Zero-knowledge by architecture
Evidence, AWS credentials, and reports live in a local SQLite database on your machine. Nothing ships to a ComplianceGuard server unless you turn on Cloud Sync.
Security
Security, by architecture.
Zero-knowledge by design. Your evidence stays on your machine — unless you explicitly choose otherwise.
Security properties
HKDF-SHA256 credential encryption
AWS keys are encrypted at rest with Fernet keys derived via domain-separated HKDF-SHA256. The legacy SHA-256 derivation is kept read-only for migrations.
Offline public-key license verification
Pro licenses are signed with Ed25519. Only the public key ships in the binary. Validation is offline — no phone-home required.
SHA-256 hash-chained audit log
The Enterprise tier writes a tamper-evident audit log. Every entry chains to the previous SHA-256 hash. /api/v1/enterprise/audit-log/verify walks the chain from genesis.
Hardened transport & rate limits
TLS 1.2+, HSTS, strict CSP, Permissions-Policy. Login 5/min, register 3/min, forgot-password 3/min — multi-worker safe via shared backend.
BSL 1.1 open core
Read the code that reads your system. ~568 tests across backend, frontend, Electron, and Playwright run green on every commit.
Last updated April 2026
Disclosure & support.
Responsible disclosure
If you discover a security vulnerability in ComplianceGuard, please disclose it responsibly by emailing getcomplianceguard@gmail.com with the subject "Security disclosure". We respond within 72 hours and credit researchers who report valid vulnerabilities.
Supported versions
Only the latest release of ComplianceGuard receives security updates. Always run the latest version at github.com/Egyan07/ComplianceGuard/releases.