Case Study
ComplianceMachine.ai
GRC SaaS PlatformA production GRC SaaS platform that replaced spreadsheets and email chains with one multi-tenant system of record - 7 compliance modules, multi-framework support, automated escalations, and a full audit trail. Live at compliancemachine.ai.
The challenge
Compliance teams preparing for ISO 27001, SOC 2, HIPAA, and regional regulations were running the process across spreadsheets, shared drives, and email. Risk registers drifted out of date. Control owners got assigned in Slack and forgotten. Policy acknowledgements lived in inboxes. Audit evidence was scattered. Leadership had no real-time view of compliance posture, and auditors could not get a clean trail without a multi-week scramble.
Kinverg needed a cloud GRC product that could systematize the entire compliance lifecycle - assets, risks, controls, frameworks, policies, audits, and events - and ship as a multi-tenant SaaS within a fixed 90-day window. The platform had to be audit-ready on day one: company-scoped data, role-based permissions, soft-delete history, and automated notifications when work slipped.
What we built
A complete multi-tenant GRC platform on Python and Django with 7 integrated modules, a cross-entity linking graph, 17 SES email workflows, cron-driven status transitions, charts and exports per module, and production deployment on AWS. Every record is company-scoped and permission-gated.
Compliance Management
Map requirements to authority documents and frameworks. Track status as Fully Met, Partially Met, Not Met, or No Controls Mapped. Requirement-to-control mapping with compliance scoring so teams see posture by framework, not by spreadsheet row.
Risk Management
Full risk register with probability x impact (1-5), inherent vs residual ratings, heat map visualization, and response tracking (Accept, Mitigate, Avoid, Transfer). Risks link to assets, controls, policies, audits, and events. CEO-level acceptance notifications via SES.
Control Management
Management, Operational, and Technical controls with readiness states (Ready, In Progress, Not Ready). Controls link to compliance requirements, risks, assets, policies, audits, and evidence. ISO 27001 default controls seeded from the official authority document on launch.
Asset Management
Physical and virtual asset inventory with CIA+Privacy ratings (Confidentiality, Integrity, Availability, Privacy) on a 1-5 scale. Category-based classification, asset owner and control owner assignment, and mapping into risks, controls, audits, and events.
Audit Management
4-stage audit workflow: Created, Planned, In Progress, Completed. Audit teams, scope, and employee assignment. Mapped to controls, assets, policies, risks, and compliance requirements. Evidence attachment, completion reporting, and non-compliance flagging.
Event Management
6-stage event lifecycle: Created, Planned, In Progress, Completed, Incomplete, Verified and Closed. Priority scoring, response plans, planned completion tracking, and automated escalation when completion dates elapse. Events cascade readiness updates into linked controls and compliance.
Policy Management
Versioned policy lifecycle with approval workflow (draft, sent for approval, approved, rejected). Acknowledgement tracking with reminder emails. Policies link to controls, assets, risks, and audits. PDF export and evidence mapping for audit packages.
How we delivered it
Fixed scope, weekly demos, and a production path from week one. Staging and production environments ran on the same Docker + Nginx + RDS stack so there was no late "deploy surprise."
Domain model first
We modeled companies, users, assets, risks, controls, compliance requirements, policies, audits, and events as first-class entities with soft-delete and through-table relationships. That graph is what lets one risk surface in an audit, affect a compliance score, and trigger an event without duplicate data entry.
RBAC and multi-tenant isolation
Every query is company-scoped. Custom Django permissions per module (heat maps, compliance scores, policy approvals) are assigned by group. Single-session middleware blocks concurrent logins so shared admin accounts cannot bypass accountability.
Workflow automation, not just CRUD
17 AWS SES templates cover owner assignment, policy approval and rejection, acknowledgement reminders, risk acceptance, audit plan creation, and overdue event escalations. A Django Cron job runs every minute to move Planned events and audits to In Progress when start dates arrive, then cascades control readiness and compliance status.
Seeded frameworks and reports
Management commands seed ISO 27001 authority documents, default controls, risk levels, policy/evidence templates, and role groups. Chart modules produce heat maps, readiness breakdowns, audit team reports, and acknowledgement rates. PDF and Excel exports ship with each module for auditor handoff.
Production on AWS
Dockerized Django with Gunicorn behind Nginx on EC2, PostgreSQL on RDS (db.t4g.micro), static assets and media on S3, transactional email via SES, SSL via Let's Encrypt. Deploy path: collectstatic, S3 upload, migrate, reload. Separate staging and production from week one.
Technical architecture
Built as a Django monolith with a clear module boundary so compliance data has one system of record instead of five tools that disagree.
- Backend: Python, Django 4.2, PostgreSQL, django-cron, django-storages, reportlab, openpyxl/xlsxwriter, pandas
- Admin and UX: Django Jazzmin admin with custom permission screens, policy review views, and acknowledgement workflows
- Notifications: boto3 + AWS SES with version-controlled JSON templates in the repo
- Files: S3-backed media for evidence, attachments, and policy documents (up to 300MB via Nginx)
- Ops: Docker Compose, Gunicorn, Nginx, Let's Encrypt, RDS Postgres, staged seed/migrate pipeline
- Quality: Model-level test suite covering assets, audits, controls, compliance, policies, risks, and company isolation
Results
Days from idea to production
GRC modules shipped
Automated SES email workflows
27001 controls seeded on launch
Audit trail and soft-delete history
Spreadsheets needed post-launch
ComplianceMachine.ai is live as a multi-framework compliance product supporting ISO 27001, SOC 2, HIPAA, GDPR, and regional frameworks - with a built-in control library, audit-ready policies, and leadership dashboards. Customers use it to simplify ISO and CMMI journeys without rebuilding process in email.
Related services
Want results like this?
Book a free 30-minute strategy call. We will scope your product, define success metrics, and give you a clear 90-day plan. No obligation.