Ataraxia

The problem

Defense contractors handling Controlled Unclassified Information are required to comply with CMMC Level 2: 110 NIST controls assessed against 320 specific objectives, scored on a methodology with strict POA&M eligibility rules [1], attested under False Claims Act exposure.

Existing tools were either compliance theater — template SSPs with blanks — or enterprise products priced out of reach for small contractors. The build target was a platform that compliance practitioners (RPOs, C3PAOs) and contractors could use to track posture, generate SSPs and POA&Ms, and prepare for assessments — without paraphrasing regulatory text or skipping the audit trail.

The build

Three months solo. Next.js 15, Supabase, Postgres. 86 migrations, including the byte-exact correction of 199 of 320 NIST 800-171A assessment objectives to canonical text from the source publication [2]. A multi-tenant data model with 244 row-level-security policies across 69 tables in 15 functional domains for org-scoped isolation. A real-time SPRS scoring engine implementing the DoD Assessment Methodology v1.2.1 [1]. An audit trail with provenance metadata on every mutation. Stripe for billing, Resend for email, Sentry for error tracking. 137 API routes, 192 components.

The platform includes SAML SSO, a public REST API with key management, an AI copilot with prompt-injection protection, retrieval-augmented generation over the regulatory corpus via pgvector, multi-framework mapping across CMMC / ISO 27001 / SOC 2 / HIPAA, a C3PAO assessor portal, subcontractor flow-down tracking, a False Claims Act risk calculator, and a mock C3PAO assessment simulator.

What's hard about it

Regulatory data fidelity

Most platforms paraphrase NIST text into developer-friendly strings; the paraphrasing drifts. A contractor attesting against drifted text is creating False Claims Act exposure. The fix was authoritative regulatory text in Postgres, SHA-256 checksums against source PDFs, citation comments on every compliance fact in code, and a pre-commit check that rejects assertions of compliance facts without citations. Migrations 085 and 086 are this discipline shipping in real time:

-- Source: cmmc-ag-l1-v2.13.pdf, §3.1.1, page 12
-- Verified byte-exact via SHA-256: a3f7c9d2…

BEGIN;

WITH upd AS (
  UPDATE controls
     SET requirement_text = canonical_text
   WHERE level = 1
  RETURNING control_id, old_text, requirement_text
)
INSERT INTO audit_logs (...)
SELECT ... FROM upd;

-- validation: row count == expected, raise on drift

COMMIT;

Multi-tenant boundaries

Application-layer tenant filtering breaks the day someone forgets the WHERE clause. The fix was Row-Level Security on every table — org-scoped reads via JWT claim, role-based writes (viewer cannot write, contributor can INSERT and UPDATE, admin can DELETE). The audit_logs table has no UPDATE or DELETE policies, so it is append-only at the database layer. A new query that forgets the org filter fails closed at the database — it does not silently leak.

BROWSER                JWT { org_id, role }
   ↓
EDGE · RATE LIMIT      sliding window per user, per route
   ↓
API · ZOD VALIDATION   schema + max length per field
   ↓
POSTGRES · RLS         org_id = jwt.org_id · role IN (...)
                       audit_logs: append-only (no UPDATE / DELETE)

Fig. 1 — the tenant boundary inherited by every query

Fifteen domains, one schema

Compliance platforms aren't single-purpose. The schema handles identity, assessment workflow, document generation, evidence collection, remediation, continuous monitoring, an AI copilot, and an audit log that captures every mutation across all of it. The hard part isn't building any single domain — it's making fifteen share one tenant boundary, one audit trail, and one transaction layer without leaks.

Status

After three months in build, I decided to step away from the platform and apply the same engineering discipline to client work. The codebase shipped past the "sellable" threshold — but distribution as a solo founder against entrenched competitors wasn't the path I wanted.

The codebase remains as a credential and a teaching artifact for the verification discipline I now apply to every Praxon engagement. Currently not in active development; not ruling out a revival.

References

1. Department of Defense CIO. CMMC Assessment Methodology, version 1.2.1. November 2024.
2. NIST. Special Publication 800-171A: Assessing Security Requirements for Controlled Unclassified Information. June 2018.
3. NIST. Special Publication 800-171, Revision 2: Protecting CUI in Nonfederal Systems and Organizations. February 2020.
4. 32 CFR Part 170. Cybersecurity Maturity Model Certification (CMMC) Program. October 2024.