Your evidence
Password policies, firewall rules, and event logs, all collected and stored in a local database on your machine. Zero bytes are uploaded unless you explicitly turn on Cloud Sync.
Trust center
Don’t believe us.
Verify us.
We're a small, independent tool asking to sit inside your network. So here's everything you'd want to check before saying yes: the source, the data flow, the tamper-evidence, and the pricing.
Enterprise · tamper-evident audit log
Break the chain.
Watch it get caught.
Every Enterprise deployment appends to a hash-chained audit log. Each entry is keyed with HMAC-SHA256 over all seven fields and linked to the entry before it, so a single edit anywhere breaks the chain, and the verify endpoint will say so. Try it below: append events, then edit one.
Hashing the chain…
1
evaluation_run
2026-08-12 10:00:00Z · user #1 · soc2 · score 82.4
genesis……
2
evidence_collected
2026-08-12 10:01:00Z · user #1 · — · {"category":"password_policy","status":"pass"}
genesis……
3
export_generated
2026-08-12 10:02:00Z · user #2 · soc2 · {"report":"pdf","scope":"type_2"}
genesis……
Verify a real deployment: GET /api/v1/enterprise/audit-log/verify → walks the chain from genesis and returns status: "valid"
This demo runs the product’s exact scheme with a demo key. In your deployment the key is derived from a secret only you hold; we never see it.
Data sovereignty
Nothing we can leak.
There is no ComplianceGuard database full of customer evidence, because there is nothing to put in it.
Your credentials
AWS keys are encrypted at rest with Fernet keys derived via domain-separated HKDF-SHA256, and read only during evidence collection. We never see them.
Your reports
PDF readiness reports are generated locally and rendered on your machine. Nothing to intercept, because nothing is transmitted.
Deep dive: transport, encryption keys, rate limits, and the air-gapped deployment bundle.
Read the security architecture →Open core
Read the code that reads your system.
Source available (BSL 1.1)
Every evidence collector, scoring rule, and report template is public on GitHub. Read the code that reads your system.
Tested on every commit
Roughly 1,265 tests across backend, frontend, Electron, and Playwright run green in CI before anything ships.
Built from the tagged source
Every installer is compiled by CI from a tagged release. What's on GitHub is what runs on your machine.
Current release v4.2.4: every release ships Windows, macOS, and Linux installers built from source.
Coverage, precisely stated
The exact numbers. Not marketing.
SOC 2
43criteria
33 CC · A1.1–A1.3 · C1.1–C1.2 · PI1.1–PI1.5
The real 2017 Trust Services Criteria, scored by evidence coverage with per-criterion assessment modes. Not a legal or audit determination of compliance.
ISO/IEC 27001:2022
93controls
Annex A · A.5 ×37 · A.6 ×8 · A.7 ×14 · A.8 ×34
The complete 2022 Annex A. The withdrawn 2013 definition is archived so historical evaluations render unchanged.
HIPAA Security Rule
47safeguards
Admin · Physical · Technical
Administrative, physical, and technical safeguards mapped to the HIPAA Security Rule across all five 45 CFR Part 164 sections.
GDPR
38obligations
EU 2016/679
Obligations classified by what endpoint evidence can actually establish. Organizational duties are never scored as done because a scan ran.
Honest by default
How we make money: we sell the app.
- Flat pricing, no per-seat math. One rate per deployment: Pro $149/mo and Enterprise $599/mo (billed annually, self-hosted), or managed hosting. No surprises at renewal.
- The free tier is a real product. Full evidence collection, all 43 SOC 2 criteria with an overall coverage score, on one machine. It exists so you can judge the output before paying anything.
- No data monetization. There is no data to monetize. We don’t see your evidence, and we never will.
See full pricing →Every price is published. Nothing is behind “talk to sales.”
Direct line
A human, in under a day.
You’re evaluating a tool that touches your audit trail. You deserve a direct line, not a ticket queue.
Responsible disclosure
Found a flaw? We respond within 72 hours and credit valid reports. See the policy →
Verify it yourself.
Download, run a readiness scan, and judge the output with your own eyes before you pay a cent.