Compliance work is a big part of my role and a lot of it involves gathering evidence and generating reports on a recurring schedule. I’m curious whether Tines can help automate this. Things like pulling logs, checking control status across systems, and assembling reports. Has anyone used Tines for compliance use cases?
Yes, definitely, and it’s actually one of the areas where Tines tends to save people the most time relative to effort invested, because so much of compliance work is just repetitive pulling and reformatting of data that already lives in your systems. 
The core idea Tines pushes for this is that evidence collection should be a byproduct of your normal operations, not a separate task someone does the week before an audit. So instead of a person logging into six systems every quarter to screenshot settings for an auditor, you build a workflow that pulls the same data on a schedule, tags it to the relevant control ID, and stores it somewhere retrievable. There’s a good writeup on this exact idea here, framed around SOC 2, GDPR, and ISO, that’s worth a read.
For the log pulling and control status checking part of what you described, the pattern is usually pretty mechanical once it’s set up. Scheduled HTTP Request actions hit whatever system holds the control evidence (IAM/identity provider for access reviews, EDR for device compliance, cloud config for infrastructure controls), the results get normalized and checked against expected state, and anything out of spec gets flagged. Tines has a broader guide on this that includes a decent example: pulling vulnerability or asset scan data automatically and pushing it into a compliance dashboard so the data’s always current instead of stale by the time the audit comes around.
If you’re using a GRC platform like Drata, Vanta, or Anecdotes already, Tines is commonly used as the glue that feeds those platforms rather than replacing them. There’s a library story specifically for uploading compliance evidence to Drata that’s a decent starting reference, and a similar pattern exists for Anecdotes.
For the reporting side specifically, a lot of teams use Tines Cases or Records to hold the evidence and generate the report as an artifact of the workflow rather than a manual writeup. There’s a good blog post on building a risk register with Tines Records that also covers dashboarding, since the same Records/Cases infrastructure works for both. It touches on things like automatically flagging SLA breaches or open risk counts exceeding a threshold, which tends to come up a lot in recurring compliance reporting.
Worth noting too, since you mentioned this being recurring: the framework list Tines commonly gets used for is pretty broad, SOC 1, SOC 2, GDPR, CCPA, PCI, ISO 27001, various NIST frameworks, CIS controls. So whatever framework you’re working against, chances are there’s prior art in the library rather than you building the pattern from scratch.
One practical thing to keep in mind going in: the value here compounds a lot once evidence is tagged to a control identifier rather than just dumped into a folder, because a single automated pull can often serve multiple frameworks at once if you tag it properly at collection time. Skipping that step early on tends to mean redoing the tagging work later once you’re compliant against more than one standard. 