The architecture-not-policy compliance engine for GDPR, the EU AI Act, and DORA. Verify your audit trails, automate DSARs, and stream enterprise telemetry — without ever storing raw personal data.
Live calls against the production engine. Nothing is persisted.
Run the check to see the redacted payload.
Every capability below is live on the production engine.
| Capability | Status |
|---|---|
PII redaction | Operational |
GDPR erasure | Operational |
Compliance assessment | Operational |
Signed trust badge | Operational |
Audit report | API access |
Every gate is enforced in the API itself — the same matrix below is what the engine checks. No hidden tiers, no unlisted features, no surprises.
| Feature / Capability | Free €0 Indie hackers & evaluators | Pro €79/mo Early-stage B2B SaaS | Growth €299/mo Scaling B2B startups | Enterprise €1,499+/mo Regulated enterprises |
|---|---|---|---|---|
| Core PII sanitization & assessment | Rate-limited | Included | Included | Included |
| Audit log retention window | 30 days | 1 year | 1 year | 7 years |
| Autonomous DSAR portal & mailbox token | — | |||
| RoPA, consent cascades & trust badges | — | |||
| AI model registry (EU AI Act) | — | — | ||
| GitHub vendor risk discovery | — | — | ||
| Incident ledgers & PDF export packages | — | — | ||
| Real-time SIEM webhooks (HMAC-signed) | — | — | — | |
| Dedicated EU routing & erasure certificates | — | — | — |
Enforced server-side via feature flags on every tenant-scoped route — a blocked call returns 403 feature_not_in_tier, not a sales pitch.
We throttle gracefully — you get a clear 429 with a retry window. We never surprise you with runaway overage bills or hold your data hostage.
Zero. Everything is self-serve. You only talk to us if you need custom enterprise routing or a dedicated SLA contract.
100% in Frankfurt (europe-west1), with zero replication outside Europe. Raw PII is inspected ephemerally in-memory and never touches a disk.
Payloads are inspected during the request and discarded. Nothing is written to a database, a file, or a log — ever.
Timestamps, payload sizes, pass/fail verdicts, call counts. Metadata — never content.
Processing is transient and in-memory only — no personal data exists at rest on our side, so there is nothing to subpoena, breach, or govern.
Every assessment produces an HMAC-signed badge. Cryptographic proof beats a PDF policy.
Custom SMTP relays, webhook signing secrets, any integration credential — held to the identical sovereign, encrypted-at-rest, zero-echo standard as the compliance data itself.
Credentials are AES-256-GCM envelope-encrypted in the application layer — the regional database stores ciphertext only. The key-encryption key lives in Secret Manager; the runtime service account is read-only.
Stored secrets are never returned by any API response and never rendered in any UI — there is no "show password" path to exploit. Rotation is a re-write, not a read.
Configs live inside your tenant's regional Firestore partition — and every change is hash-chained into the same tamper-evident audit vault that proves your compliance history.
A zero-dependency, open-source GitHub Action that scans a deployed preview URL against the sovereign engine. Composite, auditable end-to-end, and free to fork.
The reusable composite action — action.yml plus a single Node 20 script (verify.mjs) on built-in fetch. Read the whole thing in five minutes.
A working consumer repository: GitHub Pages deploy plus compliance-test.yml — copy it verbatim into your own workflow.
The action audits a deployed preview or staging URL — source code never leaves your CI runner. Only abstract findings cross the wire.
One zero-dependency Node 20 script using built-in fetch. No vendored packages, no compiled dist bundle — every line reviewable.
Builds fail strictly on unequivocal WCAG 2.2 Level A defects. Warnings and manual-review items land as a Markdown PR comment — never a surprise red build.
Portal → API Keys → assess + read permissions. A demo-tier key works for evaluation.
COMPLIANCE_API_KEY and COMPLIANCE_TENANT_ID under repository Settings → Secrets.
Point target-url at your preview deployment. Advisories comment on the PR; Level A defects block the merge.
- uses: Terrygilligan/compliance-audit-verify-action@v1
with:
api-key: ${{ secrets.COMPLIANCE_API_KEY }}
tenant-id: ${{ secrets.COMPLIANCE_TENANT_ID }}
target-url: 'https://your-preview-deploy.example.com'
fail-on: 'level-a'A cmp_demo_* key with read and assess permissions, valid 30 days. Run real assessments, open your dashboard, embed a signed badge.