Compliance verified — in the diff.
Every PR. Every push. Every model card. Checked against SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, EU AI Act and 5 more. Inline. Before merge. Sealed in a cryptographic audit trail.
Free on public repos · BYOC for enterprise · 11 framework rule packs out of the box
Compliance work is reviewed quarterly — code ships daily. We close that gap.
Frameworks were written for spreadsheets, but software shipped in seconds. Boards approve a policy; developers merge code; auditors sample evidence; regulators audit the trail — and the four groups exchange artefacts that are weeks or months out of date. Code Constitution™ runs the framework rule packs inline on every pull request, composes safe auto-fix PRs for mechanical violations, and seals every decision in a cryptographic tamper-evident audit trail the auditor can pull by URL. The framework becomes part of the diff, not a sample reviewed three months later.
Boards adopt policies. Auditors sample controls quarterly. Developers ship daily. The artefacts the four groups exchange are screenshots, spreadsheets and emails — produced after the fact, refreshed manually, never reconciled.
The code that ships breaks the policy that was approved. No one notices for months. By the time the auditor finds it, the regulator is already asking why. Frameworks (SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, EU AI Act, …) are not designed to run inline on every pull request.
Install the GitHub App. Pick your frameworks. The engine runs on every PR — annotates the diff, composes auto-fix PRs for mechanical violations, and seals a content-addressed evidence pack in an immutable WORM audit chain. Auditors verify by URL. Regulators trace by hash.
Closes the gap between CEOs, developers, CISOs, auditors and regulators — one artefact, five audiences.
Five roles. Five lenses. Today they chase five different artefacts. Code Constitution™ produces one cryptographic evidence pack per PR that all five consume in the shape their job demands. Pick a role to see what they see.
A quarterly slide deck. You hope it's still true.
A dashboard that's true right now, every PR.
- 1Plain-English board view: green / yellow / red per framework
- 2One link to send the auditor — no email chains, no scrambling
- 3Drift alerts the hour something slips, not three months later
- 4Pricing per repo, transparent — no enterprise sales process required
Audit findings — three months after merge.
Inline annotation on the diff, before merge.
- 1Up to 50 line-positioned annotations per check-run
- 2Fail / warn / info severity, each with a rule-pack citation
- 3Auto-fix PR composer handles mechanical violations
- 4BYOC vault pattern — your tokens never leave your runner
Spreadsheet rollup, refreshed quarterly.
Live posture dashboard, refreshed every PR.
- 1Org-rollup heatmap across every repo + framework
- 2Top-10 failing rules surfaced with owner per CODEOWNERS
- 3Drift detection on every push; alerts within the hour
- 4WORM-anchored evidence trail an auditor can independently verify
Screenshots + email chain + control sampling.
Cryptographic evidence pack — URL handover.
- 1Content-addressed evidence packs on R2
- 2Per-finding framework + control references with citations
- 3Replay engine reconstructs any prior state from the WORM chain
- 4Per-row tamper detection (sha256(prev_hash ‖ event))
Reconstructed from logs, weeks of effort.
WORM chain, replayable from any timestamp.
- 1Append-only at the storage layer — no row mutation possible
- 2Per-tenant, per-domain partitioning of the audit trail
- 3Conformity evidence shaped per jurisdiction (EU, US, UK)
- 4Regulator-shaped reports generated by the canonical reporting engine
CC vs adjacent categories — across four axes.
Compliance SaaS, code scanners, GRC platforms — each solves part of the problem. Here's where the lines actually run, by category not by vendor.
Compliance work that runs inline on every PR vs runs quarterly off the side of the codebase.
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Yes
- GRC
- No
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Yes
- GRC
- No
- CC
- No
- Compliance SaaS
- Yes
- Scanner
- No
- GRC
- Yes
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Yes
- GRC
- Partial
- CC
- Yes
- Compliance SaaS
- Partial
- Scanner
- No
- GRC
- Yes
Compliance + governance + AI model checks + patent-safety vs security CVEs vs control catalogues.
- CC
- Yes
- Compliance SaaS
- Partial
- Scanner
- No
- GRC
- Yes
- CC
- Yes
- Compliance SaaS
- Partial
- Scanner
- No
- GRC
- Partial
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- No
- GRC
- No
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- No
- GRC
- No
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- No
- GRC
- No
- CC
- Partial
- Compliance SaaS
- No
- Scanner
- Yes
- GRC
- No
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Partial
- GRC
- Partial
Cryptographic evidence packs + immutable WORM audit trail — vs PDFs, screenshots, mutable DB rows. Auditor + regulator readiness.
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- No
- GRC
- Partial
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- No
- GRC
- No
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- No
- GRC
- No
- CC
- Yes
- Compliance SaaS
- Partial
- Scanner
- No
- GRC
- Partial
- CC
- Yes
- Compliance SaaS
- Partial
- Scanner
- No
- GRC
- Partial
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Yes
- GRC
- No
- CC
- Yes
- Compliance SaaS
- Yes
- Scanner
- No
- GRC
- Yes
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Partial
- GRC
- No
Banking-grade trust: BYOC vault pattern + OIDC service auth (no long-lived shared secrets). Customer cloud secrets never leave the customer's runner.
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Partial
- GRC
- No
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Partial
- GRC
- No
- CC
- Yes
- Compliance SaaS
- Yes
- Scanner
- Yes
- GRC
- Yes
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Partial
- GRC
- Partial
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- No
- GRC
- Partial
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Partial
- GRC
- No
- CC
- Yes
- Compliance SaaS
- No
- Scanner
- Partial
- GRC
- Partial
Seven things no code scanner, compliance SaaS, or GRC platform does:
- Framework-grade compliance enforced inline on every PR (not quarterly)
- Immutable WORM audit trail — auditor + regulator-ready out of the box
- Cryptographic evidence packs the auditor pulls by URL (no email chain)
- Banking-grade trust posture: BYOC vault — we never see your cloud tokens
- Patent-safety + FTC §5 + USPTO trademark gates on every commit
- EU AI Act / NIST AI RMF model-card evaluator on every HF README push
- Bring-your-own constitution.yaml — customer rules layered on framework floor
Comparison is by category, not by named vendor. Each column is the archetypal capability set of that category.
What ships today
EU AI Act, ISO 42001/27001/27701, GDPR, HIPAA, SOC 1/2, PCI DSS, NIST AI RMF/CSF, DORA, NIS2, CCPA + more
patent-safety · no-placeholder · trademark-consistency · HF model-card
Banking, healthcare, manufacturing, SaaS, retail, public sector, energy, defence, more
Enterprise tier with R2 Object Lock COMPLIANCE mode (Principle #45)
Governance for development teams, codebases and GitHub orgs — enforced in the diff.
Boards govern policies. CISOs govern systems. Auditors govern controls. Until now, code, teams and GitHub orgs sat outside that frame — reviewed quarterly, never enforced inline. Code Constitution™ makes the three a first-class governed surface: enforced, maintained, proven, on every commit.
Compliance frameworks, internal policies, sector-specific rules — applied to every commit, every PR, every push. No carve-outs. No 'we'll fix it next sprint'.
- Framework rule packs as code, version-controlled
- Customer constitution layered on top
- Hard guardrails: customer rules can ADD, not weaken
- Cerbos-shaped exemption registry — auditable
Rule packs update on regulator amendments. The engine reruns on every PR. Drift surfaces the hour it happens — not at the next quarterly review.
- Quarterly framework refresh (SOC 2, ISO, etc.)
- Per-PR re-evaluation against full rule set
- Inline drift detection on every push
- Org-rollup posture cards refreshed live
WORM audit chain + cryptographic evidence packs mean every state-changing decision can be replayed from any timestamp. Auditors verify hashes; regulators trace receipts.
- WORM chain (sha256(prev_hash ‖ event))
- Content-addressed evidence packs on R2
- Replay engine reconstructs any prior state
- Per-row tamper detection
Drag the divider. See what shipped without CC vs with CC.
One real PR. Two outcomes. The compliance work either lands in the diff or lives in a 47-page audit response two months later. Pick.
+ const banner = "..."
↳ patent-safety · FTC §5
+ phone: "+1-555-..."
↳ no-placeholder · fake number
+ // TODO: ...
↳ unscoped-marker · SOC 2 CC6.1
+ model_card: undefined
↳ EU AI Act Art. 13 · transparency
+ const banner = "We are SOC 2 certified."
+ phone: "+1-555-CALL-US"
+ // TODO: implement encryption
+ <button>Coming soon</button>
+ model_card: undefined
Drag the centre handle · or use ← → keys when focused
One engine. Four shapes.
Click your scope. Same checks. Same evidence. Different entry point, different rollup.
One repo. One install. Every PR verified.
Drop the Code Constitution™ app on any repo. The next PR opens a check-run with inline annotations. No infra, no config required.
- 1Install: one click at github.com/apps/code-constitution
- 2Check-run on every PR within ~10s of the diff opening
- 3Up to 50 inline annotations per run, severity-coded
- 4Cryptographic evidence pack on R2 — auditor pulls direct
One engine. Sector-shaped rule packs.
Pick your industry. Same CC engine, same evidence pack — different rule packs apply by sector. Built-in coverage for the regulators you actually face.
Cardholder data + PSD2 SCA + DORA — in the diff.
Every payment-touching commit checked against PCI DSS v4.0.1, PSD2 RTS-SCA, and DORA ICT-risk before merge. Quarterly QSA visit becomes a URL handover.
- 1Cardholder-data path encryption checks
- 2SCA-bypass exemption tracking
- 3ICT-risk operational-resilience gates
- 4Cryptographic evidence pack per PR
Solvency II + GDPR Art. 22 — every claims model audited.
Automated-decision models touching policyholder PII run the GDPR Art. 22, Art. 9, and Solvency II ORSA rule packs alongside EU AI Act Art. 10.
- 1Automated-decision transparency gates
- 2Special-category-data consent token checks
- 3ORSA disclosure auto-draft
- 4Catastrophe-scenario eval annotations
HIPAA + 21st CCA — PHI handling locked at commit time.
Every PR touching PHI code paths runs HIPAA Privacy + Security Rule checks with minimum-necessary, encryption + audit-log emission verified inline.
- 1PHI-access audit-log emit checks
- 2Minimum-necessary pattern enforcement
- 3Encryption-at-rest + in-transit verification
- 4OCR-ready evidence pack
GxP + 21 CFR Part 11 — e-records + e-sigs first-class.
LIMS, MES, batch-record workflows verified against 21 CFR Part 11 binding + audit-trail immutability + time-stamping accuracy requirements.
- 1E-sig binding requirements
- 2Audit-trail immutability gates
- 3Time-stamp accuracy verification
- 4FDA-ready inspection packet
NIS2 + ePrivacy + lawful-interception controls.
NIS2 essential-entity controls, ePrivacy obligations, and lawful-interception dual-authorisation patterns checked on every infrastructure PR.
- 1Dual-authorisation pattern gates
- 2Interception-record access audit
- 3Incident-readiness file aggregation
- 4Critical-infra incident notification chains
SOC 2 Type II in 4 hours, not 4 weeks.
Every PR seals a cryptographic evidence pack on R2. By audit prep, you have 1,800+ packs. Auditor pulls samples by URL; verifies hashes; signs.
- 1Per-PR evidence-pack sealing
- 2Audit-trail replay engine
- 3CODEOWNERS-driven routing
- 4Org-rollup posture cards
Multi-tenant isolation provable at commit time.
Every data fetch, queue message, and storage key carries tenant context. Cross-tenant-leak gates run on every PR; ISO 27017 + 27018 rule packs.
- 1Tenant-context propagation checks
- 2Queue-message tenant-id verification
- 3Storage-key prefix enforcement
- 4Cross-tenant-leak gate on every PR
EU AI Act + NIST AI RMF — per model card, per push.
HuggingFace README.md + frontmatter scored against EU AI Act Art. 10/13/15, ISO 42001 §8.1, NIST AI RMF MAP-3.1. Pass / warn / fail per article.
- 1Per-article AI Act evaluation
- 2Training data governance check
- 3Transparency disclosure auto-suggest
- 4Robustness eval claim verification
Patent-safety + trademark + placeholder gates — universal.
Independent of sector: every codebase gets FTC §5 superlative-watch, USPTO §15(1057) trademark consistency, and the no-placeholder + unscoped-marker gates.
- 1FTC superlative-watch
- 2Trademark first-occurrence enforcement
- 3Placeholder + fake-data gate
- 4Unscoped-marker detection
Nine engines. One product. Zero roadmap.
Every check below ships today. Every check ties to a rule pack and a citation an auditor can reference. Grouped into Checks / Outputs / Trust so you can scan by domain.
What CC scans for on every PR — the deterministic gates that catch the violations before merge.
Detects unsubstantiated 'SOC 2 / ISO 27001 / PCI DSS / GDPR-compliant' claims in marketing + docs + UI. FTC §5 superlative-watch. USPTO §15(1057) trademark-symbol enforcement on first mark occurrence.
FTC §5 · USPTO §15(1057)
Blocks lorem-ipsum, fake phone numbers, unscoped TODOs in production code paths, and 'coming soon' shipping UI. Auditors can't sign off on placeholders.
SOC 2 CC8.1
First-occurrence mark detection across marketing, docs, and product copy. Catches USPTO §15(1057) / EUIPO Art. 9 hygiene drift before it weakens the mark.
USPTO · EUIPO Art. 9
What CC produces — the artefacts the engineer sees inline + the auditor pulls by URL.
Up to 50 annotations per check run, positioned at the exact line/column. Severity-coded fail / warn / info. Auto-collapses to summary when count exceeds the GitHub cap.
GitHub Checks API
Every run produces a content-addressed pack in R2: full violation list, framework refs, control refs, file paths, timestamps. Auditors pull directly from the URL — no email chain.
BCBS-239 · ISO 27001 A.18.1
Every state-changing decision is chain-hashed (sha256(prev_hash ‖ event)). The replay engine reconstructs any prior state. Per-row tamper detection. Append-only at the storage layer.
BCBS-239 ¶31
How CC respects the customer's trust boundary — credentials, auth, and the model-card evaluator.
EU AI Act Art. 10 / 13 / 15 + ISO 42001 §8.1 + NIST AI RMF MAP-3.1 conformance against any HuggingFace model README.md with YAML frontmatter. Pass / fail / warn per article.
EU AI Act · ISO 42001 · NIST AI RMF
Customer secrets stay in the customer's GitHub Secrets. The mirror workflow runs in the customer's runner. We never see HF / CF / AWS / GCP / Azure tokens — by design.
SOC 2 CC6.1 · ISO 27001 A.9
Zero long-lived shared secrets between customer + Code Constitution™. Five-minute OIDC tokens minted by GitHub, verified against the public JWKS, cross-checked against the calling repo.
OIDC 1.0 · OAuth 2.1
Deterministic, event-driven, on-the-fly reconciliation — declared state vs actual state, every cycle. Constitution Amendments 1 + 2 (locked).
Pure-function diff/reconcile/summarise loop in packages/reconciler-core. Declared state in .github/state/regunav.yml; actual state pulled from CF API + GitHub + D1 + R2. Drift events emitted with stable djb2 fingerprints for issue dedup. p99 < 5 ms.
packages/reconciler-core · CONSTITUTION.md Amendment 1
Every state-changing event is tagged with one of: upstream (declared-state change), midstream (mutation in-flight), downstream (mutation committed), propagation (post-deploy edge-fanout), compensating (SAGA rollback when drift is unresolvable). No more partial recon.
CONSTITUTION.md Amendment 1
/v1/* requests against a resource with unresolved critical/high drift are refused with HTTP 503 + retry-after:30 + repository_dispatch kick. Banking-grade: customers cannot read or write against stale state.
services/api/src/middleware/inline-reconcile-verdict.ts · BCBS-239
Cloudflare Logpush → R2 → log-bridge Worker (cron every 60 s) → git logs branch. End-to-end bound ≤ 90 s. Post-facto logging forbidden by constitutional lock. Reconciler, agents, and the App consume from the same R2 stream.
CONSTITUTION.md Amendment 2 · services/log-bridge
Your policies, your rules — enforced the same way.
Drop a YAML file in your repo. Every PR runs your internal policies inline, alongside the built-in framework rule packs. Same engine, same evidence pack, same WORM chain.
# Your internal compliance policy, version-controlled
version: 1
constitution:
name: "Acme Internal Compliance Constitution"
framework_refs: ["acme-internal-v3", "soc2-extension"]
rules:
- id: "acme-payments-codeowner"
severity: fail
file_glob: "src/payments/**.ts"
must_have_pattern: "@security-team"
message: "Payments code requires @security-team review"
citation: "Acme Internal Compliance Policy §3.2"
- id: "acme-no-direct-db"
severity: warn
file_glob: "apps/**.tsx"
must_not_match_regex: "import.*from.*['\\"]pg['\\"]"
message: "Apps must not import pg directly — use @acme/db"
What you can do
- ●Add team-specific rules (CODEOWNERS-style requirements)
- ●Add internal-policy rules (architectural guardrails)
- ●Add sector-specific rules CC doesn't ship by default
- ●Reference your own framework names + clause citations
- ●Set severity per rule (fail / warn / info)
Hard guardrails
- ◐Customer rules cannot REMOVE framework checks — they ADD to the floor
- ◐Rule eval is deterministic (regex / glob / literal only) — no LLM in production rule eval
- ◐Every rule emission is audit-emitted to the WORM chain with the constitution version stamped
- ◐Malformed regex / unknown fields surface as warnings, never silently match
Free floor. Paid depth. Marketplace breadth.
Start with the 11-framework free baseline. Layer paid sector packs co-developed with auditors when you need audit-ready depth. Tap the marketplace when you need a niche-domain publisher you trust. Mix any combination with your own internal constitution.
11 framework rule packs out of the box
SOC 2 · ISO 27001 · PCI DSS · GDPR · HIPAA · EU AI Act · NIST AI RMF · DORA · NIS2 · CCPA · ISO 42001. Open. Auditable.
- ●Ship with every install — public + private repos
- ●Apache-2.0 rule pack definitions (read them, fork them)
- ●Pinned versions per framework — no breaking changes mid-cycle
- ●Updated quarterly + on-publication of regulator amendments
Sector-specific bundles, audit-ready
Deeper-than-baseline packs co-developed with QSAs, GRC auditors and sector regulators. Audit-quality citations + jurisdiction-shaped.
- ●PCI DSS v4.0.1 QSA-ready · 100+ extra rules + SAQ-shaped reports
- ●HIPAA Privacy + Security Rule full-coverage + Tech-Safeguards
- ●NIS2 (essential-entity) + Annex I sector-overlays
- ●FedRAMP Moderate / High tailored — control-by-control coverage
- ●21 CFR Part 11 + EU Annex 11 (pharma e-records + e-sigs)
- ●Solvency II ORSA + IFRS 17 (insurance carriers)
Third-party publishers, revenue-shared
Big-4 audit firms, sector consultancies and law firms publish their own packs. Customers buy directly. Publisher keeps the long tail.
- ●Publishers: PR a pack manifest → CC review → live on marketplace
- ●Publishers earn 70% revenue share (industry-standard split)
- ●Customers: install with one click, attach to org or repos
- ●Every marketplace pack is signed + versioned + audit-tracked
- ●Hard guardrails — packs cannot weaken framework floor
- ●Coming Q3 2026 — early-access for launch partners now
Stack them. Same engine evaluates all three layers.
Free baseline + paid sector packs + your own constitution + marketplace packs from publishers you trust. CC merges them deterministically and emits one evidence pack per check-run.
Audit-prep ROI calculator
Conservative 60% prep-time reduction (lower bound of published SOC 2 benchmarks). Adjust the inputs for your org. No data leaves the page.
Your inputs
Your scenario
- Audit-prep hours today
- 1,600 hrs / yr
- Audit-prep hours with Code Constitution
- 640 hrs / yr
- Hours saved
- 960 hrs / yr
- ≈ work-days saved
- 120 days / yr
- ≈ FTE equivalent
- 0.48 FTE
Assumptions: conservative 60% prep-time reduction; uniform repo distribution; identical audit scope across audits. Your number will differ — talk to sales for a tailored estimate based on your audit history.
Talk to sales →From install to first verified PR — under 90 seconds.
No infra to host. No new tool to learn. The compliance work happens where the code work already happens.
- 1Install the GitHub App
One click. Repo or whole org. Read-only by default; write only when you opt into auto-fix PRs.
- 2Pick your frameworks
Toggle the rule packs you need — 11 ship free, paid sector packs available, marketplace for niche domains.
- 3Engine runs on every PR
Deterministic checks against your rule packs + your constitution.yaml. Inline annotations within ~90s.
- 4Evidence pack per run
Cryptographically signed, WORM-sealed evidence pack on R2 — auditor URL-handover, no email chain.
- 5Auto-fix PRs (opt-in)
Safe-fix whitelist composes fix PRs for mechanical violations. BYO LLM key for non-whitelisted fixes.
Free where it should be. Paid where you need depth.
Open-source projects ship for free under Apache-2.0. Private teams pay per developer. Enterprises get BYOC + paid sector packs + a signed SLA.
- 11 framework rule packs
- Unlimited public repos
- Inline annotations + check-runs
- Community support
- Everything in Open source
- Private repos, unlimited
- Evidence packs on R2
- Per-team CODEOWNERS routing
- Email support
- Everything in Team
- BYOC + air-gapped deployment
- Paid sector packs (PCI QSA, HIPAA, NIS2…)
- Marketplace access
- SLA + indemnification per signed MSA