SOC 2 Compliance Center
In progressAn internal SOC 2 compliance platform — a lightweight Vanta/Drata alternative with a controls explorer, versioned evidence, and scheduled reviews.
- #security
- #compliance
- #nextjs
- #supabase
A full compliance management webapp built as a lightweight alternative to Vanta or Drata: a SOC 2 controls explorer organized by Trust Services Category, versioned evidence collection, an application inventory, a policy register, and scheduled compliance reviews with Slack reminders.
The interesting part is the evidence model. Evidence is append-only by design — corrections are new versions, withdrawals require a recorded reason, and nothing is ever rewritten or hard-deleted. That guarantee is enforced in the database itself (Row Level Security on every table, plus guard triggers that hold even for privileged roles), not just in the UI, so the audit trail can’t be sidestepped.
Built with Next.js, Supabase Postgres, and Google Workspace SSO (no password path exists, on purpose), deployed on Vercel. The framework layer — all 38 Trust Services Criteria, 18 control categories, and a 43-control library — is written to be re-deployable at any company, with the tenant-specific pieces documented and isolated. Deployed and in use for a real fintech SOC 2 program; the reminder cron and dashboard are the last pieces in flight.