Your evidence
Password policies, firewall rules, event logs — collected and stored in a local database on your machine. Zero bytes are uploaded unless you explicitly turn on Cloud Sync.
Trust center
Don’t believe us.
Verify us.
We're a small, independent tool asking to sit inside your network. So here's everything you'd want to check before saying yes — the source, the data flow, the tamper-evidence, and the pricing.
Enterprise · tamper-evident audit log
Break the chain.
Watch it get caught.
Every Enterprise deployment appends to a hash-chained audit log. Each entry is keyed with HMAC-SHA256 over all seven fields and linked to the entry before it — so a single edit anywhere breaks the chain, and the verify endpoint will say so. Try it below: append events, then edit one.
Hashing the chain…
1
evaluation_run
2026-08-12 10:00:00Z · user #1 · soc2 · score 82.4
genesis……
2
evidence_collected
2026-08-12 10:01:00Z · user #1 · — · {"category":"password_policy","status":"pass"}
genesis……
3
export_generated
2026-08-12 10:02:00Z · user #2 · soc2 · {"report":"pdf","scope":"type_2"}
genesis……
Verify a real deployment: GET /api/v1/enterprise/audit-log/verify → walks the chain from genesis and returns status: "valid"
This demo runs the product’s exact scheme with a demo key. In your deployment the key is derived from a secret only you hold — we never see it.
Data sovereignty
Nothing we can leak.
There is no ComplianceGuard database full of customer evidence, because there is nothing to put in it.
Your credentials
AWS keys are encrypted at rest with Fernet keys derived via domain-separated HKDF-SHA256, and read only during evidence collection. We never see them.
Your reports
PDF readiness reports are generated locally and rendered on your machine. Nothing to intercept, because nothing is transmitted.
Deep dive: transport, encryption keys, rate limits, and the air-gapped deployment bundle.
Read the security architecture →Open core
Read the code that reads your system.
Source available — BSL 1.1
Every evidence collector, scoring rule, and report template is public on GitHub. Read the code that reads your system.
Tested on every commit
Roughly 568 tests across backend, frontend, Electron, and Playwright run green in CI before anything ships.
Built from the tagged source
Every installer is compiled by CI from a tagged release. What's on GitHub is what runs on your machine.
Current release v3.5.1 — every release ships Windows and macOS installers built from source.
Coverage, precisely stated
The exact numbers. Not marketing.
SOC 2 Type II
54controls
CC 19 · A 9 · C 9 · PI 9 · CA 8
Each control mapped to the AICPA Trust Services Criteria with configurable weights and per-control scoring.
ISO 27001:2013
47controls
Annex A
The same OS-level evidence pass scores the Information Security Management System controls.
HIPAA Security Rule
47safeguards
Admin · Physical · Technical
Administrative, physical, and technical safeguards mapped to the HIPAA Security Rule.
Honest by default
How we make money: we sell the app.
- Flat pricing, no per-seat math. One rate per deployment — Pro $149/mo and Enterprise $599/mo (billed annually, self-hosted), or managed hosting. No surprises at renewal.
- The free tier is a real product. Full evidence collection, 12 core controls, and an overall score on one machine. It exists so you can judge the output before paying anything.
- No data monetization. There is no data to monetize — we don’t see your evidence, and we never will.
See full pricing →Every price is published. Nothing is behind “talk to sales.”
Direct line
A human, in under a day.
You’re evaluating a tool that touches your audit trail — you deserve a direct line, not a ticket queue.
Responsible disclosure
Found a flaw? We respond within 72 hours and credit valid reports. See the policy →
Verify it yourself.
Download, run a readiness scan, and judge the output with your own eyes — before you pay a cent.