:45 on a Monday morning, her operations director forwarded an email from a client asking whether their SSL certificates and access controls were properly reviewed for the quarter. Two years ago, answering that would have meant an hour of hunting through three spreadsheets, a registrar dashboard, and a shared drive folder.
This time, she opened CertPilot, checked the workspace summary, and saw that all 16 monitored domains were healthy, the latest access review had been completed, with four overdue review items still requiring attention, and two vendor renewals needed attention. She clicked Generate on the Governance Evidence Pack, downloaded the dated PDF, and forwarded it to the ops director by 9:05.
The client got a five-page document with dated check results, renewal status, and access review completion evidence. No dashboard access. No raw spreadsheet. Just a readable record of what had been checked and reviewed. That is the outcome CertPilot is designed to produce: the evidence already assembled, not scrambled together under pressure.
How CertPilot Turns Checks and Registers Into Evidence
Step 1: Add your domains and let checks run
Add your domains manually or paste a list. CertPilot starts running public checks daily across SSL, DNS, RDAP, and email authentication records. No credentials, no agents, no network access needed.
Step 2: Build your registers
Import your existing renewal spreadsheet via CSV or add records manually. Do the same for people, accounts, assets, and access reviews. The registers are manual-first because manual records are the accurate source of truth for ownership and decisions.
Step 3: Generate a dated evidence report
When you need to share the picture with management, a client, or an auditor, pick a report type and click Generate. The output is a dated PDF that pulls from your live checks and registers. No reformatting, no copy-pasting from dashboards.
Who Should Try CertPilot
If you manage IT for a small business, run an MSP, or handle operations for a digital agency and you are still assembling governance evidence by hand before every client review or leadership update, CertPilot is worth a serious look. It is not trying to replace a full GRC platform. It is trying to make the evidence work that lean IT teams already do much less painful to document and share. Start with a free 14-day trial, no credit card needed, at certpilot.app.
Disclosure: This article was published in collaboration with CertPilot as part of our sponsored editorial series. Our editorial standards apply in full.
