Cloud-first compliance platforms like Vanta, Drata, and Sprinto automate evidence through SaaS, cloud, identity, and MDM/EDR integrations (Intune, Jamf, Okta, CrowdStrike, and similar). That is useful, but it misses what happens on the machines themselves. Password policies, firewall rules, event logs, running services, and local user accounts live on the endpoint, not in AWS, and most MDM integrations only scratch that surface.
ComplianceGuard lives on the endpoint too. It collects evidence directly from Windows, macOS, and Linux, scores it against SOC 2 Type II, ISO/IEC 27001:2022, HIPAA Security Rule, and GDPR controls, and tells you exactly where the gaps are, across all four frameworks in a single collection pass. Run it as a desktop app or deploy the web version with Docker: self-hosted, your organization controls the infrastructure and data access; managed, your evidence stays on the endpoints until you choose to sync.
How it works: the desktop app collects OS-level evidence → maps it to compliance controls → scores your readiness → optionally syncs to a multi-machine cloud dashboard.
┌─────────────┐
Windows OS ──────>│ Collect │──────> SQLite / PostgreSQL
Event logs │ Evidence │ (local or hosted)
Registry └──────┬──────┘
Services │
Firewall ▼
Users ┌─────────────┐
Network │ Evaluate │──────> Score + Gaps
Software │ Compliance │ per control
└──────┬──────┘
│
▼
┌─────────────┐
│ Report │──────> PDF / Dashboard
└─────────────┘
ComplianceGuard.SAAS.Video.mp4
Scheduled endpoint evidence collection, evidence coverage tracking, and PDF evidence reports on demand. Self-hosted and privacy-first.
Your real-time evidence coverage score after a full evaluation, with one-click access to collect evidence, run an evaluation, upload manual evidence, and export a PDF report.
Every control at a glance — the heatmap follows your selected framework (SOC 2 criteria, ISO Annex A, HIPAA safeguards, or GDPR articles): passing, partial, or failing, with per-control gap details and inline remediation scripts where a script genuinely exists.
Track your readiness over time on the History screen, with evidence coverage zone bands and per-framework tabs across SOC 2, ISO 27001, HIPAA, and GDPR.
Monitor every machine from one centralized web dashboard: evidence coverage scores, fleet-level stats, and last-sync status for all your endpoints.
Browse the full control library offline: SOC 2 Type II (43 criteria), ISO/IEC 27001:2022 (93 controls), HIPAA (47), and GDPR (38), with control objectives and implementation guidance.
- Security and IT teams preparing for SOC 2, ISO 27001, HIPAA, or GDPR audits
- Companies that need endpoint-level evidence, not just cloud infrastructure scanning
- Teams requiring self-hosting, air-gapped deployment, or strict data residency
| If you are... | Start with | Because |
|---|---|---|
| A startup preparing for an audit | Free, then Pro | Collect and score everything at no cost; upgrade when you need gap details and PDF reports |
| A government contractor | Self-hosted Enterprise | Data sovereignty requirements |
| NHS / healthcare | Self-hosted Enterprise | NHS DSPT, patient data governance |
| A legal firm | Self-hosted Pro/Enterprise | Client confidentiality, SRA |
| Financial services | Self-hosted Enterprise | FCA data residency |
| An accounting firm | Self-hosted or Managed Pro | HMRC data, GDPR Article 32 |
| An IT consultant or MSP | Self-hosted Pro | Manage multiple client machines from one dashboard |
| Running air-gapped or classified networks | Desktop only | Zero network traffic, works fully offline |
| A team without server ops capacity | Managed Pro | We run the server; you install the desktop app and connect |
- You only need cloud compliance; Vanta or Drata cover that better
- You can't install software on the machines being audited. Evidence collection runs on the endpoints themselves, so the desktop app has to be installed there. Managed hosting removes the server work; it doesn't remove the endpoint app.
Every organisation has different requirements. ComplianceGuard gives you full control over where your data lives.
"My data never leaves my infrastructure."
Deploy the web dashboard on your own server (Railway, Render, DigitalOcean, or any VPS). Your compliance data stays entirely within your control. Nobody, not even ComplianceGuard, can access it. A good fit for regulated industries, government contractors, legal firms, healthcare, and air-gapped environments.
You manage the server. You own the data. You pay less.
"I just want it to work without managing servers."
Contact us to set up a hosted instance. Install the desktop app on your machines, enter your credentials, and you are running. We handle uptime, backups, updates, and infrastructure. Your endpoint evidence stays on your machines until you choose to sync.
We manage the server. You own the data. Zero setup required.
Either way, the endpoint evidence collected from your machines never leaves them until you explicitly choose to sync it to the dashboard.
Download ComplianceGuard-Setup.exe from the latest release, run the installer, and launch from the Start Menu.
Requirements: Windows 10/11 (64-bit)
Auto-updates: packaged builds check for updates shortly after launch and every 4 hours, download them automatically, and install on quit. Release integrity and signing details live in
docs/release-and-signing.md. Portable builds don't auto-update; use the Setup installer.
Desktop: Linux (AppImage + .deb)
- Download
ComplianceGuard-{version}.AppImage(portable, no install) orComplianceGuard_{version}_amd64.deb(Debian/Ubuntu installer) from the latest release - AppImage:
chmod +x ComplianceGuard-*.AppImage && ./ComplianceGuard-*.AppImage(or install AppImageLauncher for desktop integration) - .deb:
sudo apt install ./ComplianceGuard_{version}_amd64.deb, then launch ComplianceGuard from your application menu
Auto-updates: AppImage builds check for updates and install them on quit, like the Windows Setup build.
.debinstalls are fixed to the installed version — reinstall the new.debfrom each release to upgrade.
Requirements: 64-bit Linux with a desktop environment; glibc 2.31+. Some distros need
libfuse2to run AppImages (sudo apt install libfuse2).
Desktop: macOS (unsigned)
- Download
ComplianceGuard-{version}-arm64.dmg(Apple Silicon) orComplianceGuard-{version}.dmg(Intel) from the latest release - Open the DMG and drag ComplianceGuard to Applications
- First launch (one time only):
- Right-click the app in Applications → Open → Open Anyway, or
- Run in Terminal:
xattr -cr /Applications/ComplianceGuard.app
- Launch normally from Applications or Spotlight thereafter
Code signing will be enabled in a future release, removing this step.
Requirements: macOS 12 Monterey or later · Intel or Apple Silicon
git clone https://github.com/Egyan07/ComplianceGuard.git- Double-click
install.bat: it installs all dependencies, sets up the database, and createsstart.bat - Double-click
start.bat: choose Desktop or Web mode and you are running
Prerequisites: Windows 10/11, Node.js 18+, Python 3.10+
Desktop (Electron)
git clone https://github.com/Egyan07/ComplianceGuard.git
cd ComplianceGuard
npm install && cd frontend && npm install && cd ..
npm run devWeb: Self-Hosted (Docker)
git clone https://github.com/Egyan07/ComplianceGuard.git
cd ComplianceGuard
cp .env.example .env # configure your settings
docker-compose up -dApp at http://localhost (nginx proxy). Requires Docker. In development (docker-compose -f docker-compose.yml -f docker-compose.dev.yml up), the backend is also reachable directly at http://localhost:8000 with interactive API docs at http://localhost:8000/docs. Production deployments serve the API only through nginx and disable the public API docs and OpenAPI schema.
One-click Railway deploy:
Web: Local Development (without Docker)
# Terminal 1: Backend
cd backend
pip install -r requirements.txt
python -m uvicorn app.main:app --reload --port 8000
# Terminal 2: Frontend
cd frontend
npm install
npm run devApp at http://localhost:5173. Create an account on first run.
Web: Hosted by Us
Contact us at [email protected] to set up a managed hosted instance. We handle deployment, uptime, backups, and updates. You just install the desktop app and connect.
Build Installers
npm run package # Windows (NSIS + portable) → dist/
npm run package:mac # macOS (Intel + Apple Silicon DMGs) → dist/
npm run package:linux # Linux (AppImage + .deb) → dist/| ComplianceGuard | Vanta / Drata / Sprinto | |
|---|---|---|
| Where it runs | On your machine or self-hosted | In the cloud |
| What it scans | OS-level: event logs, registry, services, firewall, users | Cloud infra plus SaaS/identity/MDM integrations (Intune, Jamf, Okta, CrowdStrike, etc.) |
| Data residency | Self-hosted: your organization controls the infrastructure and data access | Stored on vendor servers |
| Self-hosted option | ✅ Full control | Vendor-hosted; some offer self-hosted for select plans |
| Air-gapped networks | Desktop works completely offline | Requires internet connectivity |
| Cost | Free tier available, Pro from $149/mo | $8k to $10k/year |
| Compliance frameworks | SOC 2 (43 criteria), ISO/IEC 27001:2022 (93), HIPAA (47), GDPR (38) | Broad multi-framework coverage (SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR and more; varies by plan) |
| Source-available | ✅ BSL 1.1 (not OSI open source) | ❌ Closed source |
Cloud-first platforms automate evidence through SaaS, cloud, identity, and MDM integrations. ComplianceGuard collects evidence directly from endpoints and can run fully offline or self-hosted. Use both and you have covered the full stack.
They collect through their cloud. We collect on your machine — and it can stay there.
ComplianceGuard pulls 8 categories of evidence from Windows, macOS, and Linux:
| Category | What's Collected | Maps To |
|---|---|---|
| Event Logs | Security, System, Application logs | CC7.1, CC4.1 |
| Security Settings | Password policies, audit policies, registry options | CC6.1, CC6.2, CC6.3 |
| Services | Defender, Windows Update, Firewall, Event Log status | A1.1, CC7.1 |
| Firewall | Domain, Private, Public profile configuration | CC6.6, CC6.1 |
| User Accounts | Local accounts, admin group membership | CC6.2, CC6.3 |
| Network | Interfaces, open ports, routing tables | CC6.6, CC6.7 |
| Software | Registry-based inventory of installed programs | CC8.1, CC7.1 |
| File Permissions | ACLs on critical system paths | CC6.1, CC6.3 |
Each evidence item is SHA-256 hashed for integrity and stored with full audit logging.
43 criteria from the 2017 Trust Services Criteria (33 Common Criteria plus the category-specific supplements: Availability A1.1–A1.3, Confidentiality C1.1–C1.2, Processing Integrity PI1.1–PI1.5), scored by evidence coverage with equal weighting.
What the score means: it measures whether the required evidence types for each criterion were collected — it is not a legal or audit determination of compliance. Criteria classified
manual_upload(e.g. board oversight, policy attestations) staynot_assesseduntil you upload the corresponding manual evidence; endpoint scans alone cannot satisfy them.
Scoring uses the canonical coverage model (one engine, shared by the web API
and the desktop app, driven by the framework definitions in shared/frameworks/):
each control scores as the share of its required evidence types that are present
— 100% → compliant, ≥50% → partial, >0% → non_compliant, none →
not_assessed. The overall 0–100 score is the mean over all controls;
not_assessed controls count as 0, so a sparse evidence set honestly reflects
evidence coverage rather than inflating readiness. The same model applies to ISO
27001, HIPAA, and GDPR: framework differences are data, not separate scoring
logic.
Common Criteria (CC): 33 criteria
| ID | Criterion |
|---|---|
| CC1.1 | Integrity and Ethical Values |
| CC1.2 | Board Oversight and Independence |
| CC1.3 | Organizational Structure and Reporting Lines |
| CC1.4 | Commitment to Competence |
| CC1.5 | Individual Accountability |
| CC2.1 | Quality of Information |
| CC2.2 | Internal Communication |
| CC2.3 | External Communication |
| CC3.1 | Objectives Specification |
| CC3.2 | Risk Identification and Analysis |
| CC3.3 | Fraud Consideration |
| CC3.4 | Change Risk Assessment |
| CC4.1 | Ongoing and Separate Evaluations |
| CC4.2 | Evaluation and Communication of Deficiencies |
| CC5.1 | Selection of Control Activities |
| CC5.2 | General Controls over Technology |
| CC5.3 | Deployment Through Policies and Procedures |
| CC6.1 | Logical Access Security |
| CC6.2 | User Registration and Credential Management |
| CC6.3 | Access Authorization and Modification |
| CC6.4 | Physical Access Restrictions |
| CC6.5 | Disposal of Physical Assets |
| CC6.6 | Protection Against External Threats |
| CC6.7 | Restriction of Information Transmission |
| CC6.8 | Unauthorized and Malicious Software Controls |
| CC7.1 | Configuration and Vulnerability Detection |
| CC7.2 | Anomaly Monitoring |
| CC7.3 | Security Event Evaluation |
| CC7.4 | Incident Response |
| CC7.5 | Recovery from Security Incidents |
| CC8.1 | Change Management |
| CC9.1 | Business Disruption Risk Mitigation |
| CC9.2 | Vendor and Business Partner Risk |
Availability (A): 3 criteria
| ID | Criterion |
|---|---|
| A1.1 | Processing Capacity Management |
| A1.2 | Environmental Protections, Backup, and Recovery Infrastructure |
| A1.3 | Recovery Plan Testing |
Confidentiality (C): 2 criteria
| ID | Criterion |
|---|---|
| C1.1 | Identification and Maintenance of Confidential Information |
| C1.2 | Disposal of Confidential Information |
Processing Integrity (PI): 5 criteria
| ID | Criterion |
|---|---|
| PI1.1 | Processing Information Quality |
| PI1.2 | Input Completeness and Accuracy |
| PI1.3 | System Processing Controls |
| PI1.4 | Output Delivery |
| PI1.5 | Storage of Inputs and Outputs |
The complete Annex A: 93 controls across the four 2022 themes — A.5 Organizational (37), A.6 People (8), A.7 Physical (14), A.8 Technological (34). Available via the web API at GET /api/v1/iso27001/framework/controls. Includes control objectives, implementation guidance, and risk levels. Browse by theme (/by-category/A.8), search by keyword, or fetch by ID. The desktop app includes a read-only Browse Frameworks tab for offline reference.
Evaluations produced against the withdrawn ISO/IEC 27001:2013 remain viewable and render from the archived 2013 definition (
shared/frameworks/iso27001_2013_archived.yaml); new evaluations use 2022.
47 safeguards across all five 45 CFR Part 164 sections (§164.308–§164.316). Available via GET /api/v1/hipaa/framework/controls. Each safeguard includes its specification type (Required or Addressable) and implementation guidance aligned with HHS guidance. Also browseable offline in the desktop app's Browse Frameworks tab.
What HIPAA coverage means: evidence coverage supports Security Rule readiness but does not determine HIPAA compliance. Required and Addressable implementation specifications must be evaluated in the context of the organization's own risk analysis, and the Privacy Rule and Breach Notification Rule are outside the scope of endpoint evidence.
38 obligations across the operational chapters: principles (Art. 5–9), data subject rights (Art. 12–22), controller and processor duties (Art. 24–37), and international transfers (Art. 44–47). Available via GET /api/v1/gdpr/framework/controls. Each obligation includes its source article, GDPR chapter, control objective, and implementation guidance. Browse by article (/by-category/32), search by keyword, or fetch by ID (/framework/controls/Art.32.1). Fully supported in the desktop app too: scoring, Browse Frameworks, and PDF reports.
What GDPR coverage means: it is an evidence-readiness mapping, not a determination of GDPR compliance. Technical collection can support some obligations — such as security of processing under Article 32 — but obligations involving lawful basis, data-subject rights, transparency, contracts, DPO appointment, and records of processing generally require manual organizational evidence and legal review.
Click to expand
ComplianceGuard runs in two modes: Desktop (Electron + SQLite) for offline use, and Web (FastAPI + PostgreSQL + React) for hosted deployments. The frontend auto-detects which mode it's in.
┌──────────────────────────────────────────────────────────────┐
│ DESKTOP MODE (Electron) │
│ │
│ ┌─────────────────┐ ┌───────────────────────────────────┐ │
│ │ Evidence │ │ Compliance Engine │ │
│ │ Processor │ │ SOC 2 / ISO 27001 / HIPAA / GDPR scoring │ │
│ │ Collect · Store │ │ gap analysis · recommendations │ │
│ └────────┬────────┘ └───────────────┬───────────────────┘ │
│ └──────────┬────────────────┘ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ SQLite + Audit Log │ │
│ └─────────────────────┘ │
│ ▲ │
│ ┌──────────┴──────────┐ ┌────────────────────┐ │
│ │ Platform Collector │ │ License Manager │ │
│ │ Win/macOS/Linux │ │ Ed25519 · Offline │ │
│ └─────────────────────┘ └────────────────────┘ │
└──────────────────────┬────────────────────────────────────────┘
│ IPC (context-isolated, validated)
▼
┌──────────────────────────────────────────────────────────────┐
│ REACT FRONTEND │
│ Dashboard · Score · Evidence · History · Settings · License │
│ Auto-detects Electron (IPC) vs Web (HTTP) mode │
└──────────────────────────────────────────────────────────────┘
▲
│ HTTP / REST API
▼
┌──────────────────────────────────────────────────────────────┐
│ WEB MODE (Self-Hosted or Managed) │
│ │
│ ┌─────────────────┐ ┌───────────────────────────────────┐ │
│ │ FastAPI Backend │ │ PostgreSQL │ │
│ │ Auth · Evidence │ │ Users · Companies · Compliance │ │
│ │ Compliance API │ │ Evidence · Frameworks │ │
│ └─────────────────┘ └───────────────────────────────────┘ │
│ │
│ Your server OR our managed infrastructure: │
│ your choice, your data stays yours either way. │
└──────────────────────────────────────────────────────────────┘
Key files:
ComplianceGuard/
├── backend/
│ ├── app/
│ │ ├── main.py # FastAPI app, CORS, routes, lifespan tasks
│ │ ├── api/ # Auth, evidence, compliance, ISO 27001 endpoints
│ │ ├── core/ # Config, database, auth, controls YAML, canonical_evidence.py + canonical_router.py
│ │ ├── models/ # SQLAlchemy models (user, refresh_token, evidence, compliance, machine)
│ │ ├── services/ # Audit log, evidence collector
│ │ └── integrations/aws.py # AWS evidence collection
│ ├── migrations/ # Alembic database migrations
│ ├── tests/ # Unit, integration, and e2e suites
│ ├── requirements.txt
│ └── Dockerfile
├── electron/
│ ├── main.js # Window mgmt, IPC handlers, tray
│ ├── preload.js # Secure IPC bridge with validation
│ ├── database/sqlite.js # SQLite operations, backup
│ ├── licensing/
│ │ ├── generate-key.js # Ed25519 keypair + license key generator
│ │ ├── license-crypto.js # Signature verification (public key only)
│ │ ├── license-manager.js # License state, feature gates, persistence
│ │ └── tier-constants.js # Free vs Pro feature definitions
│ ├── processing/
│ │ ├── canonical-engine.js # Canonical scoring engine (JS port of the shared model)
│ │ ├── evidence-processor.js # Evidence collection + storage
│ │ └── report-generator.js # HTML → PDF report generation
│ └── system/ # windows.js · macos.js · linux.js evidence collectors
├── shared/frameworks/ # Source of truth: canonical control definitions (4 YAMLs) + evidence vocabulary (JSON)
├── frontend/
│ ├── src/
│ │ ├── App.tsx # App entry point: providers, auth gate, error boundary
│ │ ├── theme.ts # Light (Clean Enterprise) + dark (Dark Professional) MUI themes
│ │ ├── components/ # Dashboard, ScoreHero, Evidence, History, Settings, Login
│ │ │ ├── layout/ # AppShell, Topbar, ContextSidebar, PageTransition
│ │ │ ├── ui/ # Reusable primitives: MotionCard, MotionButton, StatCard, StatusChip, Segmented, EmptyState, PageHeader
│ │ │ └── dashboard/ # DashboardHeader, CollectionSummary sub-components
│ │ ├── hooks/useDashboard.ts # Data fetching + action handlers (react-query)
│ │ ├── contexts/AuthContext.tsx # JWT auth state, login/register/logout
│ │ ├── contexts/LicenseContext.tsx # React context for tier state + feature checks
│ │ ├── services/api.ts # Unified API (IPC or HTTP)
│ │ └── test/ # Vitest unit test suite
│ ├── e2e/ # Playwright e2e tests (9 tests)
│ ├── .eslintrc.cjs
│ ├── .prettierrc
│ └── Dockerfile
├── assets/
│ ├── banner.svg
│ └── screenshots/ # Dashboard, ControlHeatmap, ScoreTrend, CloudDashboard, ...
├── resources/icons/ # App icons (ico, png, svg, tray)
├── install.bat # One-click setup (installs deps, creates start.bat)
├── .github/workflows/ci.yml # Backend Tests → Lint & Test → Build
├── docker-compose.yml # PostgreSQL + Backend + Frontend + Nginx
├── nginx.conf # Reverse proxy, rate limiting, security headers
├── .env.example # Environment config template
└── package.json # Electron + build config
ComplianceGuard supports Windows, macOS, and Linux endpoints. The following limitations apply in the current release:
- Scheduled collection requires the desktop app running: Daily or Weekly schedules fire only while the desktop app is open — there is no OS-level/background scheduler yet. Configure in Settings → Automatic Collection.
- Per-machine view in desktop mode: the Electron app shows one machine at a time. Use web mode (self-hosted or managed) with the Cloud Dashboard to monitor multiple machines centrally.
- AWS only for cloud evidence: the web backend collects S3 and IAM evidence from AWS. GCP and Azure are not yet implemented.
- PCI DSS not yet implemented: SOC 2 Type II (43 criteria), ISO/IEC 27001:2022 (93 controls), HIPAA Security Rule (47 safeguards), and GDPR (38 obligations) are all available. PCI DSS is planned.
- Evidence coverage is not a compliance determination: scores measure whether required evidence types were collected. Many SOC 2, ISO, and GDPR criteria require organizational or manual evidence that endpoint scans cannot establish, and a certification or audit opinion always requires an independent assessor.
- Single machine in free tier: the free tier is limited to one machine. Pro supports up to 10, Enterprise is unlimited.
- No real-time monitoring: ComplianceGuard takes point-in-time snapshots, not continuous streams.
- PDF reports require Pro: the free tier shows your overall coverage score but does not generate PDF report exports.
Free tier to get started. Pro adds PDF evidence reports, trend history, and remediation scripts. Enterprise is built for the strictest environments.
ComplianceGuard fills the endpoint evidence gap that cloud-first platforms leave open: they automate evidence through SaaS, cloud, identity, and MDM integrations, while ComplianceGuard collects it directly from the machines themselves. Use both to cover the full stack — cloud infrastructure and endpoint evidence. No tool combination by itself establishes SOC 2 Type II compliance: a Type II opinion requires an independent auditor assessing operating effectiveness over a review period.
| Free | Pro | Enterprise | |
|---|---|---|---|
| Price | $0 forever | $149/mo | $599/mo flat |
| Billed annually | — | $1,788/yr | $7,188/yr |
| Evidence collection (all 8 categories) | ✅ | ✅ | ✅ |
| SOC 2 controls scored | All 43 (overall score only) | All 43 + per-control breakdown | All 43 + per-control breakdown |
| Overall evidence coverage score | ✅ | ✅ | ✅ |
| Per-control scoring + gap details | — | ✅ | ✅ |
| Control heatmap + remediation scripts | — | ✅ | ✅ |
| Evidence coverage trend (per framework) | — | ✅ | ✅ |
| Remediation recommendations | — | ✅ | ✅ |
| Upload manual evidence (policies, docs) | — | ✅ | ✅ |
| Evaluation history + trends | — | ✅ | ✅ |
| PDF evidence reports | — | ✅ | ✅ |
| Cloud dashboard (multi-machine) | — | ✅ | ✅ |
| Tamper-evident audit log (HMAC-SHA256 hash chain) | — | — | ✅ |
| RBAC (admin + auditor roles) | — | — | ✅ |
| Custom PDF branding (logo, company name, footer) | — | — | ✅ |
| Full compliance data export (NDJSON) | — | — | ✅ |
| Air-gapped Docker deployment bundle | — | — | ✅ |
| Zero telemetry (ENTERPRISE_MODE) | — | — | ✅ |
| Machines | 1 | Up to 10 | Unlimited |
| Users | 1 | Up to 10 | Unlimited |
| Support | Community | Dedicated SLA |
| Pro Managed | Enterprise Managed | |
|---|---|---|
| Price | $229/mo | $999/mo |
| Billed annually | $2,748/yr | $11,988/yr |
| Everything in Self-Hosted Pro/Enterprise | ✅ | ✅ |
| Zero server setup required | ✅ | ✅ |
| We handle uptime, backups, updates | ✅ | ✅ |
| Onboarding assistance | ✅ | ✅ |
| Dedicated infrastructure | — | ✅ |
Self-hosted: Your data stays entirely on your infrastructure, and the price is lower because you manage the server. A good fit for regulated industries, government contractors, legal firms, and air-gapped environments.
Managed: We host the dashboard for you, so there is zero setup. The price is higher because we do the work. The data sovereignty principles are the same: your endpoint evidence never leaves your machines until you sync.
License keys use Ed25519 cryptographic signatures, verified offline with no license server required.
All data stays under your control. Zero telemetry.
| Layer | How |
|---|---|
| IPC | Context isolation. Every exposed method validates input types and uses allowlists. |
| Evidence | Full audit trail with timestamps. Streaming upload with early abort on size/type violation. |
| Database | Parameterized queries. Foreign key constraints. Alembic-managed migrations. |
| Navigation | External URLs blocked. window.open denied. |
| Licensing | Ed25519 signed keys. Only the public key ships with the app. |
| Auth (Web) | JWT access tokens (30 min, held in memory only in the browser, never localStorage/sessionStorage) + DB-backed revocable refresh tokens (7 days) delivered as an HttpOnly, SameSite=Strict cookie (Secure in prod) so they aren't readable by JS/XSS. Page reloads silently re-authenticate via the refresh cookie. Desktop clients (X-Client-Type: desktop) still receive the refresh token in the response body. Refresh tokens rotate on every use with family reuse detection; the access-token path rejects refresh tokens. Password-reset and email-verification tokens are stored hashed (SHA-256), never in plaintext. Bcrypt hashing (passwords capped at 72 bytes, bcrypt's real limit). Email verification enforced. A password reset revokes all of the user's refresh tokens. POST /api/v1/auth/logout revokes the refresh token JTI and clears the cookie. |
| License (Web) | Ed25519 signed keys verified in Python (cryptography). require_pro dependency returns HTTP 402. License email validated on activation. |
| Rate Limiting | 5 req/min on login, 3/min on register. Redis shared backend via RATELIMIT_STORAGE_URI, required in production when scaled out (WORKERS>1 or REPLICAS>1; startup fails otherwise so limits can't silently weaken). Nginx rate limiting at proxy layer. |
| Metrics | /metrics is Prometheus-format but not public: loopback scrapes only unless METRICS_ALLOWED_IPS admits internal scraper subnets; nginx additionally returns 404 for public requests. |
| Error Monitoring | Sentry integration on backend (FastAPI + SQLAlchemy) and frontend. send_default_pii=False. Silent no-op when DSN unset. Disabled entirely when ENTERPRISE_MODE=true. |
| Enterprise Audit | Tamper-evident audit log with an HMAC-SHA256 keyed hash chain (prev_hash + entry_hash; key derived from the server secret, so a DB-write attacker can't forge it). Append-only at API layer; Postgres app user REVOKEd DELETE/UPDATE. Chain verifiable at GET /api/v1/enterprise/audit-log/verify. Enterprise endpoints (audit/RBAC/branding/export) require a dedicated deployment (ENTERPRISE_MODE=true) and the admin role, and are never served on the shared hosted backend. |
| Proxy | Nginx reverse proxy with CSP, HSTS, Permissions-Policy, X-Frame-Options, X-Content-Type-Options. |
For reporting security vulnerabilities, see SECURITY.md or contact us via /.well-known/security.txt (RFC 9116).
ComplianceGuard's own compliance posture: we practice what the tool preaches at the scale we're at — zero telemetry, signed release integrity manifests (SHA256SUMS + SBOMs on every release), and supply-chain checks in CI. We do not yet hold a SOC 2 attestation or a published third-party pentest report for ComplianceGuard itself; when we do, they will be listed here. We'd rather show an honest "not yet" than a borrowed claim.
npm run dev # Electron + React dev server
npm run build # Build frontend
npm run package # Windows installers (NSIS + portable .exe)
npm run package:mac # macOS DMGs (Intel + Apple Silicon)
npm run package:linux # Linux AppImage + .debdocker-compose up -d # Start all services
docker-compose down # Stop all servicescd backend
pip install -r requirements.txt
alembic upgrade head # Run database migrations
uvicorn app.main:app --reload # Run backend locally# Frontend (Vitest unit + Playwright e2e)
cd frontend
npm test # Vitest unit tests
npm run test:e2e # Playwright e2e (starts real backend + frontend)
npm run lint # ESLint
npm run format:check # Prettier
# Backend
cd backend
python -m pytest tests/unit/ -v
python -m pytest tests/integration/ -v
python -m pytest tests/e2e/ -v --run-e2e
python -m pytest tests/ -q --cov # with coverage reportThe Playwright e2e suite (frontend/e2e/) is full-stack: it boots the real
FastAPI backend against an isolated SQLite database (e2e_test.db) plus the
Vite dev server, then drives the browser through register/login/dashboard
flows. Run it with cd frontend && npm run test:e2e (backend deps must be
installed and on PATH, or prefix with PATH=../backend/.venv/bin:$PATH).
cd backend
python -m uvicorn app.main:app --reload --port 8000 # terminal 1
python scripts/benchmark.py --requests 100 # terminal 2: serial
python scripts/benchmark.py --requests 100 --concurrency 10 # parallel loadReports p50/p95/p99 latency for the hot endpoints (login, framework controls,
evaluation history, evaluate) and exits non-zero if p95 exceeds
--max-p95-ms (default 500 ms), so it can gate CI performance regressions.
The bench user is auto-created and promoted to a verified Pro account.
CI runs all tests on every push via GitHub Actions, and the desktop (Electron) test suite gates releases. Backend: 450 unit + 43 integration + 9 e2e. Frontend: 260 Vitest unit. Electron: 512. Playwright e2e: 9.
See docs/deployment.md for production deployment guides
covering Railway (one-click), Docker Compose (VPS), Render, and manual VPS
setup. Includes monitoring, migration, and troubleshooting.
Moving from SQLite to PostgreSQL? See
docs/migrate-sqlite-to-postgres.md.
Nightly pg_dump backups with verification + retention pruning, a one-command
restore, and a full DR runbook (RPO/RTO targets, off-site copies, restore
drills) live in docs/disaster-recovery.md:
./scripts/db-backup.sh # nightly backup
./scripts/db-restore.sh --dry-run backups/latest.dump # safe preview
./scripts/db-restore.sh backups/latest.dump # actual restore| Issue | Solution |
|---|---|
install.bat fails with "Node.js not found" |
Install Node.js 18+ and ensure it is added to your PATH. Restart your terminal after installation. |
install.bat fails with "Python not found" |
Install Python 3.10+ and check "Add Python to PATH" during setup. |
| Backend starts but frontend shows blank screen | Run cd frontend && npm install then npm run build. In desktop mode, ensure the Vite dev server is running on port 5173. |
| Docker Compose fails with "port already in use" | Stop any existing services on ports 80, 8000, or 5432, then re-run docker-compose up -d. |
| Evidence collection returns empty results | Run the app as Administrator. Some Windows registry and event log queries require elevated privileges. |
alembic upgrade head fails |
Ensure DATABASE_URL in your .env is set correctly. For local SQLite, use sqlite:///./complianceguard.db. |
| License key not activating | License keys are tied to the Ed25519 public key bundled with the app. Ensure you are using a key generated for this build. |
| Electron tests fail with "Could not locate the bindings file" | better-sqlite3 13 ships N-API prebuilds in the npm tarball, so the same binary works under Node (tests) and Electron (packaged app) with no rebuild. If you see a bindings error, run npm ci to restore the prebuilds; only the legacy npm run test:scheduler pretest hook rebuilds for a specific ABI. |
No. All evidence collection, scoring, and storage happens locally on your machine or on your own hosted infrastructure. There is no telemetry and no data leaves your control.
Self-hosted means you run the web dashboard on your own server: Railway, Render, DigitalOcean, or any VPS. Managed means we run it for you. Either way, the endpoint evidence collected from your machines stays local until you explicitly sync it. The difference is who manages the server infrastructure.
No. It automates evidence collection and gives you a readiness score, but a formal SOC 2 audit still requires a licensed CPA firm. Think of ComplianceGuard as audit preparation, not audit replacement.
The free tier is useful for assessing your current posture. For an actual audit you will need Pro, which includes the full 43-criteria breakdown, gap details, remediation recommendations, and PDF exports that auditors expect. Note that no tool — ComplianceGuard included — issues or replaces the audit opinion itself: only an independent auditor can do that.
Your data is stored in a local SQLite file (Desktop mode) or your own PostgreSQL instance (Web mode). Uninstalling the app or deleting the database file removes all data permanently.
Yes. The full source is available in this repository under the Business Source License. You can inspect every line of the evidence collection and scoring logic.
Contact [email protected] for licensing. Managed hosted instances are also available; we handle deployment and infrastructure for you.
The Cloud Dashboard allows you to monitor multiple machines from one centralized web view. Each endpoint (Windows, macOS, or Linux) runs the Electron desktop app. Go to Settings > Cloud Sync, enter your web server URL and credentials, and click Sync to Cloud. The web dashboard then shows all machines' evidence coverage scores, last sync time, and fleet-level stats. Available for Pro and Enterprise users.
Yes. The Desktop (Electron) mode works completely offline with no network traffic. Evidence is collected locally, stored in SQLite, and never leaves the machine unless you configure cloud sync. A good fit for classified, government, or highly regulated environments.
Contributions are welcome. Before submitting a pull request, please:
- Add tests for any new functionality
- Ensure all existing tests pass (
npm test+pytest) - Follow existing code style (ESLint + Prettier for frontend, ruff for backend)
- Update documentation for any user-facing changes
See CONTRIBUTING.md for full guidelines.
Shipped
- Evidence collection across 8 categories: event logs, registry, services, firewall, users, network, software, file permissions
- Native Linux support: systemd/journald, iproute2, ufw/iptables/nftables, dpkg/rpm/pacman; AppImage + .deb distribution
- Native macOS support on Intel and Apple Silicon (unsigned DMG with Gatekeeper bypass)
- Four compliance frameworks: SOC 2 Type II (43 criteria), ISO/IEC 27001:2022 (93), HIPAA Security Rule (47), GDPR (38)
- Scheduled evidence collection (Daily/Weekly while the desktop app is running)
- Control Heatmap with per-control scores, gap details, and inline remediation scripts
- Evidence coverage trend with per-framework history
- PDF evidence reports and evaluation history
- Air-gapped Enterprise tier: tamper-evident HMAC-SHA256 audit log, RBAC, custom PDF branding, NDJSON export, offline Docker bundle
- Free / Pro / Enterprise licensing with Ed25519 signatures, verified fully offline
- Cloud sync and multi-machine compliance dashboard
- Self-hosted (Docker), managed hosting, and one-click Railway deploy
Planned
- GCP and Azure cloud evidence (AWS today)
- PCI DSS framework
- Signed macOS builds and notarization (requires Apple Developer enrollment)
- Evidence status workflow (pending review, approve, annotate)
- Setup video walkthrough
Business Source License 1.1: free to use, modify, and self-host. You may not offer ComplianceGuard as a competing hosted commercial service. See LICENSE for full terms.
See CHANGELOG.md for full version history.
ComplianceGuard — Collect. Evaluate. Comply.
Built by Egyan07
