Defense contractors handling Controlled Unclassified Information are required to comply with CMMC Level 2: 110 NIST controls assessed against 320specific objectives, scored on a methodology with strict POA&M eligibility rules [1], attested under False Claims Act exposure.

Existing tools were either compliance theater (template SSPs with blanks) or enterprise products priced out of reach for small contractors. The build target was a platform that compliance practitioners (RPOs, C3PAOs) and contractors could use to track posture, generate SSPs and POA&Ms, and prepare for assessments — without paraphrasing regulatory text or skipping the audit trail.

Three months solo. Next.js 15, Supabase, Postgres. 86 migrations including the byte-exact correction of 199 of 320 NIST 800-171A assessment objectives to canonical text from the source publication [2]. Multi-tenant data model with 244 RLS policies across 69 tables in 15 functional domains for org-scoped isolation. Real-time SPRS scoring engine implementing the DoD Assessment Methodology v1.2.1 [1]. Audit trail with provenance metadata on every mutation. Stripe for billing, Resend for email, Sentry for error tracking. 137 API routes, 192 components.

The platform includes SAML SSO, a public REST API with key management, an AI copilot with prompt injection protection, retrieval-augmented generation over the regulatory corpus via pgvector, multi-framework mapping across CMMC / ISO 27001 / SOC 2 / HIPAA, a C3PAO assessor portal, subcontractor flow-down tracking, a False Claims Act risk calculator, and a mock C3PAO assessment simulator.

Regulatory data fidelity. Most platforms paraphrase NIST text into developer-friendly strings; the paraphrasing drifts. A contractor attesting against drifted text is creating False Claims Act exposure. The fix was authoritative regulatory text in Postgres, SHA-256 checksums against source PDFs, citation comments on every compliance fact in code, and a pre-commit check that rejects assertions of compliance facts without citations. Migrations 085 and 086 are this discipline shipping in real time:

-- Source: cmmc-ag-l1-v2.13.pdf, §3.1.1, page 12
-- Verified byte-exact via SHA-256: a3f7c9d2…

BEGIN;

WITH upd AS (
  UPDATE controls
     SET requirement_text = canonical_text
   WHERE level = 1
  RETURNING control_id, old_text, requirement_text
)
INSERT INTO audit_logs (...)
SELECT ... FROM upd;

-- validation: row count == expected, raise on drift

COMMIT;

Multi-tenant boundaries. Application-layer tenant filtering breaks the day someone forgets the WHERE clause. The fix was Row-Level Security on every table — org-scoped reads via JWT claim, role-based writes (viewer cannot write, contributor can INSERT and UPDATE, admin can DELETE). The audit_logs table has no UPDATE or DELETE policies, so it's append-only at the database layer. A new query that forgets the org filter fails closed at the database, not silently leaks.

Coordinating fifteen domains in one schema. Compliance platforms aren't single-purpose. The schema has to handle identity, assessment workflow, document generation, evidence collection, remediation, continuous monitoring, an AI copilot, and an audit log that captures every mutation across all of it. The hard part isn't building any single domain. It's making fifteen share one tenant boundary, one audit trail, and one transaction layer without leaks.