Skip to content
Open source · Apache-2.0

Compliance posture,
continuously proven.

Blackfyre scans AWS, Azure, GCP and on-prem against 678 controls across 9 frameworks with 55 auditors, then maps every finding to the controls it affects. Self-host it free.

Star on GitHubQuickstart

What ships in the box

55

Auditors

9

Frameworks

678

Controls

Free

Apache-2.0

Multi-cloud scanning

Scan every layer of AWS, Azure & GCP.

AI, with a floor

Claude/Bedrock analysis, heuristic fallback.

Tamper-evident evidence

Evidence an auditor can trust.

Database-enforced tenancy

Isolation enforced by the database.

Free forever · self-host

Run the whole platform on your own infrastructure.

Read the docsStar on GitHub

Built on

Next.jsFastifyPostgreSQL · RLSDrizzleAWS · SSTCloudflareClaude / Bedrock
Coverage

Scan everything. Prove anything.

One open-source codebase covers the whole estate — cloud, containers, identity, network and on-prem — and turns every finding into framework-mapped, audit-ready posture.

  • Read-only by design

    Cross-account IAM role, no write keys — least privilege, minimum data.

  • Graceful degradation

    Every AI feature falls back to deterministic heuristics with no key set.

  • Serious multi-tenancy

    Postgres RLS below the ORM, request-scoped, fails closed (ADR-0001).

Browse all 55 auditors
SCANNING
aws✓ 15 auditors
azure✓ 11 auditors
gcp✓ 10 auditors
on-prem✓ AD · SNMP

Multi-cloud scanning

55 auditors across AWS, Azure, GCP and on-prem — plus Prowler & IaC scanners.

View source
ANALYSIS
gap analysisclaude / bedrock
mitre att&ckmapped
no api key→ heuristics

AI, with a floor

Gap analysis & remediation via Claude or Bedrock — degrades to deterministic heuristics with no key.

View source
EVIDENCE
sha-2569f2a…e71c
s3 object lock✓ WORM
piiaes-256-gcm

Tamper-evident evidence

SHA-256 integrity per item, S3 Object Lock + versioning, AES-256-GCM for PII.

View source
MULTI-TENANCY
postgres 16FORCE RLS
tenant bindper-request
on breachfails closed

Database-enforced tenancy

Postgres row-level security below the ORM, request-scoped and fails closed.

View source
How it works

From scan to audit-ready evidence.

The same pipeline that scores your posture also produces the artifacts an auditor asks for — no spreadsheet reconciliation.

  1. 01 · Connect a read-only role

    A cross-account IAM role — read-only, no write keys. Blackfyre never mutates your infrastructure.

  2. 02 · 55 auditors scan

    SDK auditors run in-process; Prowler and IaC scanners run as containers. Every cloud, every layer.

  3. 03 · Findings map to 678 controls

    Each finding is mapped to the controls it affects across 9 frameworks, with weighted per-framework scoring.

  4. 04 · AI + heuristics remediate

    Gap analysis, MITRE ATT&CK mapping, and remediation steps — or deterministic heuristics when no key is set.

  5. 05 · Tamper-evident evidence

    Every artifact lands in a SHA-256 chain on Object-Lock storage — audit-ready, hand it to an assessor.

9 frameworks · 678 controls · four shown

15

controls

SOC 2

SOC 2 Type II (AICPA TSC 2017)

AICPA Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) for service-org controls.

Controls

15

Scoring

Weighted

Evidence

Mapped

See framework

113

controls

HIPAA

HIPAA Security Rule (45 CFR Part 164)

US healthcare rule protecting electronic PHI via administrative, physical, and technical safeguards.

Controls

113

Scoring

Weighted

Evidence

Mapped

See framework

22

controls

ISO 42001

ISO/IEC 42001:2023

AI management-system standard covering AI governance, risk, lifecycle, transparency, fairness, and human oversight.

Controls

22

Scoring

Weighted

Evidence

Mapped

See framework

298

controls

NIST 800-53

NIST SP 800-53 Rev 5

US federal security & privacy control catalog across 20 control families (AC, AU, SC, SI, etc.).

Controls

298

Scoring

Weighted

Evidence

Mapped

See framework
Get started

Clone. Compose. Done.

The full stack runs locally on Docker Compose — no cloud account or API keys. Up and evaluating in about fifteen minutes.

§ 01 · QUICKSTART

Clone. Compose. Done.

Spin up the full stack — API, portal and admin — locally in one clone. Free, offline, and evaluation-ready in about fifteen minutes.

  • No cloud account or API keys needed
  • Postgres, Redis and LocalStack via Docker Compose
  • Seeded dev login: admin@acme.com / password123
Self-hosting guide
bash — local eval
# Full local stack — no cloud account or API keys needed.
$ git clone https://github.com/blackfyre-security/blackfyre.git
$ cd blackfyre/platform
$ docker compose up -d postgres redis localstack
$ npm install && npm run build
$ cp packages/api/.env.example packages/api/.env   # edit per the local-dev guide
$ npm run db:migrate && npm run dev                # API on :4000

# Then in two more terminals:
$ NEXT_PUBLIC_API_URL=http://localhost:4000 npm run dev --workspace=packages/portal   # :3001
$ NEXT_PUBLIC_API_URL=http://localhost:4000 npm run dev --workspace=packages/admin    # :3003

# Log in at http://localhost:3001 — seeded dev user admin@acme.com / password123
Star on GitHubSelf-hosting guide