What is Code Constitution™?

Code Constitution™ is a GitHub App that runs framework-grade compliance checks (SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, EU AI Act, NIST AI RMF, DORA, NIS2, CCPA, ISO 42001) inline on every pull request. It composes safe auto-fix PRs for mechanical violations and seals each run in a content-addressed cryptographic evidence pack on an immutable WORM audit chain.

How does it differ from a code scanner or compliance SaaS?

Code scanners (Snyk, Semgrep, etc.) look for security CVEs. Compliance SaaS (Vanta, Drata, etc.) catalogues controls and runs quarterly. GRC platforms (ServiceNow, OneTrust) track policy. Only Code Constitution™ enforces ALL OF: framework-grade compliance + code governance + AI Act conformity + patent-safety + trademark hygiene — inline on every PR, sealed in a cryptographic evidence trail an auditor can verify by URL.

Yes — free forever on public GitHub repositories with all 11 framework rule packs enabled. Private repos and enterprise BYOC are paid tiers; pricing is published at codeconstitution.com/pricing.

Does Code Constitution™ see my source code or my secrets?

It sees the diff during check execution (the standard GitHub App contract) and never persists file contents. It never sees your cloud-provider tokens — the BYOC vault pattern keeps customer cloud secrets in your runner. Every state-changing operation is recorded in the WORM audit trail and available on request.

What is an evidence pack?

A content-addressed bundle on Cloudflare R2 containing every finding, the rule-pack references, the diff fingerprint, and the signing key trail. Auditors verify the head-hash, pull the pack by URL, sample as deeply as their methodology requires — no email chain, no screenshot rounds.

Which frameworks ship in the free tier?

11 framework rule packs: SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, EU AI Act, NIST AI RMF, DORA, NIS2, CCPA, ISO/IEC 42001. Sector-specific packs (PCI QSA, HIPAA pharma, maritime, oil & gas, banking-grade) are available on the Enterprise tier.

Status

Canonical service surfaces. The continuous probe (cc-e2e-verify workflow) runs every six hours and writes findings to the public logs branch on GitHub. See logs/cc-e2e/latest/findings.md for the most recent probe result.

Probed surfaces

Host	Purpose
codeconstitution.com	Marketing + landing
api.codeconstitution.com	GitHub App webhook + dashboard API
api.codeconstitution.com/health	Worker health probe
api.codeconstitution.com/v1/installations	App installations endpoint

Subscribe. Email [email protected] to receive incident notifications. Auditors + tier-1 customers also receive RSS / webhook delivery via the auditor portal.

Last probe + per-surface verdict are published to the logs branch within minutes of the probe completing. The probe distinguishes DNS_FAIL / CONNECT_FAIL / TIMEOUT / TLS_FAIL / http=<code> (no synthesised codes).