CertMoat

The business problem

Small regulated businesses have to track hundreds of security controls, but most compliance tools are cloud services. That's a hard sell when the compliance data is itself sensitive. CertMoat keeps everything on the customer's machine.

Requirements I set

• No compliance data leaves the machine, enforced by the application rather than by policy.
• Support multiple frameworks at once, and add new ones without code changes.
• Produce the documents an assessor expects: System Security Plan and reports in Word, PDF and Excel.
• Tamper evidence: the user can show the app and its audit trail haven't been altered.

Solution design decisions

• Schema-driven engine: a single framework schema drives rendering, scoring and reporting. CMMC (14 families, 110 controls) and HIPAA (7 families, 61 controls) are data files checked by a validator, not code.
• Air-gap enforced at runtime: network requests are blocked by default at the application layer and backed by a strict content security policy.
• Integrity and audit: the packaged app checks a recorded SHA-256 hash of itself at runtime, and every change is written to a keyed-hash audit log.
• Reuse over rebuild: I adopted Tahdoo's licensing architecture and native purchase bridge, with separate Store product identities so the two apps' licenses can't collide.

How the project was run

• Held the release until the sibling app passed Store certification, then applied its lessons, with a full review before every package.
• Retired a Stripe and license-server billing design in favor of Store-only licensing, then decommissioned the server infrastructure it needed.

Results

What I learned

It was my first build, and I'd spend more time on the stack and the requirements before writing code. HIPAA was added after several phases of development. A compliance product of that weight needs every framework it supports settled before the first build, not bolted on later.