Audit-ready from the first commit.
Compliance delivers fourteen packages in one bundle: tenant isolation that fails closed, evidence that can't be overwritten, and machine-readable OSCAL exports backed by a pinned NIST catalog. Own the source, wire it in before your first customer, and hand an auditor an artifact instead of a slide deck.
$ psql -c "select * from invoices" ERROR: permission denied for table invoices DETAIL: RLS policy "tenant_isolation" forbids SELECT with no app.tenant_id set — fail-closed by default.
What it composes
The Compliance bundle's core has ten direct @caisson/* dependencies: kernel, tenancy-rls, field-crypto, audit-worm, migrate, alerting, retention-runner, compliance-core, frameworks-pack, and signing-primitive. compliance-core and frameworks-pack both depend on and re-export oscal-spine, the shared commercial package that owns OSCAL assessment, catalog, XML, ISO 27001 SoA, and pinned NIST SP 800-53 surfaces. The purchase also includes three standalone compliance modules beside that runtime graph: access-review, risk-register, and trust-page.
Fourteen packages, one bundle.
Ten direct dependencies plus their shared OSCAL spine form the runtime graph. Three further standalone compliance modules are included in the same purchase. The ones also sold standalone carry their own price.
Typed config/schema, the SHA-256 chain primitive, and append-only versioning that the rest of the bundle builds on.
Fail-closed row-level security, every tenant table enables AND forces RLS, so a query with no tenant context returns nothing.
Per-tenant field encryption via HKDF-SHA256 + AES-256-GCM; a leaked tenant key exposes one tenant, never the table.
Append-only SHA-256 audit chain plus an S3 Object-Lock WORM adapter, evidence storage tampering breaks the chain and is provable.
The one migration assembler and runner: forward-only, idempotent, and fails closed on checksum drift.
Deduped, rate-capped alert delivery with quiet hours and an audit trail, the SOC 2 CC7.2 alerting control.
Policy-driven data retention on a schedule, expiry and legal-hold, enforced automatically, not by a recurring calendar reminder.
The RLS-force evidence collector, isolation tests, and the SOC 2 / HIPAA evidence-pack generator that maps live controls to named clauses.
SOC 2, HIPAA, and EU AI Act control mappings, the clause-to-control catalog the evidence packs render against.
Deterministic OSCAL v1.2.2 assessment, catalog, XML, and ISO 27001 SoA exports with a byte-pinned NIST SP 800-53 rev5 reference catalog.
Detached Ed25519 + RFC-3161 signing over evidence bundles and audit roots, a signature a third party can verify without your keys.
Audit-prep access campaigns: import a membership snapshot, record each reviewer's attested approve/revoke decision onto the audit chain, and close with every undecided reviewee flagged unresolved, never auto-approved.
Likelihood x impact risk scoring with a computed, never freeform, residual; an operator override is its own chained exception, and every entry crosswalks into your framework packs.
A self-contained public trust page rendered from your evidence pack through allowlist-based redaction, a field absent from the allowlist never reaches the page, no exceptions.
Teams that need the controls before the first customer, not after.
Teams building regulated SaaS (HIPAA, SOC 2, or both) who need the technical access and integrity controls in place before the first customer shares a row, not backfilled after a pen test or a procurement questionnaire flags the gap. Retrofitting RLS, WORM, and an audit chain into a live multi-tenant database is a migration with customer data on the line; wiring them in on day one is a schema decision.
SOC 2 from scratch runs $80k and 6–9 months. Retrofitting RLS, WORM, and an audit chain into a live multi-tenant database is months more, a migration with customer data on the line.
Both, wired on day one. Once tenants share rows in production, isolation becomes a backfill you cannot fully trust. As a default, it is just how the schema is built.
The unplanned version of that bill: across our interviews, prospect and partner reviews kept triggering the same reactive sprint. One engineering lead’s week, an enterprise prospect asks for a 90-day audit export, the logs are missing admin actions, and the roadmap loses a war-room week with the deal on the line.
Those reviews ask for what this bundle ships, the audit chain, immutable logs, the evidence export. Install the controls before the deal that demands them.
Five technical controls, each with its proof.
No diagrams standing in for behaviour. The artifact carries the claim, and each control names the framework clause it satisfies.
Every tenant table enables AND forces row-level security, so the policy binds the owner too, no privileged path around it. A query that never set the tenant context returns nothing, not everything.
SELECT count(*) FROM invoices; → ERROR: app.tenant_id not setEvidence buckets ship with S3 Object Lock in GOVERNANCE mode and a default retention, with a typed, recorded escalation to COMPLIANCE mode at launch. Inside the window an object cannot be overwritten or deleted through any normal path, not by a bug, not by an operator.
delete-object → AccessDenied: WORM-protected until 2033-06-27ZEach audit row commits SHA-256 over the previous hash plus its own payload. Tampering with any historical row breaks every link after it, and the break is detectable, provable, and exportable for an auditor.
caisson audit verify → 41984 rows · 0 breaks · root 2c9f…b7Sensitive columns are sealed with a data key derived per tenant from a root KMS key via HKDF-SHA256. A leaked tenant key exposes one tenant, never the table; rotating the root re-derives every key with no re-encrypt scan.
hkdf(rootKey, tenantId) → DEK·A cannot open DEK·B ciphertextCollects the live RLS policies, the WORM retention config, and an audit-chain proof, maps them to named controls, and writes a dated bundle. The evidence comes from the system that enforces it, not a spreadsheet.
soc2-evidence-2026-06-28/: rls-policies.json · worm-retention.json · audit-chain-proof.jsonCaisson ships the controls. Your auditor signs the certificate.
Caisson ships the technical controls SOC 2 CC6.x / CC7.2 and HIPAA §164.312 require, and generates the dated evidence bundle mapped to those named controls. It does not (and cannot) make you certified: the administrative controls (HR, vendor management, incident response) and the audit engagement itself stay with you and your auditor.
- The technical access and integrity controls, in code.
- A dated evidence pack mapped to named SOC 2 / HIPAA controls.
- A tamper-evident audit chain you can replay and export.
- Administrative controls, HR, vendor management, incident response.
- The audit engagement and the certification itself.
- The scope decision: Caisson ships the controls CC6.x / CC7.2 require, not a compliance verdict.
Why the ownership line matters: in March 2026 a venture-backed compliance-automation vendor was publicly accused of delivering AI-fabricated SOC 2 reports to hundreds of customers (TechCrunch, 2026-03-22). Whatever that case resolves to, the lesson stands: evidence you cannot verify independently is a promise, not proof. Caisson’s audit chain is hash-linked and anchored write-once outside your database, and its evidence packs are deterministic to the byte, so your auditor verifies integrity without trusting any vendor, including us. Read the dated comparison.
The evidence format is schema-checked in CI, on every push.
Not a claim you take on trust: every push runs an OSCAL conformance gate. The evidence pack is exported to NIST OSCAL v1.2.2 and round-tripped JSON → XML → schema-validate against the published OSCAL schema, so a malformed or drifted export fails the build before it ships.
oscal-cli validate soc2-evidence.xml → SAR + POA&M · v1.2.2 · schema OKPrecise scope: this gate proves the evidence pack conforms to the NIST OSCAL schema (structure and well-formedness) so the export is machine-readable by any tool that speaks OSCAL. It is a self-run conformance check on Caisson’s own export format, not a third-party assessment. No external body assesses or certifies Caisson or your deployment; that engagement stays with your auditor.
What a security review asks first.
Does Caisson make us SOC 2 or HIPAA certified?
Which packages does the bundle actually compose?
Do I own the source?
Own the source, or track the frameworks.
A one-time, perpetual license: bunx @caisson-sh/cli@latest scaffolds the base with tenancy-rls fail-closed and the standards gate passing, and the five evidence collectors, RLS-force, chain-verify, WORM-retention, field-crypto-policy, and the impersonation collector, are already wired into the SOC 2, HIPAA, and EU-AI-Act evidence packs. The pack format includes an OSCAL v1.2.2 export (canonical JSON plus an XML conversion path) alongside Ed25519 and RFC-3161 signing. caisson audit verify walks the chain and reports the root hash; the evidence pack is generated from the live system, not written by hand.
After month 12: the source stays yours. A perpetual license does not expire, stop working, or phone home — checks verify offline. Only new updates lapse, and you renew a single entitlement for another 12 months at 40% of the then-current list, or let it lapse and keep every version already delivered. The month-13 terms in full
$1,649 is the committed one-time price. Buyers we interviewed put building these foundations in-house at four to eight engineering-weeks, the translation most sign-offs actually run on; that estimate is theirs, and it is of the build, not of the price.
Prove fit in week one.
Don't take the fit on faith, scaffold the audited base and run it on your own stack before you commit.
The deadliest question in a build-vs-buy call is whether it fits the stack you already run. Answer it with code, not a sales call: scaffold the audited base in one command and deploy from the template the generator emits for your host. You own the source from the first line, so a week-one spike is a real evaluation on your own infrastructure — not a demo that disappears.
$ bunx @caisson-sh/cli@latest my-app $ cd my-app $ bun install # ready to run — deploy from the Railway, Fly, or Vercel template
Start fail-closed.
$ bunx @caisson-sh/cli@latest ✓ scaffold complete ✓ tenancy-rls: fail-closed ✓ standards gate: passing