Enforcer checks how your cloud is really configured against ISO 27001 every day — read-only — and keeps a dated, hash-verified record of every result. When a bank asks how you control access, you export the answer instead of assembling it. It runs alongside the compliance tool you already have.
I spent years working inside banking environments. Access was shared like candy: credentials passed around, permissions granted “temporarily” and never revoked, one person able to approve their own work.
Every one of those environments had a compliance tool. Every one of them passed.
The tools were not lying. They were reading policy documents and HR records, and the policy documents were fine. Nobody was looking at what the infrastructure was actually doing.
I built Enforcer to look.
Every check produces one row. Every export bundles those rows with a manifest that hashes every file in the pack. Most compliance tools describe their evidence. Here is ours — read it, download it, and recompute the hashes yourself.
A SHA-256 for every file in the pack, plus the database-side hash of each evidence record.
{
"counts": {
"control_evaluations": 8,
"evidence_records": 5,
"report_artifacts": 1
},
"evidence_integrity": [
{
"hash_sha256": "d0efcbaa5bdb168a6ee4cdae34bdf1f1b775d5964ff1cf72a15eb8e8ea343476",
"id": "ev_5a0d6e92_bpa"
},
{
"hash_sha256": "332acd2c1fbfd747fd3a718754180430b92c2e0965eb29999250d7e34d9e4d6e",
"id": "ev_7f21a4c0_admin"
},
{
"hash_sha256": "f6b76384ccb0f35d38c5438dea64b20061f492f5edf55b5fba5349da0c72e312",
"id": "ev_c93f10ab_key"
},
{
"hash_sha256": "357e43765be1d86d32238a2815c2e245635a7e1ba9028ab7a71f637ffb96da69",
"id": "ev_1b8e33d5_crb"
},
{
"hash_sha256": "400ccd472686c77f69555c40cae9a12ea87c72b1e048f4d3d614e0991750ce07",
"id": "ev_9e6c07f4_enc"
}
],
"files": [
{
"bytes": 1475,
"path": "controls/control_matrix.csv",
"sha256": "32f6f1e44d10858578fade69a6efff3b51a68f690665d0d14906f50fafe211e4"
},
{
"bytes": 5299,
"path": "controls/control_matrix.json",
"sha256": "8f58845222c5267d2ac34e46a6a05af6e13e0ca6f82f6c351fa1f0e95027470a"
},
{
"bytes": 588,
"path": "evidence/ev_1b8e33d5_crb.json",
"sha256": "223d355bdc09b219966e68bad4f8779ee8c0731fb13f177fa22a486960a384f5"
},
{
"bytes": 629,
"path": "evidence/ev_5a0d6e92_bpa.json",
"sha256": "5beba4f9151ebfb4ec1bcab34e1b21a84c2980f7abbfa366864c705494c190a7"
},
{
"bytes": 545,
"path": "evidence/ev_7f21a4c0_admin.json",
"sha256": "0a91cfbbc5e46df0b8c9f30265621444de5cf706601f0d5a169c9c8fee0ad80e"
},
{
"bytes": 612,
"path": "evidence/ev_9e6c07f4_enc.json",
"sha256": "66d5adace8076bd95fe8b0d9cd43accffe894d028bc1481a7416c53a0862b362"
},
{
"bytes": 465,
"path": "evidence/ev_c93f10ab_key.json",
"sha256": "8ceaedcd16c60df56297259968fb7489eb2692db43c21472c5d39625b2f3b375"
},
{
"bytes": 492,
"path": "report/sample-report.html",
"sha256": "ae16de72efa0dd53d08e5fa63487fdbb8c87cb19466636c8c6138339d277d459"
}
],
"generated_at": "2026-07-10T12:52:15.030863+00:00",
"pack_format_version": "1.0",
"report": {
"created_at": "2026-07-09T02:15:00+00:00",
"environment_name": "acme-payments-prod",
"id": "rpt_sample_0001",
"standard_id": "std_iso27001_2022",
"standard_name": "ISO/IEC 27001 2022",
"status": "COMPLETED"
},
"score_summary": {
"compliance_score": 50.0,
"controls_assessed": 8,
"error_controls": 0,
"failing_controls": 4,
"passing_controls": 4,
"unevaluated_controls": 85
}
}Nothing here needs our word. Download the pack, hash any file in it, and compare againstmanifest.json.
$ unzip enforcer-sample-evidence-pack.zip
$ shasum -a 256 evidence/ev_5a0d6e92_bpa.json
5beba4f9151ebfb4ec1bcab34e1b21a84c2980f7abbfa366864c705494c190a7The pack itself hashes to ce40e958d50efa7b01dead2006d07f77d848438e24bac668e4537ae39a597fbe.
A real pack, built by the same function that builds a customer's, from a synthetic environment. The account, buckets and people are invented. The format and every hash are real.
Private beta. The founder answers every message himself.
If you sell to banks, you have to prove your systems are set up safely — and keep proving it. Enforcer connects to your cloud with read-only access, checks how it is really configured every day, and keeps a dated record of what it found. When something changes for the worse — a database opened to the internet, a contractor holding more access than they should — it notices that day and writes it down.
Not goals or projections. These are the checks Enforcer runs against your systems today, every day. Every number below links to what it counts.
Other tools list twenty standards and check each one shallowly. We would rather cover ISO 27001 all the way down to the individual server — and add standards when customers ask for them, not to fill a sales slide.
133 checks run every day across 32 kinds of AWS resource and 13 kinds of Kubernetes resource, answering 25 of the standard's requirements. Who has access, what is exposed to the internet, what is encrypted, what is logged — answered for each individual server and account, not on a form.
Not built yet, and we will not pretend otherwise. ISO 27001 is the only standard Enforcer checks against today. The underlying engine does not care which standard it is given, so adding SOC 2 means writing the mapping, not rebuilding the product. We build it when the companies we work with tell us it is what is blocking them.
When a bank reviews you as a supplier, it asks who can touch what, and how you know. Those are the same questions ISO 27001 asks — so the record Enforcer already keeps answers the review. No separate project.
Enforcer ships with every check in monitor-only mode. Out of the box it cannot change anything in your account. Two independent things must happen first, and neither one is a default.
A check fails. Enforcer records the resource, the rule, and the time.
The check must be switched out of monitor-only mode. All 133 ship in monitor-only.
A named human approves this specific fix. There is no default-approve.
Only now does anything change. Finding, approval and fix are stored as one record.
24 of the 133 checks have a fix Enforcer knows how to apply. The rest it reports and leaves alone. Nothing here runs on its own, and nothing about it is a guess.
Your auditor asks about separation of duties once a year. Your infrastructure answers the question every day. Enforcer writes the answer down.
Shared logins, accounts with far more power than the job needs, one person able to approve their own work. Found the day it happens, not at next year’s audit.
Each record names the exact server or account, what was checked, what it read, and when — and carries a SHA-256 you can recompute. Not a photograph taken whenever your old tool last checked in.
Keep Vanta or Drata for policy documents, training, and HR records. Enforcer covers what they cannot see, inside your cloud. Nothing to migrate, nothing to rip out.
Most compliance tools treat Kubernetes as one box to tick. Enforcer checks access rules, network isolation, and resource limits inside your clusters, and rolls them up next to your AWS results under the same control.
Including the ones with answers we would rather not have to give.
We are recruiting a small cohort — compliance leads and security engineers at companies that answer to banks and their auditors. You get a discounted first year and a direct line to the founder. In exchange, you tell us what your assessor actually asks you for, and we shape the evidence pack around it before the format is frozen.
No card. No SaaS backend. The founder answers every message himself.