Compliance
Compliance recipes
13 admin-reviewed Compliance starting points in the Vault, each installable with one command. Browse every category →
.NET + Postgres: Regulatory Filing & Reporting Deadline Tracker
Tracks regulatory filing deadlines (tax, compliance reports) with a worker flagging upcoming due dates — distinct from Vendor Risk and Certification tracking: this is specifically about deadlines and filings, not vendor assessment or control evidence.
by @ops
.NET + Postgres: Vendor Security Questionnaire & Third-party Risk Tracking
Vendor security questionnaires, response tracking, and risk scoring for third-party vendor assessment — distinct from Compliance Certification & Audit Evidence: that tracks YOUR OWN controls, this assesses the vendors and partners you depend on.
by @ops
Compliance Certification & Audit Evidence Tracker
Tracks control status and collects audit evidence for certifications like SOC 2 or ISO 27001 — distinct from GDPR/Consent/Retention: those handle user data rights, this is evidence that YOUR controls are actually being followed.
by @ops
Consent Management Platform
Cookie/privacy consent capture and an auditable record of what a user agreed to and when — distinct from the GDPR Data Rights recipe: that handles export/deletion requests after the fact, this is the consent record those requests get checked against.
by @ops
Data Masking & Synthetic Test Data Generator
Generates realistic-but-fake data for staging/test environments via a worker, so real customer data never has to leave production. A genuine compliance concern hiding as a DevOps convenience.
by @ops
Data Retention & Archival Policy Service
Scheduled, policy-driven data lifecycle enforcement — archive after X, delete after Y, per data type — with a worker that actually executes retention policy instead of it living only in a document nobody enforces. Distinct from the GDPR recipe: that's user-initiated requests, this runs on its own schedule.
by @ops
GDPR / Data Rights Request Service
A backend for handling data export and deletion requests properly — request intake, an auditable trail of what was done and when, and a worker to actually walk through deleting/exporting across tables instead of a manual one-off SQL script every time someone asks.
by @ops
Go + Postgres + Redis: API Key Rotation & Credential Lifecycle Management
Scheduled rotation of API keys and credentials with a worker managing the rotation cycle and history — distinct from Secrets & Config Management: that's storage, this is specifically the rotation lifecycle and audit trail of when keys changed.
by @ops
Go + Postgres: Container Vulnerability Scan Tracking Backend
Stores and trends container image vulnerability scan results over time, a worker ingesting scan output — for teams who run the scans already but have nowhere to track findings across builds and see whether things are getting better or worse.
by @ops
Legal Contract & E-signature Workflow
Contract versioning, signature status tracking, and an auditable record of who signed what and when, with a worker processing signature events. A compliance-adjacent pattern: the paper trail matters as much as the contract itself.
by @ops
Python + Postgres: Compliance Training & Certification Tracking
Mandatory employee training assignments and certification expiry tracking, a worker flagging upcoming renewals — distinct from Compliance Certification & Audit Evidence (that's YOUR OWN organizational controls): this tracks individual employees' required training and cert status.
by @ops
Python + Postgres: Policy-as-Code Validation Engine
Validates infrastructure or application configuration against declared policy rules, similar in spirit to Stacktora's own company.stacktora.json enforcement — generalized as a standalone service for validating any structured config against any rule set.
by @ops
Rust + Postgres: Tamper-evident Immutable Audit Ledger
Hash-chained audit records where altering history breaks the chain and is provably detectable — distinct from the standard Audit Log / Activity Trail recipe: that's a normal append-only log, this is cryptographically tamper-evident for a much higher assurance bar.
by @ops