In DevelopmentRegTech

Certivar

An AI compliance officer.

The Problem

Why This Exists

Getting certified turns an engineer into a part-time compliance manager. The alternative is a consultant who bills forty thousand dollars, installs agents across your infrastructure, and still hands back claims nobody can trace to evidence.

The Solution

What We Built

Certivar runs the whole program: the scoping, the policies, the daily evidence collection, and the conversation with your auditor. It reads your cloud, code and identity systems through read-only connections, with nothing installed on anything you own. Any claim about your organisation has to cite evidence that actually exists, or it never gets written.

Capabilities

Key Features

Full program coverage — scoping, policy authoring, evidence collection, and auditor liaison

SOC 2, ISO 27001, HIPAA and PCI DSS in a single program

Read-only connections to cloud, code and identity systems, with nothing installed

Every claim cites the evidence behind it, or it is never written

Named human approval, bound to the exact document being attested

Complete action log, readable by you and by your auditor

Honest dates, including when a deadline cannot be met

From $990 a month, one framework start to finish

Technology

Tech Stack

TypeScriptNext.jsNestJSPostgreSQLpgvectorPrismaRedisBullMQClaudeVoyage AIAWSTerraform

Architecture

System Design

Read-only collection across AWS, GitHub, Google Workspace and Okta, installing nothing on customer infrastructure

Retrieval over the control corpus using Voyage embeddings at 1024 dimensions in pgvector with HNSW indexing

Model tiering by task — Sonnet for routine work, Opus for scoping and policy drafting

Evidence-citation gate that blocks any unsupported claim from being written

Attestation binding a named approver to the exact document version they reviewed

BullMQ worker fleet on scheduled daily collection, Terraformed with OpenTelemetry and CloudWatch alarms

Interested in this venture? Let's connect.

Talk to us