Core Concepts
Our architecture relies on a few fundamental concepts to keep your evidence trustworthy:
1. Adapters
An adapter is a read-only collector for one resource type. Enforcer ships 45 of them — 32 AWS and 13 Kubernetes — and each normalizes what your cloud actually runs into an asset the policy engine can evaluate. AWS is reached through a read-only IAM role; Kubernetes through a read-only kubeconfig.
2. Policies
Policies are declarative rules that define the desired state of your infrastructure, each mapped to an ISO 27001 control. Enforcer ships 92 policies across the AWS adapters and 41 across the Kubernetes adapters — 133 policies mapped onto 25 distinct ISO 27001 controls, covering access control, network segregation, logging, cryptography, and resource governance.
Every policy is pure data: a scope that selects the asset type and a rule definition evaluated by a sandboxed rule engine. No policy executes arbitrary code, and no LLM sits anywhere in the evidence path.
3. Drift Detection
Scheduled compliance flows evaluate the live state of every adapted resource against its policies. Each violation is recorded as a finding that carries the exact resource, the policy it failed, and the delta — timestamped and reproducible.
4. Gated Remediation
Remediation deliberately never runs on its own. A proposed fix executes only when two independent gates are satisfied: the platform is explicitly set to remediate mode, and a human approves the specific action. Finding, approval, and fix are linked into one auditable record.
5. Evidence
Every evaluation — pass or fail — feeds a structured, queryable evidence store. Evidence packs export timestamped, provenance-carrying records for a date range. When your auditor asks "how do you know this control held in March?", the answer is a query, not a screenshot hunt.
6. Compliance Score
One number, defined once: passing evaluations divided by evaluated evaluations, taken over the latest result for each (control, asset, policy) triple. Every surface in the product — dashboard, API, evidence pack — reads that same rollup, so the score on your screen and the score in your auditor's export cannot disagree.