The compliance as code platform. Get SOC 2 fast, then never outgrow it.
Every compliance tool gets you through your first audit. Then you hit a requirement it can't express, and the overflow goes into a spreadsheet. Calethia has no ceiling, because the checks, the frameworks, and the connectors are all code you own.
Controls the tool can't express end up in a spreadsheet
Config-based tools get you to SOC 2 well, but they give you a fixed menu of checks, and your requirements outgrow the menu. Two years in you have a control specific to how you run, an internal system nobody wrote a connector for, and a customer questionnaire that matches no published framework. None of it fits, so it goes in a spreadsheet next to the tool you're paying for.
What happens with a config-based tool
- ✗A control you need has no way to be expressed, so it's tracked by hand
- ✗Anything they haven't built is a feature request, so your audit date depends on their roadmap
- ✗A new framework means re-tagging everything from scratch
- ✗Half your program lives outside the tool, and only the other half is monitored
What happens with Calethia
- You write the control as a Python function, and it runs on every scheduled check from day one
- You write the connector yourself, so you can unblock yourself
- A new framework maps onto controls you already have, so coverage starts high
- The whole program lives in Git: every check signed, every run monitored
A plugin architecture for every layer
Most platforms let you customize the dashboard. Calethia lets you change the checks, the frameworks, and the connectors.
Custom checks
A check is a Python function in your repository. If you can describe the control, you can write it, including for systems no compliance vendor has ever heard of.
Custom frameworks
Map each check once onto a common control, and every framework you add after that needs only a mapping. Your customer's bespoke questionnaire is just another framework.
Custom integrations
Multiple providers ship with the platform. For anything else, a plugin interface lets you write the connector yourself, with no wait on our roadmap.
Your GRC team writes the rules. Calethia runs them.
Most compliance automation takes judgment away from the person who has it. The vendor decides what counts as compliant and hides the reasoning, so your GRC engineer administers a tool that answers on their behalf. Your GRC engineers already know which controls matter here. Calethia makes that judgment executable, so it runs continuously.
Describe it, and review the code
Our Claude Code plugin scaffolds a policy from a requirement written in plain language, so authoring a control doesn't require a Python background. You then review the code it wrote.
Catch mistakes before they run
We ship a CLI for local development, so you check policies before they ever run against real infrastructure. calethia lint catches common errors in seconds and reports each with a named code and an explanation.
Engineers can verify every control
Because every check is readable, your GRC engineer can confirm a control does what its name says. A black box removes that judgment.
Compliance that behaves like engineering
Policies read like tests, run in CI, and live in version control. The compliance program works the way the rest of your platform already works.
Teams that write their own checks end up building the platform too. Calethia is already that platform.
Current compliance status
Checks run on a schedule against live infrastructure, so you see your compliance status today.
Evidence you can verify
Every run is signed (RSA-SHA256) and timestamped (RFC 3161). Your auditor can confirm an artifact is genuine without taking our word for it.
Git-native workflow
Policies live in your repo alongside your code. Review them in pull requests, version them with every change, and take them with you.
Checks that report the actual truth
You can read the logic of every control, so you can tell the difference between a check that passed and a check that was never capable of failing.
Documents that scale with you
Start with nothing and Calethia generates your policy documents. Grow, and publish them out to the system your team already reads. Mature, and connect the ones you maintain yourself, and Calethia keeps reconciling them against what your infrastructure actually does.
No black box to trust blindly
Every check is source you can open, run, and change yourself. Your engineers own the tool and can check what it does.
How it works
Connect
Connect your cloud accounts, identity provider, and source control with read-only, scoped access.
Adopt
Start from the built-in policy library mapped to SOC 2 and other frameworks. Get to your first report on the same timeline as anywhere else.
Extend
When the library doesn't cover a requirement, write the check yourself.
Numerous frameworks, one set of controls
Policies map onto a framework-neutral common control spine. Adding a framework means adding a mapping, and you can see your coverage against it before you commit to the audit.
Multiple integrations, with more on the way
Connect the tools you already use. The integrations below ship with the platform today. If the one you need isn't on this list, the plugin interface covers it.
Build on Calethia
Bring your own integration
Calethia ships a published SDK interface, so you can write a connector for an internal system nobody sells one for, the way Terraform's ecosystem writes its own providers.
Bring your own framework
The common control spine that makes cross-framework coverage work is open. Define a framework of your own, whether that's an internal standard, a regulator nobody has productized, or the bespoke control list a large customer sent over, and see your existing coverage against it immediately.
Verify without us
calethia verify is a standalone source-available CLI that checks a piece of evidence's signature, timestamp, and source hash with no Calethia account and no network call. It runs for an auditor who has never heard of us, and it still runs for a customer who has left, so compliance history outlives the vendor that built it.
Auditor portal
Auditors get their own portal: scoped, time-boxed access to an engagement's signed evidence, with the same signed export as a first-class alternative. No emailing PDFs back and forth and no seat to buy. Auditors sign in with a one-time emailed code, and the signed export verifies offline with no account at all.
Host your own data plane
Run Calethia inside your own cloud account, with no runtime dependency on infrastructure we operate. You pull signed, versioned releases when you choose to upgrade, and your config, secrets, and signing keys stay in your environment, never round-tripped through ours.
Name a control your current tool can't express
Bring the requirement your platform has no place to put. We'll write it, run it, and sign the evidence while you watch.