Skip to main content
Skip to main content
FormaOS
Compliance OS for NDIS, aged care & healthcare

Audit-ready every day,
not the week before the Commission visits.

FormaOS turns NDIS, aged care and healthcare obligations into enforced workflows — named owners, blocked failure paths, and an immutable evidence trail. Every control stays audit-ready, so you pass Commission and accreditation review the first time.

Get Compliance PlanBook Demo

Guided assessment · AU-hosted by default · Evidence-backed workflows

Frameworks supportedNDISAHPRAISO 27001SOC 2
Designed for NDIS, AHPRA, ISO, and SOC 2 environments
Audit-ready workflows
Evidence-backed compliance
Prevents gaps before they become audit findings

Why buyers stay

Three paths to conviction, visible before the first call

Operators see accountable workflows. Security reviewers see defensible evidence. Procurement sees a structured evaluation path. Each audience gets substance without waiting for a demo.

01

For operators

Controls run as workflows, not as documents

Named tasks, approval gates, and evidence chains execute inside daily operations, not in a separate compliance layer.

See how it works
02

For enterprise buyers

One evaluation flow from security review to rollout

Identity controls, audit exports, hosting posture, and procurement artifacts stay in a single narrative buyers can verify.

See enterprise path
03

For security reviewers

Trust evidence is visible before the first call

Trust documentation, evidence defensibility, and review-ready context surface early so reviewers can verify substance upfront.

Visit trust center

How It Works

From obligation to enforced evidence chain

FormaOS turns compliance into a continuous operating loop rather than a document clean-up project before an audit.

01

Define compliance workflow

Map the operational process, owners, due dates, evidence, and review points.

02

Assign rules

Set what must be present before work can move forward.

Enforcing

03

System enforces execution

FormaOS runs checks continuously and blocks incomplete paths.

04

Evidence generated automatically

Actions, approvals, timestamps, and context become audit evidence.

05

Audit ready anytime

Export the evidence chain instead of rebuilding it under pressure.

8 framework packs shipping today· AU regulatory coverage in templates & policy library
  • NDIS Practice Standards
  • Aged Care Quality Standards
  • NSQHS Standards
  • AHPRA
  • ASIC s912A
  • APRA CPS 230
  • AUSTRAC AML/CTF
  • ACECQA NQF
  • WHS Act
  • SafeWork Australia
  • ISO 27001
  • SOC 2
  • GDPR
  • NIST CSF
  • PCI DSS
  • HIPAA
  • CIS Controls
  • ISO 9001
Operating System Architecture

Not a repository. A live system.

Other tools store documents. FormaOS enforces your compliance program, controls are gated, ownership is structural, and evidence is generated as teams operate.

94%

What the posture screen looks like

Live posture computed nightly fromorg_control_evaluationsand rendered at /app/compliance/health. Example values, not a customer claim.

SOC 2 Type II94%
ISO 2700188%
HIPAA96%
47/50
Active controls
312
Evidence items
8
Framework packs

Workflow Enforcement

Controls gate work in real time. Non-compliant actions are blocked before they happen.

Blocked
Missing approval, A.9.2 Access Control
Approved
Control satisfied, CC6.1 Logical Access
Approved
Evidence attached, HIPAA §164.312

Evidence Chain

Every action is timestamped, immutable, and traceable. No reconstruction needed.

Control created
Day 0
Evidence uploaded, by named owner
Day 3
Review approved, by control reviewer
Day 4
Hash anchored, Sigstore Rekor entry
Day 5

Named Ownership

Every control is assigned to a named person. No ambiguity when regulators ask “who owns this?”

AC
Access control owner
Assigned in workspace
DE
Data encryption owner
Assigned in workspace
IR
Incident response owner
Assigned in workspace

Audit-Ready

Export complete audit packets, evidence, ownership, control history , without scrambling.

Minutes
not weeks
PDF, CSV, JSON
Export formats
Full trail
History depth
Frameworks→Controls→Tasks→Evidence

See how everything connects

Frameworks map to controls. Controls generate tasks. Tasks produce evidence. Tap or hover any node to trace its compliance relationships.

  1. 1
    Frameworks5 supported

    The obligations from every standard you adopt.

  2. 2
    Controls6 mapped

    Each framework maps to the controls that enforce it.

  3. 3
    Tasks3 workflows

    Controls generate owned, scheduled work.

  4. 4
    Evidence4 types

    Tasks produce verifiable, audit-ready evidence.

Trace dependencies from Frameworks to Controls to Evidence to Tasks