Ctrl+Alt+Comply
A self-hosted compliance management platform that unifies the regulatory frameworks a modern regulated business actually has to deal with — HIPAA, GDPR, ISO 9001, ISO 13485, ISO 27001, ISO 42001, NIST, 21 CFR Part 11, the EU AI Act, and more — into one workspace.
Compliance work is a patchwork.
A modern healthcare-AI startup ends up touching HIPAA, GDPR, ISO 9001, ISO 13485, ISO 27001, ISO 42001, and the EU AI Act simultaneously. But every existing tool either covers one framework deeply or all of them shallowly.
Teams duplicate effort because they can't see that ISO 27001 A.5.1, ISO 9001 §7.5, NIST 800-53 AC-1, and HIPAA §164.308(a)(2) are all asking for the same controlled document. Auditors arrive and find the evidence scattered across SharePoint, Notion, and someone's email thread. The commercial GRC suites that solve this start at $50K/year — pricing most small-to-midsize regulated companies out of the conversation entirely.
Ctrl+Alt+Comply was built to close that gap: one workspace, every framework, audit-ready output — at a cost a single team can stomach.
Topic-first, not framework-first.
Most compliance tools organize their requirement library by framework — a HIPAA section, an ISO section, a NIST section. Users navigate to the framework they're being audited against and work top-down through its requirements.
Ctrl+Alt+Comply inverts this. Requirements are grouped by what they actually ask for — access control, breach notification, training records, audit trails, change management — with the relevant framework controls stacked underneath each topic. Open the "Audit Trails & Logging" topic and you see the 21 CFR Part 11, ISO 27002, NIST 800-53, and HIPAA requirements side-by-side.
The practical result: one policy satisfies eight controls. Teams stop writing the same access control standard four different ways for four different audits.
Eight modules, one workspace.
Each module addresses a specific point in the compliance lifecycle — discovery, mapping, planning, audit, evidence, and ongoing reference — without forcing teams to switch tools to switch tasks.
Compliance Explorer
Browse 40+ frameworks and ~2,000 requirements by topic or by framework. Every requirement carries a plain-language "What this means" explanation plus a numbered "Examples of acceptable evidence" checklist — so non-lawyers can actually use it.
Overlap Matrix
Visualize where requirements overlap across frameworks. See at a glance that one access-control policy can satisfy eight different controls — write the policy once, map it once, reuse forever.
Compliance Roadmap
Phase your adoption across five canonical phases — Strategic Foundation through Continuous Improvement — with topic-to-phase mapping built in. Visualize a realistic 12–24 month implementation timeline.
Audit Manager
Create scoped audits by framework or topic. Track per-requirement findings (Compliant / Partial / Non-Compliant / N/A), attach evidence references, manage CAPAs, and generate executive summaries.
Document Management System
Controlled lifecycle for SOPs, policies, work instructions, and forms — create, route for approval, assign required readers and training, capture electronic signatures (21 CFR Part 11), and audit every action. The Document Checker gap-analysis tool sits inside this module, letting you upload any document and assess it against any framework, offline or AI-powered via Claude.
DSAR Workbench
Intake, identity verification, and exemption handling for GDPR, CCPA, HIPAA, and DPDPA right-of-access flows. Built-in SLA tracking (including HIPAA's 30-day clock).
"Ask Lombardo"
Claude-powered chat assistant grounded in the platform's own requirement library — not the open internet. Answers cite the controls they reference. Knowledge base + FAQ live alongside.
Administration & Security
Role-based permissions, TOTP MFA, full audit log, AES-256-GCM encryption at rest, and AI usage cost tracking. Built on the same security primitives an auditor would expect to see.
Regulation made scannable.
The visual centerpiece of the product: every requirement is rendered as a risk-coded header plus two stacked context boxes — one explaining the regulation in plain English, one listing what evidence actually satisfies it. The pattern below repeats across Explorer, Audit Manager, and Roadmap views.
- A current risk assessment report dated within the last 12 months
- Asset inventory identifying all systems that process ePHI
- Threat & vulnerability catalog with severity ratings
- Risk register with named owners and treatment decisions
- Management review minutes documenting risk acceptance
Why this pattern matters.
Regulatory text is dense, lawyerly, and written for lawyers. Most compliance tools display it verbatim and leave interpretation to the user — which is fine if the user is general counsel, and useless if the user is the QA lead, the security engineer, or the founder doing their first audit.
Ctrl+Alt+Comply does the translation work upfront. Every one of the ~2,000 requirements in the library carries both layers: the legal text, the plain-language explanation, and the evidence checklist. The same pattern shows up in Audit Manager during an actual audit, so the explanation a team learned from while preparing is the same one they reference when their auditor asks the question.
- Risk badges as content, not chrome. CRITICAL / MAJOR / MINOR ratings sit inline with every requirement ID, persisting across every view in the app. Audit prioritization becomes a visual decision.
- Color tokens with consistent semantics. Blue = explanation. Green = evidence. Red / orange / green = risk. Users learn the visual vocabulary once.
- Inline expansion, not page navigation. Accordion rows let auditors scan, dive in, and collapse without losing context. Especially useful during walk-throughs.
- Neomorphic design system. Hand-rolled CSS custom properties — no Tailwind, no shadcn, no Material. Closer to a premium desktop app than a typical SaaS dashboard.
Selected screens.
A walkthrough of the live application — from the neomorphic sign-in screen through the dashboard, framework browsing, audit workflow, knowledge base, roadmap, document control, audit log, security administration, framework data ingestion, AI usage telemetry, and the DSAR privacy workflow. Captured directly from the running production deployment on AWS.
Built on familiar primitives.
Deliberately boring stack choices — proven libraries, single-process simplicity, and one Docker image to deploy. The fancy part is in the regulatory content, not the framework gymnastics.
One engineer plus Claude Code.
Ctrl+Alt+Comply was built in collaboration with Claude Code — Anthropic's CLI agent — not as a vibe-coded prototype, but as a real engineering partnership across the full stack.
Production Code
Wrote and refactored server routes, React pages, and the SQLite schema layer. Every diff was human-reviewed before merge. Architecture decisions stayed with the engineer.
Requirement Library
Plain-language explanations and evidence checklists for ~2,000 requirements across 40+ frameworks. Drafted by Claude, human-reviewed — months of legal writing that would have made this project unviable solo.
The Unglamorous Work
Idempotent database migrations. Encryption-at-rest plumbing. OCR-aware audit trail. Federated topic mappings. The infrastructure that ships products but never appears in demos.
Inside the Product, Too
"Ask Lombardo" and Document Checker call Claude Sonnet 4.5 via AWS Bedrock with prompt caching. The same model that helped build the platform is also the one users interact with at runtime.
Shipped, and what's next.
Shipped
Live on AWS, deployed via Watchtower auto-rollouts, used in production.
- 40+ regulatory frameworks; ~2,000 requirements with plain-language explanations + evidence examples
- Audit workflow with CAPA tracking and executive-summary generation
- "Ask Lombardo" AI chat, Document Checker, Overlap Matrix, Compliance Roadmap
- DSAR workbench (HIPAA, GDPR, CCPA, India DPDPA, Australian APP)
- MFA, encryption at rest, audit logging, role-based permissions
- Deployed on AWS with auto-HTTPS and auto-deploy via Watchtower
In Flight
What's currently being built or staged for the next release wave.
- Multi-tenant SaaS mode (currently single-tenant self-hosted)
- Evidence vault — direct upload + linkage of evidence artifacts to audit findings
- Continuous control monitoring — connectors to AWS Config, Okta, GitHub for automated evidence collection
- Customer-facing audit report export (branded PDF)
- Additional frameworks: SOC 2, PCI-DSS 4.0, HITRUST, TISAX