“Where is the evidence for CC6.1?”
On the control. Every file names the controls it satisfies.
v0.9.5mh
Compliance evidence
Compliance evidence
that survives the audit.
Self-hosted GRC for SOC 2, ISO/IEC 27001:2022 and PCI DSS v4.0.1. Controls, evidence, vendors and risk in one place, and sealed audit packages your assessor verifies offline.
Two-command install
$ git clone --branch v0.9.5mh https://github.com/dboudreau00/Conformiti.git $ cd Conformiti && docker compose up -d --build # → http://localhost:8080 · Postgres, Redis, API, worker, nginx
No .env needed. It starts empty: run manage.py createsuperuser, or set SEED_DEMO_DATA=true for the worked example.
SOC 2 61 controls
ISO/IEC 27001:2022 93 controls
PCI DSS v4.0.1 63 controls
Cross-framework crosswalk
A clickable mock of the shipping interface, loaded with the demo dataset.
What ships in the box
One workspace instead of
nine spreadsheets and a
shared drive.
Every control has an owner and a status. Every file is mapped to the controls it satisfies. Readiness is measured from those facts, not drawn on a slide.
Tour the product217controls across three frameworks
20crosswalk themes: one policy covers CC6.1, A.5.15 and 7.1
0calls to us needed to verify a sealed package
60sfrom git clone to a running stack
The difference
Built for the week the auditor arrives.
“This policy was last reviewed in 2023.”
Every document has a review cadence, and its owner is reminded before it lapses.
“Just give the auditor access to the drive.”
Seal a package instead: a signed snapshot for named auditors, for a fixed window.
How it works
From empty install to signed audit package.
Every screen below is the shipping product.
Step 01
Stand it up and pick your frameworks.
One docker compose up. The three libraries load 217 controls and build the evidence tree for you.
Step 02
Put the evidence where the control is.
Upload a policy once and map it to every control it satisfies. Old versions are kept, never overwritten.
Step 03
Run the governance the standards ask for.
A 5×5 risk register, access reviews and meeting cadences, with an audit trail under all of it.
Step 04 · the reason this exists
Hand the auditor a package,
not your file server.
01: ASSEMBLE
Scope it
Pick the controls, pin the evidence, state the samples.
02: SEAL
Seal and sign it
Every file and its SHA-256 go into a manifest signed with Ed25519.
03: ISSUE
Grant exactly this
Named auditors, a fixed window, revoked in one action.
04: VERIFY
They leave with proof
One ZIP with a stdlib verify.py. No vendor in the loop.
Sampling, in the package
You state the population. The auditor marks each sample pass or exception.
Roll forward next year
Re-seal the same scope with today's evidence and see what changed.
The PBC list, chased for you
Every auditor request is assigned, dated and chased until it is answered.
A signature proves the package has not changed since it was sealed. It cannot prove the key was never stolen, and we say so.
Everything else
The rest of the programme,
in the same place.
Passkeys that fail closed
TOTP and passkeys. A possibly cloned key is disabled, and the account never falls back to password-only.
SSO over OIDC or SAML 2.0
Okta, Entra ID, Google Workspace or Keycloak, configured from the environment only.
Slack, Teams and email
Seals, auditor requests and scanner alerts where people already work, plus a personal digest.
Readiness that is measured
A daily snapshot per framework. Nobody types a percentage.
Workspaces
Several organisations on one installation, each seeing only its own.
Yours to run and to read
AGPL-3.0 licensed. No telemetry, no phone-home, no seat meter.
Third parties
Vendor risk, computed
from what is on file.
The rating follows the reports and certificates you hold, and drops when they lapse.
- Send a questionnaire by link. The vendor answers without an account.
- Responsibility matrices and RACI per control, for people and vendors.
- A reminder when a SOC report lapses with nothing newer on file.
Editions
So what do you actually sell?
Core is free and complete. We sell two editions that install on top, and our time.
Free · AGPL-3.0
Core
The whole programme for SOC 2, ISO 27001 and PCI DSS, on your hardware.
Built · v1.8.0
Pro
The copilot, security questionnaires, control testing, a trust centre and 27 compliance packs.
Built · v1.8.0
Enterprise
Everything in Pro, plus multi-headed business units on one baseline, controls run once for every unit, and one console for every client.
Nothing in Core moves behind a licence.
Consulting
Let us handle the audit
evidence for you.
Most tools give you somewhere to put evidence. We produce it, inside your organisation, filed against the right control.
Engineering posture
A compliance tool has to be worth auditing itself.
Every gate runs on every push, on Python 3.11 to 3.14, against SQLite and PostgreSQL 16.
1,007backend tests: auth, MFA, RBAC, evidence access and the auditor’s reach
180browser tests against the built app, failing on any console error
7independent security reviews, on record in SECURITY.md
0telemetry endpoints, licence servers or seat meters
Uploads are treated as hostile
Size-capped at nginx and in the app, active content refused, everything served sandboxed.
Every finding is answered
Fixed, or the reason it was left is written down.
Read the code before you trust it
Every line is on GitHub. Your data is a PostgreSQL database and a folder of files.
Is the free version cut down?
No. Audit packages, signatures, SSO, passkeys and workspaces are all in the free build. SOC 2, ISO 27001 and PCI DSS ship free; twenty-seven more frameworks come with the paid editions.
Will an auditor accept evidence from a tool I host myself?
Auditors accept evidence, not tools. A sealed package carries a SHA-256 per file, an Ed25519 signature and a verify.py they run themselves.
Does it write my policies with AI?
Not in Core. The Pro copilot drafts on your own model key, and only a person can approve what it writes.
Do you ship the text of the standards?
No. Control IDs and titles are identifiers, and the objectives are short original paraphrases. Paste in official text only if you hold a licence for it.
Get started
Sixty seconds to a running
compliance programme.
Start with the demo dataset, or book thirty minutes and we will walk your scope through it.
AGPL-3.0 licensed · no account required · no telemetry