01 · FRONTENDS
portal:3001 · static
admin:3003 · static
hostcloudflare pages
Portal + Admin
Next.js static exports — Portal and Admin — served from Cloudflare Pages. No server, nothing to patch.
Read the architecture§ 01 · The platformThe whole compliance stack,
The whole compliance stack,
built in the open.
Blackfyre maps your multi-cloud and on-prem posture to 9 compliance frameworks, stores tamper-evident evidence, and ships as source you run yourself. 55 auditors, 678 controls, one runtime — Apache-2.0.
What ships in the box
55
Auditors
9
Frameworks
678
Controls
Free
Apache-2.0
Built on
Next.jsFastifyPostgreSQL · RLSDrizzleAWS · SSTCloudflareClaude / Bedrock
§ 02 · Architecture
One request pipeline, end to end.
Static frontends talk to a Fastify API; the API writes to Postgres and enqueues work; Lambda workers drain the queues, run the scanners, and land tamper-evident evidence in S3.
02 · API
fastify 4:4000
every reqjwt · csrf
db handlerls-scoped
Fastify gateway
Fastify on :4000. Every request is JWT + CSRF authenticated and bound to an RLS-scoped database handle.
Read the architecture03 · DATA PLANE
postgres 16force rls
queues4 sqs + 4 dlq
adr0001 · 0002
Postgres · Redis · SQS
Postgres 16 with row-level security, Redis, and four SQS work queues — each paired with a dead-letter queue.
Read the architecture04 · WORKERS
drainsscan · monitor
+ ai+ evidence
deliveryat-least-once
Queue consumers
SQS-triggered Lambda workers drain the scan, monitor, AI and evidence queues — at-least-once and idempotent.
Read the architecture05 · SCANNERS
sdk auditors55 · in-proc
prowlercontainer λ
adr0003
Auditors + tools
Lightweight SDK auditors run in-process; Prowler and the IaC scanners (Checkov / Semgrep / Bandit) run as container Lambdas.
Read the architecture06 · EVIDENCE
s3 object lock✓ worm
sha-2569f2a…e71c
piiaes-256-gcm
S3 evidence vault
Artifacts land in S3 with Object Lock + versioning (WORM), a SHA-256 hash per item, and AES-256-GCM for PII.
Read the architectureLocally, the whole thing runs on docker-compose with LocalStack — no cloud account or API keys required. For production it deploys to your own AWS account via SST 4.13; that path is fully documented but is not yet a hosted, managed service.
§ 03 · Capabilities
Every posture signal, one runtime.
Scanning, framework mapping, AI analysis, evidence, drift, tenancy, auth and durable background work — each built to what an external auditor would demand.
Multi-cloud scanning
55 auditors across AWS, Azure, GCP and on-prem, plus Prowler and the IaC scanners Checkov, Semgrep and Bandit.
Framework mapping
Every finding maps to the controls it affects across 9 frameworks, with weighted per-framework scoring.
AI-assisted analysis
Gap analysis, MITRE ATT&CK mapping and remediation via Claude or Bedrock — degrades to deterministic heuristics with no key.
Tamper-evident evidence
SHA-256 per item, S3 Object Lock + versioning (WORM), and AES-256-GCM field encryption for PII.
Real-time drift
Continuous drift detection catches regressions after a passing scan; live scan progress streams over Server-Sent Events.
Database-enforced tenancy
Postgres 16 row-level security below the ORM, request-scoped and fails closed (ADR-0001).
Enterprise auth
JWT + MFA, Google SSO, SAML, SCIM, Argon2id API keys, auditor-scoped roles and CSRF double-submit.
Durable scanning
Scan, monitor, AI and evidence each get an SQS queue plus a DLQ, drained by idempotent Lambda workers (ADR-0002 / 0003).
§ Frameworks
Every framework you're accountable to.
9 frameworks · 678 controls. A single finding maps to the controls it affects across every one, each scored on its own weighted terms.
SOC 215 controls
SOC 2 Type II (AICPA TSC 2017)
AICPA Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) for service-org controls.
View mappingISO 2700193 controls
ISO/IEC 27001:2022
International ISMS standard; Annex A information-security controls across organizational, people, physical, and technological themes.
HIPAA113 controls
HIPAA Security Rule (45 CFR Part 164)
US healthcare rule protecting electronic PHI via administrative, physical, and technical safeguards.
View mappingGDPR99 controls
General Data Protection Regulation (EU 2016/679)
EU regulation governing personal-data processing, data-subject rights, breach notification, and cross-border transfers.
PCI DSS14 controls
PCI DSS v4.0
Payment Card Industry Data Security Standard for protecting cardholder / account data.
DPDPA8 controls
India Digital Personal Data Protection Act, 2023
India's personal-data law setting data-fiduciary security, breach, retention, and consent obligations.
ISO 4200122 controls
ISO/IEC 42001:2023
AI management-system standard covering AI governance, risk, lifecycle, transparency, fairness, and human oversight.
View mappingPDPPL16 controls
Qatar Personal Data Privacy Protection Law (Law No. 13 of 2016)
Qatar's personal-data law covering lawful processing, consent, security safeguards, and cross-border/localization rules.
NIST 800-53298 controls
NIST SP 800-53 Rev 5
US federal security & privacy control catalog across 20 control families (AC, AU, SC, SI, etc.).
View mapping§ 04 · Auth & security
A security model auditors recognize.
Identity, tenancy and least-privilege access aren't add-ons — they're wired through every request, every queue and every scan.
Found a vulnerability? Blackfyre runs a private disclosure process — see SECURITY.md.
JWT + MFA sessions
Signed with jose; MFA on top of password login.
Google SSO · SAML · SCIM
Federated login and directory-driven provisioning.
API keys (Argon2id)
Programmatic access; keys hashed with Argon2id at rest.
Auditor-scoped roles
owner / admin / engineer / viewer / auditor.
Database-enforced RLS
Row-level security below the ORM; fails closed (ADR-0001).
CSRF double-submit
Every state-changing request is CSRF-protected.
Read-only scan access
Cross-account IAM role is read-only, least-privilege — no write keys.
Minimum-data collection
Scanners collect posture data only — never PII or customer records.
Found a vulnerability? Blackfyre runs a private disclosure process — see SECURITY.md.
§ Get the source
Read the code. Run it yourself.
Blackfyre is Apache-2.0 — clone it, self-host it, and audit every line. The full stack runs locally on Docker Compose with no cloud account or API keys. No sales call required.