Compliance
Sprinto
API integration
Ship Compliance features without building the integration. Full Sprinto API access via Proxy and 5 MCP-ready tools for AI agents — extend models and mappings to fit your product.
Talk to usUse Cases
Why integrate with Sprinto
Common scenarios for SaaS companies building Sprinto integrations for their customers.
Automate background check delivery into GRC
Background screening platforms can push completed verification reports directly into their customers' Sprinto instances, eliminating the manual PDF download-and-reupload dance that HR teams do for every new hire during SOC 2 or ISO 27001 audits.
Ship security evidence to compliance checks automatically
DevSecOps tools like SAST scanners, pen testing platforms, and vulnerability management products can map their scan outputs to specific Sprinto workflow checks, so their customers get audit-ready evidence without engineering teams stitching reports together manually.
Sync employment scope for continuous compliance
HRIS, payroll, and contractor management platforms can automatically mark employees as in-scope or out-of-scope in Sprinto based on employment type and role, ensuring security training and endpoint monitoring workflows only apply to the right people.
Turn product events into compliance evidence
Any B2B SaaS producing audit-relevant artifacts (access reviews, incident reports, training completions) can offer a native Sprinto connection so their customers stop screenshotting dashboards for auditors.
What You Can Build
Ship these features with Truto + Sprinto
Concrete product features your team can ship faster by leveraging Truto’s Sprinto integration instead of building from scratch.
One-click Sprinto connection in your app
Let end users authenticate their Sprinto workspace from your product using Truto's managed auth, without you handling tokens or credential storage.
Automated evidence uploads to workflow checks
Fetch the customer's workflow checks, let them map your product's outputs to specific checks, and push evidence files with the correct record date whenever a new artifact is generated.
Background verification report sync
When a background check completes in your platform, automatically create the corresponding verification report in Sprinto against the employee's email with the completion date and PDF attached.
Employment-driven scope management
Trigger in-scope or not-in-scope updates in Sprinto based on lifecycle events in your HRIS or payroll product, with an optional reason string for auditability.
Workflow check picker UI
Use the list of workflow checks to render a native picker inside your app so customers can choose which Sprinto control each of your data streams should feed.
Scheduled evidence refresh jobs
Run recurring jobs that regenerate reports (e.g., weekly vulnerability scans) and push a fresh evidence file to the same Sprinto workflow check, keeping controls perpetually green.
SuperAI
Sprinto AI agent tools
Comprehensive AI agent toolset with fine-grained control. Integrates with MCP clients like Cursor and Claude, or frameworks like LangChain.
list_all_sprinto_workflow_checks
List workflow checks in Sprinto using cursor-based pagination. Returns a paginated collection of workflow check edges, each containing a node with the check's pk and title, plus a cursor string used for page navigation.
create_a_sprinto_background_verification_report
Upload a background verification report for a staff member in Sprinto. Returns: message. Required: email, verificationCompletedOn, verificationReportFile.
create_a_sprinto_workflow_check_evidence
Upload evidence for a workflow check in Sprinto. Returns workflowCheck containing the evidenceStatus of the check after the upload. Required: workflowCheckPk, evidenceRecordDate, evidenceFile.
sprinto_staff_members_mark_in_scope
Mark a Sprinto staff member account as in-scope, including them in the audit compliance scope so they are mapped against configured controls and automated checks. Returns a user object containing pk, firstName, lastName, fullName, and email. Required: email.
sprinto_staff_members_mark_not_in_scope
Mark a Sprinto staff member account as not in-scope, excluding them from the audit compliance scope so Sprinto does not perform security tasks (such as policy acceptance or training) for that account. Returns a user object containing pk, firstName, lastName, fullName, and email. Required: email. Optional: reason.
Why Truto
Why use Truto’s MCP server for Sprinto
Other MCP servers give you a static tool list for one app. Truto gives you a managed, multi-tenant MCP infrastructure across 600+ integrations.
Auto-generated, always up to date
Tools are dynamically generated from curated documentation — not hand-coded. As integrations evolve, tools stay current without manual maintenance.
Fine-grained access control
Scope each MCP server to read-only, write-only, specific methods, or tagged tool groups. Expose only what your AI agent needs — nothing more.
Multi-tenant by design
Each MCP server is scoped to a single connected account with its own credentials. The URL itself is the auth token — no shared secrets, no credential leaking across tenants.
Works with every MCP client
Standard JSON-RPC 2.0 protocol. Paste the URL into Claude, ChatGPT, Cursor, or any MCP-compatible agent framework — tools are discovered automatically.
Built-in auth, rate limits, and error handling
Tool calls execute through Truto’s proxy layer with automatic OAuth refresh, rate-limit handling, and normalized error responses. No raw API plumbing in your agent.
Expiring and auditable servers
Create time-limited MCP servers for contractors or automated workflows. Optional dual-auth requires both the URL and a Truto API token for high-security environments.
How It Works
From zero to integrated
Go live with Sprinto in under an hour. No boilerplate, no maintenance burden.
Link your customer’s Sprinto account
Use Truto’s frontend SDK to connect your customer’s Sprinto account. We handle all OAuth and API key flows — you don’t need to create the OAuth app.
We handle authentication
Don’t spend time refreshing access tokens or figuring out secure storage. We handle it and inject credentials into every API request.
Call our API, we call Sprinto
Truto’s Proxy API is a 1-to-1 mapping of the Sprinto API. You call us, we call Sprinto, and pass the response back in the same cycle.
Unified response format
Every response follows a single format across all integrations. We translate Sprinto’s pagination into unified cursor-based pagination. Data is always in the result attribute.
FAQs
Common questions about Sprinto on Truto
Authentication, rate limits, data freshness, and everything else you need to know before you integrate.
How does authentication work for Sprinto?
Truto handles Sprinto authentication for you. Your end users connect their Sprinto workspace through Truto's link flow, and Truto securely stores and refreshes the credentials, so you never touch API keys or tokens directly.
Which Sprinto operations are supported through Truto today?
The current toolset covers listing workflow checks, creating workflow check evidence, creating background verification reports, and marking staff members as in-scope or not-in-scope. If you need additional Sprinto endpoints, Truto can add them on request.
How do I push evidence against a specific compliance control?
First call list_all_sprinto_workflow_checks to retrieve the customer's checks with their node PKs and titles, then call create_a_sprinto_workflow_check_evidence with the chosen workflowCheckPk, an evidenceRecordDate, and the evidenceFile. This updates the check's evidenceStatus in Sprinto.
What identifiers do I need for staff and background check operations?
Sprinto's staff and BGV operations key off the employee's email. Marking a staff member in or out of scope requires the email (with an optional reason for the not-in-scope case), and creating a background verification report requires the email, verificationCompletedOn date, and the verificationReportFile.
Does Truto handle pagination when listing workflow checks?
Yes. Truto normalizes pagination for list_all_sprinto_workflow_checks so you can iterate through a customer's full set of checks without dealing with Sprinto's underlying cursor or page semantics.
How fresh is the data returned from Sprinto?
Truto calls Sprinto's APIs in real time on each request, so listed workflow checks and the results of evidence, BGV, and scope mutations reflect the live state of the customer's Sprinto workspace.
From the Blog
Sprinto integration guides
Deep dives, architecture guides, and practical tutorials for building Sprinto integrations.
Sprinto
Get Sprinto integrated into your app
Our team understands what it takes to make a Sprinto integration successful. A short, crisp 30 minute call with folks who understand the problem.