Build it, buy it, or own it.
Three ways to get audit-ready infrastructure: build it yourself over 6–9 months, rent a hosted audit platform that watches your stack from the outside, or own the code that enforces the controls from within. Caisson is the third path, the load-bearing layer, bought once and yours to keep.
-- fail-closed RLS: a query with -- no tenant context returns nothing > SELECT count(*) FROM audit_events; 0 // kernel verifyChain — // tamper breaks the link const r = verifyChain( entries, anchor ); // { valid: true, brokenAt: null }
Every regulated team weighs the same three.
This isn't a scoreboard against a named vendor, it's the real decision. Build the load-bearing infrastructure, rent a service that monitors it, or own the code that is it. Here's each path told straight.
Build it yourself
Write fail-closed RLS, a tamper-evident audit chain, WORM evidence storage, and an evidence-pack generator from scratch, the load-bearing parts a regulated-SaaS team has to get exactly right the first time.
SOC 2 from scratch: $80k, 6–9 months
Retrofitting RLS, WORM, and an audit chain into a live database is months more.
Buy a hosted platform
Subscribe to an audit-automation service that connects to your stack and monitors it from the outside, a scanner and a dashboard. Fast to show a status page, and a recurring subscription for as long as you need to stay audit-ready.
A scanner reports what's missing.
It watches code it didn't write, the controls still have to exist in your codebase.
Own the code
The compliance controls as source you own (fail-closed RLS, an append-only audit chain, WORM evidence storage, and an evidence-pack generator) wired on day one and tested in CI on every push.
$1,649 · one-time, perpetual
Own the source. No per-seat subscription; optional updates keep the mappings current.
Build figures are the industry cost of a first SOC 2, not a Caisson quote. Whether any path makes your system compliant depends on your deployment and your audit, a determination that stays with your team.
A scanner reports what's missing. It doesn't build it.
A hosted platform inspects your stack from the outside and tells you where the controls should be. Caisson is the controls (fail-closed RLS, a tamper-evident audit chain, and evidence generation), as source you own and run. The load-bearing layer sits earlier than the dashboard that grades it.
// The controls a platform checks for — as code you own.
import { verifyChain } from "@caisson/kernel/node";
// Append-only SHA-256 chain: tamper, truncate, or reorder
// any row and the next link fails on verify.
const result = verifyChain(entries, anchor);
// { valid: true, brokenAt: null }
// Fail-closed RLS is enforced by Postgres itself — a query
// that never sets the tenant context matches no rows, not
// a leaked row. No dashboard required to make it true.The base substrate (fail-closed RLS, auth, billing) is Apache-2.0 and ships with every bundle. The Compliance bundle adds the WORM store, audit chain, and evidence-pack generator on top.
What Caisson ships
- Fail-closed RLS, WORM storage, and an append-only audit chain, as source you own
- An evidence-pack generator that maps controls to framework clauses
- The gates wired and tested in CI before your first assessment
- A one-time, perpetual purchase, $1,649 for the Compliance bundle
What stays yours
- The audit itself and the conformity sign-off
- Organizational controls: HR, vendor management, incident response
- Which frameworks apply and how your systems are scoped
- The decision to keep the optional updates plan, or not
Caisson ships technical controls and generates evidence. It is not itself SOC 2 or HIPAA certified, and owning it does not make you compliant, that determination depends on your audit and your organizational controls.
Buy the code once. Keep it.
A hosted platform is a subscription that renews for as long as you need to stay audit-ready. Building the same controls yourself costs $80k and 6–9 months for a first SOC 2. The Compliance bundle is $1,649, once.
Regulations don't hold still, so an optional Compliance Updates plan ($1,499/yr) keeps the control mappings and evidence packs current. It's an add-on, not a gate: the source you bought runs whether or not you renew.
Build vs buy, answered.
Is Caisson a compliance platform?
If I own the code, do I still need an audit?
Build vs buy: which is cheaper?
Can't I just have an AI coding assistant write these controls?
What support and updates come with the code I own?
What happens if I stop paying?
Own the controls from day one.
Scaffold a project and the fail-closed RLS, audit chain, and evidence generator are in the repo, tested, before your first customer signs.
bunx @caisson-sh/cli@latest