_{Open source · self-hosted · customer-owned evidence}

TrustOps

Read-only evidence. Deterministic controls. Audit-ready proof.
One self-hosted platform for operators, agents, and auditors — backed by the same verifiable JSON.

Quick start · Product tour · Connectors · Architecture · API & MCP · Deploy

One operating loop

Collect evidence read-only, evaluate controls with deterministic rules, operate the findings, and prove posture with immutable snapshots.

Regulatory requirements are consolidated into a Common Control Framework: you operate one safeguard, and it satisfies every requirement mapped to it across frameworks. The catalog holds 942 requirements across 13 frameworks; run security-lakehouse frameworks safeguards for current coverage.

Evidence stays in your environment. Models may summarize and prioritize; they do not silently change evidence or decide pass/fail.

The open-source, self-hosted alternative to managed GRC SaaS — interoperable, secure, and built to scale in your environment.

Where to start

Quick start

Requires Python 3.11+ and Node 22+ (the console is built from source; it is not committed to the repository). For the fastest path, use make demo-local which runs the whole sequence in one step.

python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev,server]"

make web-install web-build   # builds the console into src/security_lakehouse/web/dist

security-lakehouse fixtures load --company golden --out build/lakehouse
security-lakehouse db upgrade --lake build/lakehouse
security-lakehouse serve \
  --lake build/lakehouse \
  --server \
  --allow-insecure-no-auth \
  --port 8787

Open http://127.0.0.1:8787/console/dashboard/.

Note: Skipping make web-install web-build leaves /console/ as a 404. The server mounts the console only when a built dist is present. --allow-insecure-no-auth is for local development only.

Other install paths:

# Evaluator: container (no build required)
docker run -p 8787:8787 ghcr.io/msaad00/trustops:latest

# Kubernetes
helm install trustops deploy/helm/trustops

# CLI / local lake only (zero dependencies)
pip install trustops-security-data-lake
security-lakehouse fixtures load --company golden --out ./lake

See deploy/README.md for production configuration and authentication setup.

Product preview

Trust Home	Audit room

Evidence	Connectors

More views: frameworks · insights · workflows · trust center

Connect a live source

The default path is agentless and read-only; no pre-existing data lake is required.

• Console: open Connectors, choose a source, then run Discover → Test → Enable → Sync.
• Headless: follow the connector setup playbook for API, CLI, and MCP flows.
• Existing lake: connect Snowflake or ClickHouse when evidence already lives there.

Cloud connectors use short-lived provider credentials or workload identity. No connector requires pasted long-lived cloud keys. TrustOps stores non-secret identifiers, redacted fingerprints, sync history, and evidence hashes.

Connector security contracts:

• AWS uses STS AssumeRole, one External ID per deployed role, short-lived session credentials, and read-only IAM posture APIs. Temporary credentials expire after each session; TrustOps stores no long-lived access keys. Scale rollout with CloudFormation StackSets or Terraform workspaces; Bulk account import is the next operator surface.
• Azure uses a customer-owned Entra application, managed identity, or federated workload identity with Reader scope. Tokens are short-lived, and no Azure password or raw client secret is stored.
• Snowflake supports browser SSO for human proof or a read-only service identity with a key-pair or OAuth token reference held by the runtime secret manager. TrustOps stores account, role, and view identifiers — not passwords or private-key contents. Snowflake is the existing security-data-lake path.

Architecture

read-only source → raw observation → normalized fact → deterministic evaluation
                 → finding/current posture → immutable snapshot → governed action

The console, CLI, MCP server, agents, and CI gate share the same API and assessment engine. This keeps browser output and headless automation consistent.

What ships

See the product shape for shipped, partial, and planned capability status.

Verify

make smoke       # backend, contracts, docs, brand, pipeline, API
make web-ci      # install, typecheck, production build
make security    # dependency audits and pre-commit checks

Regenerate documentation screenshots with make demo-screenshots-full.

Repository map

src/security_lakehouse/   assessment engine, API, auth, connectors, MCP
app/web/                  Next.js console
controls/ frameworks/     control catalogs, packs, and mappings
deploy/                   Docker, Helm, cloud, warehouse, and IaC examples
docs/                     product, architecture, operations, and API guides

Documentation

• Product walkthrough
• Architecture
• Connector catalog
• Continuous ingestion
• Audit readiness
• Agent API
• Deployment
• Roadmap

Apache-2.0 licensed. Third-party visual assets and usage terms are documented in THIRD_PARTY_ASSETS.md.