Fission Accountant collects continuous, timestamped control evidence from the systems you already run, chains every snapshot with SHA-256, and hands your auditor a package they can verify. Self-hosted, developer-native, and priced for seed-stage teams.
No vendor account. No data egress. Free edition stays free forever.
Auditors reject evidence with timestamps a vendor or an admin can rewrite. Compliance platforms solve that at $10,000–$15,000 a year, priced for companies with a compliance team. Fission Accountant solves the evidence problem directly: automated collection, cryptographic integrity, and an export your auditor can check line by line.
Every control result records the source API response, the collector version, and the exact collection time. Nothing is typed in by hand or pasted from a screenshot.
Each snapshot commits to the hash of the one before it. Publish the same snapshot to an S3 Object Lock bucket under COMPLIANCE retention and even you cannot rewrite it.
One container, your database, your cloud account. Credentials are encrypted at rest and read only by your worker process.
The whole workflow is designed to be finished by one engineer in an afternoon.
Run the container, Docker Compose stack, or a one-click Railway deployment. Migrations and the control catalog are applied on boot.
A fine-grained GitHub token, a read-only AWS role, and — with Pro — Google Cloud and Google Workspace service accounts.
Run on demand, on a schedule, or from CI. Failing controls open remediation tasks and drift triggers a webhook alert.
Issue a scoped, revocable auditor link. They browse control status and download a ZIP with evidence, policy approvals, and the hash-chained audit log.
61 controls mapped to SOC 2 Trust Services Criteria, versioned so historic results stay comparable across releases.
| Source | Controls | Examples | Edition |
|---|---|---|---|
| GitHub | 15 | Organization MFA, branch protection, required reviews, secret scanning, Dependabot, Actions policy | Free |
| AWS | 20 | Root MFA, IAM key rotation, CloudTrail, GuardDuty, S3 encryption and public access, RDS backups, KMS rotation | Free |
| Google Cloud | 12 | Owner inventory, audit logs, bucket public access prevention, Cloud SQL backups, GKE private nodes, flow logs | Pro |
| Google Workspace | 8 | Two-step verification, super admin inventory, suspended accounts, access review | Pro |
| Manual attestations | 6 | Access reviews, vendor risk, incident exercise, risk assessment, policy approval, security training | Free |
Free is a complete evidence engine, not a crippled trial. Pro adds the collaboration, automation, and auditor workflows a real audit needs.
GitHub and AWS automation with the full ledger and dashboard.
Everything in Free, plus:
In your deployment: your Postgres database, your evidence directory, and optionally your own S3 Object Lock bucket. Fissionworx operates no collection service and receives no telemetry.
Each snapshot is canonicalised and hashed, and each ledger record commits to the previous record's hash, so any edit breaks the chain. Application events use the same chaining. For retention an administrator cannot bypass, publish snapshots to an S3 bucket created with Object Lock and COMPLIANCE retention.
No. A Pro purchase is a perpetual license for the major version you bought, verified offline with an Ed25519 signature. A future major version is a separate purchase, and your evidence remains readable regardless of license state.
No. Only a licensed CPA firm can issue a SOC 2 report. Fission Accountant automates the technical evidence and gives your auditor a verifiable package; scope, testing, and judgment remain theirs.
Fissionworx