---
title: "Your Codebase Ships Fast. Your Compliance Posture Doesn't Have To Lag Six Months Behind."
published: false
tags: [devsecops, compliance, python, opensource]
---
## The Audit That Ate Three Sprints
It was a Thursday afternoon when the email arrived: *"SOC 2 Type II audit kicks off in 30 days."*
You know the drill. Someone creates a shared Google Doc titled "EVIDENCE COLLECTION MASTER v3_FINAL_USE_THIS_ONE." Engineers get pulled off features to screenshot access logs. The security team discovers that the encryption policy they *thought* was enforced... wasn't. A consultant charges $400/hour to tell you things you already suspected.
Thirty days later, you've shipped nothing, your team is demoralized, and you have a binder full of PDFs that will be stale by next quarter.
**This is not a compliance problem. It's an architecture problem.**
Compliance was designed as a point-in-time snapshot. Your infrastructure is a living system. Treating the first like the second is why audits hurt.
---
## What If Compliance Was Just Another CI Check?
That's the mental model behind **ComplianceWeave** — continuous infrastructure monitoring against SOC 2, GDPR, HIPAA, and ISO 27001, with audit-ready reports generated automatically. Not a checklist. Not a consultant. A system that watches your infrastructure the same way your observability stack watches your services.
When something drifts out of compliance, you know *immediately* — not 29 days before an auditor shows up.
---
## Quick Start
bash
pip install complianceweave
Three lines to your first compliance scan:
python
from complianceweave import Client
cw = Client(api_key="cw_your_key_here")
report = cw.scan(frameworks=["soc2", "gdpr"], target="aws://your-account-id")
print(report.summary())
That's it. You'll get a structured compliance snapshot across both frameworks — gaps flagged, severity scored, remediation paths suggested.
---
## A Real Scenario: The Startup That Didn't Know Its S3 Buckets Were Talking
Let me walk you through something we see constantly.
A Series A startup. Twelve engineers. Moving fast. They've got AWS infrastructure that evolved organically — a little Terraform here, some click-ops there from the early days. They *think* they're HIPAA-compliant because they signed a BAA with AWS.
Signing a BAA with AWS means AWS's infrastructure is covered. **Your configuration is still your problem.**
Here's how ComplianceWeave surfaces what they missed:
python
from complianceweave import Client
from complianceweave.models import RemediationPriority
cw = Client(api_key="cw_your_key_here")
Run a targeted HIPAA scan on their storage layer
scan = cw.scan(
frameworks=["hipaa"],
target="aws://123456789",
scope=["s3", "rds", "kms"]
)
Pull only critical and high-severity findings
critical_findings = scan.findings.filter(
severity=["critical", "high"]
)
for finding in critical_findings:
print(f"[{finding.severity.upper()}] {finding.control_id}: {finding.description}")
print(f" → Affected resource: {finding.resource_arn}")
print(f" → Remediation: {finding.remediation_steps[0]}")
print()
Generate a remediation plan, prioritized by risk
plan = cw.generate_remediation_plan(
scan_id=scan.id,
priority=RemediationPriority.RISK_WEIGHTED
)
Export audit-ready report
scan.export(format="pdf", output="hipaa_audit_report.pdf")
**Sample output:**
plaintext
[CRITICAL] HIPAA-164.312(a)(1): Access control mechanisms not enforced on S3 bucket
→ Affected resource: arn:aws:s3:::patient-uploads-prod
→ Remediation: Enable S3 Block Public Access at account level and bucket level
[HIGH] HIPAA-164.312(e)(2)(ii): Encryption of PHI in transit not enforced
→ Affected resource: arn:aws:rds:us-east-1:123456789:db:patient-records
→ Remediation: Enforce SSL connections via RDS parameter group (rds.force_ssl = 1)
The startup found three S3 buckets with public read ACLs containing de-identified (but still regulated) data. They found an RDS instance where SSL wasn't enforced. They found CloudTrail wasn't enabled in two regions.
None of this required a consultant. It took eleven minutes.
---
## Continuous Monitoring: The Part That Actually Changes Your Posture
One-time scans are better than nothing. But infrastructure drifts.
An engineer adds a new EC2 instance with a permissive security group. A Terraform module gets updated and quietly changes an IAM policy. Someone enables a new AWS service that isn't covered by your existing logging configuration.
ComplianceWeave runs continuously and integrates with your existing alerting:
python
from complianceweave import Client
from complianceweave.webhooks import SlackWebhook
cw = Client(api_key="cw_your_key_here")
Register a continuous monitor
monitor = cw.monitors.create(
name="prod-continuous",
frameworks=["soc2", "iso27001"],
target="aws://123456789",
schedule="*/15 * * * *", # Every 15 minutes
alert_on_severity=["critical", "high"],
webhook=SlackWebhook(url="https://hooks.slack.com/your-webhook")
)
print(f"Monitor active: {monitor.id}")
print(f"Dashboard: {monitor.dashboard_url}")
Now instead of discovering drift during an audit, you get a Slack message that reads: *"New finding: SOC 2 CC6.1 — IAM user `deploy-bot` has console access enabled. Created 14 minutes ago."*
Fix it before it becomes evidence of a control failure.
---
## Multi-Framework Isn't Just Running Four Scans
Here's something that took us a while to get right: a lot of controls overlap between frameworks. Encryption at rest shows up in SOC 2, HIPAA, GDPR, and ISO 27001. Running four separate scans and getting four separate reports creates noise and duplicated remediation work.
ComplianceWeave maps findings to a unified control graph, so you see:
- **One finding** for "RDS encryption not enabled"
- **Four framework mappings** (SOC 2 CC9.1, HIPAA 164.312(a)(2)(iv), GDPR Article 32, ISO 27001 A.10.1.1)
- **One remediation action** that satisfies all four simultaneously
Your remediation plan is deduplicated. Your audit report shows cross-framework coverage. Your engineers fix things once.
---
## Where This Fits In Your Stack
ComplianceWeave isn't trying to replace your SIEM, your secrets manager, or your IaC tooling. It sits in the observability layer — alongside your metrics, logs, and traces — and answers the question: *"Are we compliant right now?"*
It works with:
- **AWS, GCP, Azure** (multi-cloud scanning in a single report)
- **Terraform and Pulumi** (scan IaC before it ships)
- **GitHub Actions** (fail PRs that introduce compliance drift)
- **Datadog, PagerDuty, OpsGenie** (route compliance alerts through existing on-call workflows)
---
## The Numbers That Matter
Before ComplianceWeave, the average SOC 2 Type II preparation takes **4-6 weeks** of engineering time. After? Teams using continuous monitoring report **audit prep time under 3 days** — because the evidence was being collected automatically, all year.
That's not a marketing stat. That's what happens when compliance is a system instead of a project.
---
## Try It
ComplianceWeave is in public beta. The API is free for up to 3 infrastructure targets and 2 frameworks.
- 🔗 **[Get your API key →](https://complianceweave.io/signup)**
- ⭐ **[Star us on GitHub →](https://github.com/complianceweave/complianceweave-python)** — the Python client is open source
- 📖 **[Read the full API docs →](https://docs.complianceweave.io)**
If you're currently in the middle of an audit sprint, [book a 20-minute setup call](https://complianceweave.io/demo) and we'll get your first continuous monitor running before the call ends.
---
*Questions? Drop them in the comments or find us in the [ComplianceWeave Discord](https://discord.gg/complianceweave). We read everything.*
Top comments (0)