Skip to main content

Guide · Skylos Cloud · platform documentation read on 13 November 2026

Using this with Vanta, Drata or Secureframe

A Skylos report is the code-evidence file for your auditor and for the compliance platform you already use. This page says which file goes against which kind of control, and how to attach it.

Read this first

  • There is no automatic sync today. Skylos does not connect to Vanta, Drata or Secureframe.
  • Upload is manual: you download the files from Skylos and attach them on your platform yourself.
  • Skylos is not a partner of these companies and is not endorsed by them. Their names are used only to say where a file goes.
  • A Skylos file does not turn a platform's automated test green. Those tests read GitHub or a connected scanner themselves.
  • Platforms change their screens and test names. Check their documentation if a step here does not match what you see.

How to attach a file

Download the files from step 3 of the Compliance page in Skylos Cloud. Downloads are free. The steps below come from each platform's own help pages.

Vanta

A custom document on the Documents page, added to a control.

  1. On the Documents page, choose Add Document, fill in the form and choose Create document.
  2. Add the control it supports. If the window does not open by itself, use More, then Add control.
  3. Choose Upload, pick the Skylos file, and add a description and the document's effective date.

The article does not state file types or a size limit. Source: V1.

Drata

An item in the Evidence Library, mapped to controls.

  1. Go to Compliance, then Evidence, and choose Create Evidence.
  2. Upload the Skylos file and enter the creation date and the renewal date.
  3. Map the evidence to the controls it supports, then save.

The article lists CSV, PDF, JSON and HTML among the accepted file types, up to 50 MB for one file. Source: D1.

Secureframe

The Evidence tab of the test the file supports.

  1. Open the test, choose the Evidence tab, then + Add.
  2. Upload the Skylos file, mark the frameworks in scope and save.
  3. For vulnerability scanning you run outside Secureframe, its documentation says to use Pass with upload on the test; a normal attachment can leave the test failing.

The article gives a 500 MB limit and recommends PDF and CSV among other types. Source: S1, S3.

Which file goes where

The CSV files come with SOC 2 reports. Control names differ between platforms and frameworks, so the table names the kind of control. A platform test is named only where its documentation names it.

PDF for your auditor (external summary)The whole report with counts in place of findings. No file paths, finding text or exception reasons.Kind of control it supportsSecure development, vulnerability management and change management: one document to hand over.Platform tests on the same subjectNone reads this file. It is a document for a person to read.How to attach itUpload as custom evidence on the vulnerability management and change management controls. This is the copy to attach.SourceV1, D1, S1
Full PDF for your teamThe whole report with file paths, finding text and exception reasons.Kind of control it supportsThe same controls as the external summary.Platform tests on the same subjectNone.How to attach itKeep it inside your company. Upload it only if your auditor asks for the finding detail.SourceV1, D1, S1
merged_prs.csvEvery pull request merged in the period: the scan before merge, the check result, any override with who and why, and the approvers.Kind of control it supportsChange management: code review and security check before merge.Platform tests on the same subjectVanta has tests named "GitHub code changes were approved or provided justification for exception" and "GitHub code changes has automated checks enabled". Drata has "Test 8: Formal Code Review Process", which reads branch configuration. Secureframe has "Code pull request approvals (Github)" and "Code static application security testing (Github)". Each reads GitHub itself; this file does not change their result.How to attach itUpload as custom evidence on the matching control.SourceV2, D2, S2
scan_checks.csvEach trusted scan in the period and whether its security, secrets and dependency checks ran to completion.Kind of control it supportsVulnerability management: code scanning was performed and was complete.Platform tests on the same subjectNo platform test named in the documentation read takes this file.How to attach itUpload as custom evidence on the matching control.SourceV1, D1, S1
weekly_scans.csvTrusted scans per repository for each week of the period.Kind of control it supportsVulnerability management: scanning happened throughout the period.Platform tests on the same subjectNo platform test named in the documentation read takes this file.How to attach itUpload as custom evidence on the matching control.SourceV1, D1, S1
scan_gaps.csvEvery interval between default-branch scans, with the ones longer than 7 days marked.Kind of control it supportsVulnerability management: how regular the scanning was.Platform tests on the same subjectSecureframe's documentation says to use Pass with upload when scanning is handled outside Secureframe. Whether this file is enough is for you and your auditor to decide.How to attach itUpload as custom evidence on the matching control.SourceS1, S3
findings.csvEvery critical and high finding open in the period, with first-seen date, fix-by date, the scan where it was no longer found, and any approved exception.Kind of control it supportsVulnerability management: fixes inside your deadlines.Platform tests on the same subjectDrata creates "Critical Vulnerabilities Addressed" and "High Vulnerabilities Addressed" tests for each vulnerability provider you connect. Skylos is not in the provider list of the article read, so this file does not feed those tests.How to attach itUpload as custom evidence on the vulnerability management control. Use the external edition outside your company: it leaves out file paths.SourceD3, D1
secret_findings.csvOpen and accepted hard-coded secret findings on the latest scan of each repository.Kind of control it supportsSecure development: credentials are not kept in source code.Platform tests on the same subjectNo platform test named in the documentation read takes this file.How to attach itUpload as custom evidence on the matching control.SourceV1, D1, S1
cicd_findings.csvOpen findings in CI/CD pipeline files on the latest scan of each repository.Kind of control it supportsSecure development: build pipeline configuration.Platform tests on the same subjectNo platform test named in the documentation read takes this file.How to attach itUpload as custom evidence on the matching control.SourceV1, D1, S1
dependency_coverage.csvPer repository: whether declared dependencies were listed and checked against public advisories, and how many.Kind of control it supportsVulnerability management: third-party and open-source components.Platform tests on the same subjectVanta's GitHub guide describes vulnerability tests that track open Dependabot alerts. Secureframe's "Code Dependency Testing (GitHub)" supports Dependabot only. This file does not change their result.How to attach itUpload as custom evidence on the matching control.SourceV2, S2
branch_settings.csvPer repository: whether the Skylos check was required on the default branch on the day Skylos read the setting.Kind of control it supportsChange management: the security check cannot be skipped.Platform tests on the same subjectThe platforms read branch protection from GitHub themselves. This file covers only the Skylos check.How to attach itUpload as custom evidence on the matching control.SourceV2, D2, S2
deviations.csvEvery deviation the report found, with your management response where you wrote one.Kind of control it supportsMonitoring and remediation: what went wrong and what you did about it.Platform tests on the same subjectNone.How to attach itUpload as custom evidence next to the file it refers to. Use the external edition outside your company.SourceV1, D1, S1
readiness.csvYour own to-do list per criterion: owner, target date and status. It is there when you filled in the SOC 2 answers.Kind of control it supportsA working list for you. It is not evidence that a control operated.Platform tests on the same subjectNone.How to attach itUsually not uploaded.SourceNone
JSON (signed)The stored report itself, with its SHA-256 and signature.Kind of control it supportsIntegrity: anyone can compare a copy with the record Skylos stores.Platform tests on the same subjectNone.How to attach itKeep it with your records and give your auditor the verification link. Drata's Evidence Library lists JSON among its file types if you want it stored there.SourceD1

If you have no compliance platform

You do not need one to answer a customer's security questionnaire about your code. Two things from a SOC 2 report cover most of it:

  • Questionnaire answers. Next to each SOC 2 report in step 3 of the Compliance page, open Questionnaire answers. It drafts answers to common questions about code scanning, fixing vulnerabilities and change review, each with the numbers from that report. You check each one before you send it.
  • The external summary. The "PDF for your auditor" has counts and no file paths or finding text. Attach it when a question asks for evidence or for scan results.

Skylos sees code scans and pull requests. Questions about access control, staff training, penetration tests and infrastructure need answers from your own systems. How to generate a report

Sources

Everything this page says about a platform comes from that platform's public help pages, read on 13 November 2026.