Small corrections.
Whole fleet on course.
Trimtab checks every Windows device against CMMC Level 2 and HIPAA, explains each gap in plain English, and tells you the moment a device drifts out of compliance.
Read-only agent · 37 device checks · Mapped to 26 CMMC controls and 10 HIPAA safeguards
From install to clear answers in one afternoon.
No consultants, no spreadsheets, no guessing which setting maps to which control.
Install the agent
One command with a client enrollment key. The agent runs as a scheduled task, scans daily and after every restart, and never changes a setting.
Every check maps to a control
37 checks cover encryption, malware protection, accounts, sessions, hardening, audit logging, and patching. Each result is tied to the exact CMMC and HIPAA requirements it proves.
Watch for drift
The fleet dashboard shows every device's score and history, and flags any check that went from Pass to Fail since the last scan.
Everything you need to prove it, nothing you have to babysit.
Read-only agent
Trimtab observes and reports. It never changes a configuration, so it is safe to run on production machines.
Mapped to the standard
Every check rolls up to CMMC Level 2 and HIPAA controls, so you see compliance by requirement, not just a list of settings.
Plain-English explanations
Each requirement shows what it means in everyday language, the official wording, and a link to the source document.
Drift detection
Compare every scan to the one before it. New failures and fixes are called out on the fleet view and on each device.
Evidence and remediation
Every finding includes the raw evidence the agent collected and a specific fix. Reports print cleanly for auditors and clients.
Multi-client from day one
Separate clients, per-client enrollment keys, and per-device tokens you can revoke at any time. Filter the fleet by client in one click.
Works offline
Laptops on the road keep scanning. Results queue locally and upload automatically the next time the device can reach Trimtab.
Fleet view by check
See which checks fail most across all devices, and jump straight to the machines that need attention.
Thresholds you control
Password length, patch age, log size, and other limits are configurable, so the checks match your policy rather than ours.
Compliance your clients can actually read.
Frameworks are written for assessors. Trimtab translates every requirement into a sentence anyone can act on, without losing the official text.
- What the requirement means, in everyday words
- The official requirement wording, word for word
- A direct link to NIST, DoD, or the HIPAA regulation
- Why each failed check matters, right on the finding
Use session lock with pattern-hiding displays
Built around the standards your clients are held to.
CMMC Level 2
The DoD requirement for contractors handling Controlled Unclassified Information, aligned to NIST SP 800-171 r2.
HIPAA Security Rule
Administrative and technical safeguards for electronic protected health information under 45 CFR 164.
What's next
Microsoft 365 tenant checks, CIS Windows Benchmarks, and NIST CSF 2.0, all mapped to the same controls.
What Trimtab proves, and what it doesn't. Device checks prove technical settings. Policies, training, physical security, and other process controls still need their own evidence. Trimtab tells you exactly which requirements it covered, so nothing is assumed.
One tool for the people doing the work and the people answering for it.
Run compliance as a service.
- Every client in one dashboard, separated by enrollment key
- Catch drift before your client's assessor does
- Hand clients reports they understand
- Deploy in minutes with any software deployment tool
Know where you stand, every day.
- A daily score instead of a once-a-year surprise
- Gaps explained in language leadership can follow
- Evidence collected automatically, device by device
- A clear line between what's proven and what's still on you
A compliance tool should not be your weakest link.
Read-only agent
No check modifies the system. The only side effect is a temporary policy export that is deleted immediately.
Per-device credentials
Each device gets its own token, encrypted at rest with Windows DPAPI and stored where only administrators can read it.
Encrypted in transit
The agent talks to Trimtab over HTTPS only, using outbound connections. No inbound ports are opened on your devices.
MFA on every login
The dashboard requires a password and an authenticator code, and sign-in attempts are rate-limited after repeated failures.
Questions, answered.
Does Trimtab change anything on my devices?
No. Every check is read-only. Trimtab reports what it finds and recommends a fix, and your team decides what to change.
What operating systems are supported?
Windows 10, Windows 11, and Windows Server, using the built-in Windows PowerShell. No extra runtime is required.
Does Trimtab make me CMMC certified or HIPAA compliant?
No tool can. Certification comes from an assessment, and compliance includes policies and processes as well as technology. Trimtab gives you continuous, evidence-backed visibility into the technical requirements, and clearly marks what it does not cover.
How often are devices scanned?
Once a day and shortly after every restart, by default. Scans take under a minute and run in the background.
What if a laptop is offline?
It keeps scanning. Results are queued on the device and uploaded automatically the next time it can reach Trimtab.
What data does the agent collect?
Security configuration only: device name, model, serial number, operating system, and the result and evidence for each check. It does not read documents, email, or browsing activity. See our privacy page for the full list.
When can I get Trimtab?
Trimtab is coming soon and isn't available for purchase yet. Sign up for updates and we'll let you know when it launches.
Is Microsoft 365 supported?
Microsoft 365 tenant checks are on the roadmap and will map to the same controls as device checks.
Trimtab is almost ready to set sail.
We're putting the finishing touches on Trimtab. Sign up for updates and we'll let you know as soon as it's available.