Local-first GRC: why I'm building a compliance workbench that doesn't phone home

#security #compliance #buildinpublic #indiehacker

I'm Gary — The Security Gator. I build a GRC command deck for vCISOs, MSPs, and consultants who are tired of renting access to their own compliance data.

The premise is simple: most compliance platforms are SaaS. Your control assessments, your risk scores, your client evidence — all of it lives on someone else's servers, behind a subscription that never ends. Stop paying, lose access.

The bet: own it, don't rent it

AxiomLens is a NIST CSF 2.0 workbench that runs entirely on your machine — SQLite under the hood, a local GUI on top, one-time license. After activation it's strictly offline.

	CaaS / SaaS	AxiomLens
Your data lives	On their servers	In a SQLite file you own
Access model	Log in to their cloud, every session	Activate once, then fully offline
Cost shape	Subscription, forever	One-time license
When you stop paying	Locked out	Nothing happens — it's yours

$ axiomlens status --json
{
  "controls_total": 106,
  "in_scope": 100,
  "coverage": "computed locally"
}

Coverage math, scored risk, board-ready reports, client hand-off docs — computed on your machine, owned outright. It supports compliance documentation and audit preparation; it's not a substitute for legal, compliance, or audit advice — and I'm careful to never claim otherwise. That honesty is part of the pitch.

What I'll write about here

The build, in public: SQLite schema decisions for framework crosswalks, packaging Python into a single exe with Nuitka, deterministic report generation instead of LLM roulette, and the general weirdness of shipping desktop software in a SaaS world.