What is Code Constitution™?

Code Constitution™ is a GitHub App that runs framework-grade compliance checks (SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, EU AI Act, NIST AI RMF, DORA, NIS2, CCPA, ISO 42001) inline on every pull request. It composes safe auto-fix PRs for mechanical violations and seals each run in a content-addressed cryptographic evidence pack on an immutable WORM audit chain.

How does it differ from a code scanner or compliance SaaS?

Code scanners (Snyk, Semgrep, etc.) look for security CVEs. Compliance SaaS (Vanta, Drata, etc.) catalogues controls and runs quarterly. GRC platforms (ServiceNow, OneTrust) track policy. Only Code Constitution™ enforces ALL OF: framework-grade compliance + code governance + AI Act conformity + patent-safety + trademark hygiene — inline on every PR, sealed in a cryptographic evidence trail an auditor can verify by URL.

Yes — free forever on public GitHub repositories with all 11 framework rule packs enabled. Private repos and enterprise BYOC are paid tiers; pricing is published at codeconstitution.com/pricing.

Does Code Constitution™ see my source code or my secrets?

It sees the diff during check execution (the standard GitHub App contract) and never persists file contents. It never sees your cloud-provider tokens — the BYOC vault pattern keeps customer cloud secrets in your runner. Every state-changing operation is recorded in the WORM audit trail and available on request.

What is an evidence pack?

A content-addressed bundle on Cloudflare R2 containing every finding, the rule-pack references, the diff fingerprint, and the signing key trail. Auditors verify the head-hash, pull the pack by URL, sample as deeply as their methodology requires — no email chain, no screenshot rounds.

Which frameworks ship in the free tier?

11 framework rule packs: SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, EU AI Act, NIST AI RMF, DORA, NIS2, CCPA, ISO/IEC 42001. Sector-specific packs (PCI QSA, HIPAA pharma, maritime, oil & gas, banking-grade) are available on the Enterprise tier.

Install

Install Code Constitution™ on your repo — under 90 seconds.

Free on public repos. BYOC for enterprise. Read-only by default; write access only when you opt into auto-fix PRs.

Install on GitHub →Pricing

How it works

Five steps. No infra to host.

The compliance work happens where the code work already happens — on every PR, on every push.

1
Install the GitHub App
One click. A single repo or your whole org. The App requests Contents (read) + Pull requests (write) + Checks (write). Nothing else.
Install on GitHub →
2
Open a PR — the check runs automatically
Every new PR triggers Code Constitution™. Findings appear as inline annotations on the affected lines plus a summary check-run grouped by engine (patent-safety / no-placeholder / trademark / HF model-card / …).
3
Fix in the diff, before merge
Inline annotations carry the rule-pack citation, severity, and (for mechanical violations) a suggested replacement. Auto-fix PR composer handles the common cases.
4
Drop your constitution.yaml
Bring your own rules. Customer-defined rules layer on top of the 11 free framework rule packs — same engine evaluates both.
5
Hand the auditor a URL
Every check-run seals a cryptographic evidence pack on R2. The auditor pulls the URL list and verifies hashes against the WORM chain. No email chain. No screenshots.

Permissions requested

Read-only by default. Nothing extra.

Code Constitution™ asks for the minimum scopes needed to verify your codebase + post the check-run. Cloud-provider tokens never leave your runner (vault pattern).

Scope

Access

Why

Repository contents

Read

Read the diff + repo files needed to evaluate the rule packs

Pull requests

Read & write

Post check-runs + inline annotations on PRs

Checks

Read & write

Create + update the Code Constitution™ check-run

Issues

Read & write

Open compliance issues (only when configured)

Workflows

Read & write

Manage the log-mirror reusable workflow opt-in

Frequently asked

Answers in one sentence.

Do you store our code?

No. Code Constitution™ reads the diff via the GitHub App installation token (just-in-time, ≤50min cache). Evidence packs store findings + framework refs + file paths — not full file contents.

Do you see our cloud credentials?

No. The vault pattern is the design: the log-mirror workflow runs in YOUR runner with YOUR GitHub Secrets. HuggingFace, Cloudflare, AWS, GCP, Azure tokens never leave your runner.

What if a rule false-positives?

Drop a `.codeconstitution/exemptions.yaml` in your repo. Per (file, rule) exemptions downgrade the finding from blocking to advisory + record the justification in the evidence pack.

Can we host this ourselves?

Yes. Enterprise tier supports BYOC + air-gapped deployments. Same engine, same rule packs, runs in your CF account / your AWS region / your air-gapped network.

Which frameworks ship by default?

11 free baseline: SOC 2, ISO 27001, ISO 42001, PCI DSS v4.0.1, GDPR, HIPAA, EU AI Act, NIST AI RMF, NIST CSF 2.0, DORA, NIS2, plus CCPA / UK-GDPR / EU-CRA carve-outs.

What's the auto-fix scope?

Safe-fix whitelist composes fix PRs for mechanical violations (qualify SOC 2 claims, attribute PCI scope to provider, add ™ to first mark occurrence). BYO LLM key for non-whitelisted fixes; prompts never touch our infrastructure.

Ready when you are.

Install on a single repo to try it. Add the whole org when you're convinced. Public repos: free forever.

Install on GitHub →See pricing