Everything here happens inside your own infrastructure.
cp .env.example .env # set SOC2_ENCRYPTION_KEY and the collector credentials docker compose up -d --build # services: web (8080), worker, postgres, redis, minio # open http://localhost:8080 and create the first administrator
The migrate service runs migrations before web and worker start, so a fresh volume and an upgrade follow the same path.
# 1. create a project from this repository railway init && railway up # 2. add the Postgres plugin, then set variables DATABASE_URL=${{Postgres.DATABASE_URL}} SOC2_ENCRYPTION_KEY=<openssl rand -hex 32> FISSION_APP_MODE=product # or "site" for the marketing site # 3. optional second service for the worker start command: fission-accountant worker
Railway injects PORT; both the product app and the marketing site bind to it automatically. Migrations run on boot.
| Provider | Configuration JSON | Credentials JSON |
|---|---|---|
| github | {"organization": "your-org"} | {"token": "github_pat_..."} |
| aws | {"region": "us-east-1"} | Uses the container's role or environment credentials |
| gcp | {"project_id": "my-project"} | {"service_account": "<json>"} |
| google_workspace | {"admin_email": "admin@example.com"} | {"service_account": "<json>"} |
Credentials are encrypted with SOC2_ENCRYPTION_KEY before they are written to the database and are decrypted only by the worker process.
fission-accountant collect --github-org acme --skip-aws fission-accountant collect --gcp-project my-project \ --gcp-service-account-file ./gcp.json # Pro fission-accountant verify # check the hash chain fission-accountant export --output evidence.zip fission-accountant license # show the effective edition fission-accountant init-db # migrate and seed the catalog fission-accountant worker # durable worker and scheduler fission-accountant serve # web application
Use --fail-on-findings in CI to exit non-zero once a snapshot has been retained.
A Pro license is an Ed25519-signed JSON document. Install it from the dashboard License page, or mount it and set FISSION_LICENSE_FILE. Verification is offline, so an air-gapped install works unchanged. The license covers major version 1.0.0 perpetually; your collected evidence stays readable in every edition.
Create a scoped token under Auditor access with a label, validity period, and optional observation window. The auditor opens /auditor on your deployment, pastes the token, reviews control status, and downloads the evidence package. Only the token hash is stored, and revocation is immediate.
Fission Accountant collects technical evidence. It does not certify SOC 2 compliance and does not replace an auditor's scope, judgment, policy review, or control testing.
Fissionworx