Compliance as an engineering problem: building an open-source Information Security, Privacy and AI Governance Platform

There are two kinds of compliance tooling on the market. The first is a spreadsheet dressed in good intentions. The second is a contract with a golf invitation attached. I spent a few years watching organisations pay handsomely for the second while quietly operating the first underneath it, and eventually decided to find out what it would take to build something that was neither. This post is the architectural write-up. Not a pitch — I'm not selling anything. Just the decisions, the trade-offs,...