# Caisson > Compliance-grade infrastructure for regulated SaaS: fail-closed Postgres RLS, S3 Object-Lock WORM, and an append-only audit chain, shipped as a composable open-core base plus six commercial bundles. ## Licensing Open-core. The 16-package Base substrate is Apache-2.0 — free to use, read, and redistribute under those terms: @caisson/kernel · @caisson/auth · @caisson/tenancy-rls · @caisson/ui · @caisson/billing · @caisson/jobs · @caisson/email · @caisson/ai-config · @caisson/mcp-server · @caisson/registry-schema · @caisson/observability · @caisson/rate-limit · @caisson/ds-manifest · @caisson/cli · @caisson/migrate · @caisson/license-verify. The six bundles and the à-la-carte modules built on top of it are commercial, sold as a perpetual license with a 12-month updates window. - [License terms](/legal/license): which packages are Apache-2.0, which are commercial, and what each grant allows. - [Licensing, updates and renewals](/docs/licensing): what a perpetual license includes and what renewing costs. ## Documentation - [Documentation](/docs): the full docs tree, indexed below. - [Getting started](/docs/getting-started): install and first run. ## Buying Prices are published and committed on the marketplace pages below. Checkout on caisson.sh is currently restricted to the Caisson team, so there is no public self-serve purchase path today — purchase, licensing, and delivery questions go to support@caisson.sh (see /support). ## Marketplace - [Marketplace](/marketplace): Every bundle and module on one surface — filter, compare, and build a stack. - [Plans and pricing](/marketplace/plans): Subscription plans alongside the one-time bundles and modules. ## Modules - [field-crypto](/marketplace/modules/field-crypto): One protected key per tenant, and ciphertext moved to another tenant fails to decrypt, provably. - [audit-worm](/marketplace/modules/audit-worm): An audit log that proves it wasn't edited: hash-chained entries, a write-once anchor per append, and an S3 Object-Lock store underneath. - [retention-runner](/marketplace/modules/retention-runner): One erasure request, every store, one audit row, even when a target fails. - [alerting](/marketplace/modules/alerting): Five deterministic stages between an event and a delivered alert, dedup, rate-cap, quiet hours, multi-channel send, one audit row. - [access-review](/marketplace/modules/access-review): A review campaign closes complete or at its deadline, and every missing decision stays visible as unresolved, never guessed into approval. - [risk-register](/marketplace/modules/risk-register): The residual is computed from likelihood and impact; an operator can override the judgment, but never rewrite the score that came before it. - [trust-page](/marketplace/modules/trust-page): A fact absent from the allowlist reaches neither HTML nor JSON, and the default page exposes aggregate posture without tenant or control detail. - [ai-meter](/marketplace/modules/ai-meter): Reserve a token estimate before the call, true it to actual usage after: a runaway prompt loop 402s on the next call instead of running your bill up. - [ai-evals](/marketplace/modules/ai-evals): Regression-grade evals that run in CI, not in prod. A model swap fails the build first, not a customer's session. - [guardrails](/marketplace/modules/guardrails): The chokepoint between your app and the model, moderate, redact, and block, fail-closed by default. - [prompt-registry](/marketplace/modules/prompt-registry): Prompts hardcoded three layers deep in a route handler, versioned like everything else that ships. - [local-store](/marketplace/modules/local-store): Hybrid vector + full-text search that runs on disk, in one SQLite file per tenant, nothing shipped to a vector cloud. - [agent-kernel](/marketplace/modules/agent-kernel): The guarded agent lifecycle FSM: VERIFY failing reopens PLAN, there's no edge to SHIP. - [agent-runner](/marketplace/modules/agent-runner): Spawn a headless coding agent with a scrubbed environment, an isolated worktree, and a transcript you can audit line by line. - [agent-trajectory](/marketplace/modules/agent-trajectory): Every step, tool proposal, approval, and dollar an agent run touches, appended once and replayed byte-identical, never a mutable log an incident review can't trust. - [tool-exec](/marketplace/modules/tool-exec): A default-deny allowlist maps every command an agent is allowed to run, call anything not on it, and NotFoundError refuses the call before a process ever spawns. - [org-controls](/marketplace/modules/org-controls): admin_write is a second Postgres role your buyer-facing tenant-isolation policy never matches, so your own operator control plane can write across every tenant without the app role ever gaining that reach. - [compliance-core](/marketplace/modules/compliance-core): generateEvidencePack won't produce a pack while any control's evidence is unresolved, what it does hand you is a byte-stable, SHA-256-verifiable ZIP. - [billing-orchestration](/marketplace/modules/billing-orchestration): One BillingProvider port normalizes Paddle, Stripe, LemonSqueezy, and Polar into one event stream, a subscription renewal grants credits exactly once, a mid-cycle charge never over-grants. - [ui-pro](/marketplace/modules/ui-pro): The interactive layer @caisson/ui doesn't ship, Tooltip, Popover, and Menu hand-rolled against zero Radix and zero @floating-ui, plus the data grid, hash-chain audit timeline, and diff viewer a real dashboard needs. - [local-inference](/marketplace/modules/local-inference): A hash-verified ONNX model runs inference on-device with zero egress by default, the hosted lane switches on only when you name its host in the privacy allowlist. - [local-privacy](/marketplace/modules/local-privacy): An empty allowlist blocks every outbound host by default, a request only egresses if a typed sink names the exact host and why. - [local-sync](/marketplace/modules/local-sync): Two replicas can merge in either order and land on the exact same result: a stale peer's edit can never resurrect a row a later delete already won. - [frameworks-pack](/marketplace/modules/frameworks-pack): A canonical control library where an `implements` claim without a linkable proof pointer fails to typecheck. - [oscal-spine](/marketplace/modules/oscal-spine): One package owns every OSCAL artifact, conformance fixture, and pinned NIST reference your compliance pipeline depends on. - [signing-primitive](/marketplace/modules/signing-primitive): Your evidence, signed under your own per-tenant Ed25519 key (never Caisson's) so any third party verifies it without touching your secrets. - [credits](/marketplace/modules/credits): debit() locks the wallet row, drains unexpired grants oldest-first, and 402s before a cent of paid work runs, the ledger only ever writes what actually happened. ## Glossary - [Glossary](/glossary): Definitions of the compliance, security, licensing, and AI-infrastructure terms Caisson ships against. - [WORM audit log](/glossary/worm-audit-log) - [Append-only audit log](/glossary/append-only-audit-log) - [Tamper-evident hash chain](/glossary/hash-chain-audit-trail) - [S3 Object Lock](/glossary/s3-object-lock) - [OSCAL](/glossary/oscal) - [Control-to-code mapping](/glossary/control-to-code-mapping) - [Audit evidence bundle](/glossary/audit-evidence-bundle) - [WORM retention policy](/glossary/worm-retention-policy) - [HIPAA technical safeguards](/glossary/hipaa-technical-safeguards) - [SOC 2 audit log](/glossary/soc2-audit-log) - [Row-Level Security (RLS)](/glossary/row-level-security) - [Token metering](/glossary/token-metering) - [Fail-closed](/glossary/fail-closed) - [Multi-tenant isolation](/glossary/multi-tenant-isolation) - [Field-level encryption](/glossary/field-level-encryption) - [Envelope encryption (DEK/KEK)](/glossary/envelope-encryption) - [Crypto-shredding](/glossary/crypto-shredding) - [BYOK (bring your own key)](/glossary/byok) - [Per-tenant key derivation (HKDF)](/glossary/per-tenant-encryption-keys) - [Offline license verification](/glossary/offline-license-verification) - [Ed25519 license keys](/glossary/ed25519-license-keys) - [Software entitlement](/glossary/software-entitlement) - [Credit-based billing](/glossary/credit-based-billing) - [Self-hosted npm registry](/glossary/self-hosted-npm-registry) - [LLM cost control](/glossary/llm-cost-control) - [AI spend circuit breaker](/glossary/ai-spend-circuit-breaker) - [LLM eval gate](/glossary/llm-eval-gate) - [AI guardrails](/glossary/ai-guardrails) - [Governed agents](/glossary/governed-agents) - [On-device vector search](/glossary/on-device-vector-search) - [Compliance-as-code](/glossary/compliance-as-code) - [MCP server (Model Context Protocol)](/glossary/mcp-server) - [WORM audit logs for SaaS](/glossary/worm-audit-logs-for-saas) - [OSCAL export from a TypeScript stack](/glossary/oscal-export-typescript) - [Multi-tenant RLS for compliance](/glossary/multi-tenant-rls-compliance) - [EU AI Act Article 50](/glossary/eu-ai-act-article-50) - [RFC 3161 timestamping](/glossary/rfc-3161-timestamping) - [Transparency log](/glossary/transparency-log) - [Evidence receipt](/glossary/evidence-receipt) - [Compliance crosswalk](/glossary/compliance-crosswalk) - [Signed audit anchor](/glossary/signed-audit-anchor) - [Agent trajectory](/glossary/agent-trajectory) - [Token hashing at rest](/glossary/token-hash-at-rest) - [Durable outbox](/glossary/durable-outbox) - [Idempotency key](/glossary/idempotency-key) - [Canonical JSON](/glossary/canonical-json) - [Additional authenticated data (AAD)](/glossary/additional-authenticated-data) - [PII redaction](/glossary/pii-redaction) - [Prompt injection](/glossary/prompt-injection) - [Deterministic replay](/glossary/deterministic-replay) ## Documentation - [Caisson documentation](/docs): Compliance-grade infrastructure for regulated SaaS, the manual. - [Getting started](/docs/getting-started): Install the base, wire a tenant, and run the standards gate. - **Base substrate** - Packages - [Base substrate](/docs/base): The sixteen Apache-2.0 packages every bundle sits on — kernel, auth, tenancy RLS, UI tokens, billing, jobs, email, AI config, the MCP server, registry-schema, observability, rate-limit, ds-manifest, and the generator tooling (cli, migrate, license-verify) — plus the commercial Platform tier. - [Auth](/docs/base/auth): Provider-agnostic session contract, an EdDSA-signed account JWT, and multi-user account membership over row-level security. - [Tenancy (RLS)](/docs/base/tenancy-rls): Fail-closed multi-tenant Postgres RLS. A query with no tenant context returns nothing. - [Billing](/docs/base/billing): Stripe, Paddle, LemonSqueezy, and Polar behind a BillingProvider port, with HMAC raw-body webhook verification. - [AI config](/docs/base/ai-config): Provider-agnostic AI configuration with agent-assisted setup. - [MCP server](/docs/base/mcp-server): The buyer-facing MCP server, auth-gated and entitlement-scoped. - [UI](/docs/base/ui): A typed token floor, --cs-* OKLCH tokens, one light and one dark theme. - [Jobs](/docs/base/jobs): A Trigger.dev job port with test drivers, billing and credit side-effects are enqueued, not inline. - [Email](/docs/base/email): A Resend email port with a test driver. - [Kernel](/docs/base/kernel): The typed CaissonError hierarchy, the credit-gate and tenancy-denial error shapes, and the one standards gate. - **Platform** - [Org controls](/docs/base/org-controls): WorkOS SSO sign-in, a Clerk session-verification driver, owner-gated multi-user membership, and the cross-tenant admin-write RLS layer the operator control plane mutates through. - [Billing orchestration](/docs/base/billing-orchestration): The multi-provider checkout drivers, provider-to-domain-event parsers, and dual-layer webhook idempotency composed on top of the open BillingProvider port. - [UI Pro](/docs/base/ui-pro): The commercial component tier on the open @caisson/ui token floor, an advanced data grid, virtualized tree, ops matrix, audit timeline, and more. - **Bundles** - Compliance - [Compliance](/docs/compliance): The compliance wedge, fail-closed evidence collection, an append-only WORM audit chain, per-tenant encryption, and a signed, OSCAL-exportable evidence pack mapped to named framework clauses. - [compliance-core](/docs/compliance/compliance-core): The compliance evidence engine, typed collectors, a deterministic byte-stable evidence pack that hard-blocks on any unresolved control, and OSCAL exports. - [frameworks-pack](/docs/compliance/frameworks-pack): Own-authored, clean-room control catalogs for SOC 2, HIPAA Security, and the EU AI Act, crosswalked to each framework's requirement ids. - [retention-runner](/docs/compliance/retention-runner): The CCPA/GDPR right-to-erasure runner, fans one subject's erasure across every registered store, isolates per-target failure, and writes one reason-tagged audit row. - [alerting](/docs/compliance/alerting): A five-stage alert-delivery pipeline (dedup, rate-cap-to-digest, IANA-timezone quiet hours, multi-channel send, one audit row) the SOC 2 CC7.2 control. - AI-Production - [AI-Production](/docs/ai-production): The production-rigor layer for AI features, token metering with spend caps, a CI eval gate, PII/moderation guardrails, and a versioned prompt registry. - [ai-meter](/docs/ai-production/ai-meter): PG-atomic reserve/reconcile token metering for LLM calls, per-tenant spend caps, a circuit breaker, and a MinHash dedup gate. Integer credits only, no floats. - [ai-evals](/docs/ai-production/ai-evals): A regression gate for prompt and model changes, defineEval() scores a dataset through a grader taxonomy, gateAgainstBaseline() fails the build on a real score drop, all offline and deterministic. - [guardrails](/docs/ai-production/guardrails): A fail-closed guard around every model call, PII redaction (mask, hash, or tokenize), a swappable moderator, and an unconditional secret-shape gate. - [prompt-registry](/docs/ai-production/prompt-registry): Append-only prompt versioning with name@version and name@alias addressing, a mutable alias pointer for zero-redeploy promotion, and injection-safe rendering. - [credits](/docs/ai-production/credits): An integer credit wallet with an append-only ledger and debit-before-spend, an empty balance fails closed, never a negative wallet. - Local-first - [Local-first](/docs/local-first): On-device inference and vector search behind a default-deny privacy gate, two-way offline sync, and per-tenant field encryption. Your data stays on-device by default. - [local-store](/docs/local-first/local-store): Hybrid vector + full-text retrieval that runs on disk, one SQLite file per tenant, sqlite-vec KNN fused with FTS5 by Reciprocal Rank Fusion, no vector cloud involved. - [local-sync](/docs/local-first/local-sync): Two-way offline sync for per-tenant SQLite files, a changeset log, a hybrid-logical-clock last-writer-wins merge, and tombstone-aware convergence. - [local-inference](/docs/local-first/local-inference): The InferenceBackend seam over a MiniLM-class ONNX model via transformers.js, SHA-256 hash-verified before use, on-device by default. - [local-privacy](/docs/local-first/local-privacy): A default-deny egress boundary every payload crosses before it can leave the process, a strict zero-egress PrivacyPolicy plus the EgressGuard runtime wrapper, with an empty allowlist blocking every host. - Agentic-Dev - [Agentic-Dev](/docs/agentic-dev): The governed-agent kernel plus sandboxed execution, typed agent/skill/rule schema, a seven-act lifecycle FSM, a default-deny tool-exec gate, and local hybrid memory. - [agent-kernel](/docs/agentic-dev/agent-kernel): The engine-neutral agent kernel, agent/skill/rule schema, seven-act lifecycle FSM, allow/deny/mutate governance, hooks dispatcher, and an opt-in tamper-evident audit chain. No vendor SDK, no LLM call. - [agent-runner](/docs/agentic-dev/agent-runner): Spawn a headless coding agent in an isolated worktree with a scrubbed, from-scratch env, zero secret leak by construction, an auditable .jsonl transcript, and a structured run report. - [tool-exec](/docs/agentic-dev/tool-exec): Governed tool-call / sandboxed-exec primitive, a default-deny command allowlist, Zod-strict argv validation, and execFile arg-arrays only, never a shell. - Provenance - [Provenance](/docs/provenance): Cryptographic provenance, detached signing over a canonical manifest, an append-only WORM audit chain, and per-tenant field encryption. Proof, not a promise. - [signing-primitive](/docs/provenance/signing-primitive): Per-tenant evidence signing, a detached Ed25519 signature over a canonical, chain-anchored manifest body, with an optional RFC-3161 trusted-timestamp countersignature and a fail-closed verify path. - [audit-worm](/docs/provenance/audit-worm): S3/GCS/R2 Object-Lock WORM storage plus an append-only SHA-256 audit chain and a derived-current locked-version table, evidence that cannot be altered before retention expires, and tampering that is provable. - [field-crypto](/docs/provenance/field-crypto): Per-tenant field encryption with wrapped random DEKs or self-hosted HKDF derivation, behind a pluggable FieldKeyProvider KMS port. - Everything - [Everything](/docs/everything): The full Caisson catalog, every bundle and every à-la-carte module, one purchase. - **Tooling** - create-caisson - [create-caisson](/docs/cli/create-caisson): Scaffold a tailored codebase from the versioned module registry, by hand, or driven by your AI agent through the auth-gated MCP server. - **Policies** - [Refund policy](/docs/refunds): The 14-day money-back guarantee, what qualifies, how to request a refund, and what happens to your license. - [Licensing, updates & renewals](/docs/licensing): What a one-time purchase gets you forever, how the 12-month updates window works, and what renewing costs.