TrustOps

Continuous compliance in your cloud.
Read-only evidence collection, deterministic control tests, and audit-ready proof — in one self-hosted platform.

Product tour · Connectors · Architecture · API & agents · Deploy

What TrustOps does

TrustOps gives security and compliance teams one operating loop:

1. Collect evidence through least-privilege AWS, Azure, GCP, GitHub, GitLab, Okta, Snowflake, and ClickHouse connectors.
2. Evaluate controls with deterministic, versioned rules.
3. Operate findings, remediation, policies, vendors, access reviews, and workflows.
4. Prove posture through immutable snapshots, reports, trust shares, API responses, MCP tools, and CI gates.

Evidence stays in your environment. Models may summarize and prioritize; they do not silently change evidence or decide pass/fail.

Surface	Purpose
Console	Posture, controls, evidence, findings, workflows, and audit room
API	Versioned /api/v1 contract used by every client
CLI	Local pipelines, validation, snapshots, and server operations
MCP & agents	Read posture and propose governed actions with approval boundaries
CI	Block releases when posture or control-test thresholds regress

Product preview

Trust Home	Audit room

Evidence	Connectors

More views: frameworks · insights · workflows · trust center

Quick start

Requires Python 3.11+.

python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev,server]"

security-lakehouse fixtures load --company golden --out build/lakehouse
security-lakehouse db upgrade --lake build/lakehouse
security-lakehouse serve \
  --lake build/lakehouse \
  --server \
  --allow-insecure-no-auth \
  --port 8787

Open http://127.0.0.1:8787/console/dashboard/.

--allow-insecure-no-auth is for local development only. Production deployments require configured authentication; see server authentication.

Connect a live source

The default path is agentless and read-only; no pre-existing data lake is required.

• Console: open Connectors, choose a source, then run Discover → Test → Enable → Sync.
• Headless: follow the connector setup playbook for API, CLI, and MCP flows.
• Existing lake: connect Snowflake or ClickHouse when evidence already lives there.

Cloud connectors use short-lived provider credentials or workload identity. No connector requires pasted long-lived cloud keys. TrustOps stores non-secret identifiers, redacted fingerprints, sync history, and evidence hashes.

Connector security contracts:

• AWS uses STS AssumeRole, one External ID per deployed role, short-lived session credentials, and read-only IAM posture APIs. Temporary credentials expire after each session; TrustOps stores no long-lived access keys. Scale rollout with CloudFormation StackSets or Terraform workspaces; Bulk account import is the next operator surface.
• Azure uses a customer-owned Entra application, managed identity, or federated workload identity with Reader scope. Tokens are short-lived, and no Azure password or raw client secret is stored.
• Snowflake supports browser SSO for human proof or a read-only service identity with a key-pair or OAuth token reference held by the runtime secret manager. TrustOps stores account, role, and view identifiers — not passwords or private-key contents. Snowflake is the existing security-data-lake path.

Architecture

read-only source → raw observation → normalized fact → deterministic evaluation
                 → finding/current posture → immutable snapshot → governed action

The console, CLI, MCP server, agents, and CI gate share the same API and assessment engine. This keeps browser output and headless automation consistent.

What ships

Area	Included
Compliance	SOC 2, NIST AI RMF, FedRAMP, ISO, CIS AWS, HIPAA, PCI DSS, GDPR, and EU AI Act packs
Evidence	Freshness SLAs, provenance, SHA-256 verification, tags, and saved views
GRC workflows	Remediation, policies, attestations, vendor risk, access reviews, and approvals
Identity	OIDC, SAML, API keys, RBAC, tenant boundaries, and SCIM scaffolding
Deployment	Local, Docker, Helm, EKS reference IaC, Snowflake, and ClickHouse
Exports	Snapshots, executive PDF, trust shares, OpenAPI, MCP, and GitHub posture gate

See the product shape for shipped, partial, and planned capability status.

Verify

make smoke       # backend, contracts, docs, brand, pipeline, API
make web-ci      # install, typecheck, production build
make security    # dependency audits and pre-commit checks

Regenerate documentation screenshots with make demo-screenshots-full.

Repository map

src/security_lakehouse/   assessment engine, API, auth, connectors, MCP
app/web/                  Next.js console
controls/ frameworks/     control catalogs, packs, and mappings
deploy/                   Docker, Helm, cloud, warehouse, and IaC examples
docs/                     product, architecture, operations, and API guides

Documentation

• Product walkthrough
• Architecture
• Connector catalog
• Continuous ingestion
• Audit readiness
• Agent API
• Deployment
• Roadmap

Apache-2.0 licensed. Third-party visual assets and usage terms are documented in THIRD_PARTY_ASSETS.md.