Operators
Controls run as workflows, not as documents
Named tasks, approval gates, and evidence chains execute inside daily operations, not in a separate compliance layer.
See how it worksCompliance OS for NDIS, aged care & healthcare
Audit-ready every day,
not the week before the Commission visits.
FormaOS turns NDIS, aged care and healthcare obligations into enforced workflows — named owners, blocked failure paths, and an immutable evidence trail. Every control stays audit-ready, so you pass Commission and accreditation review the first time.
Guided assessment · AU-hosted by default · Evidence-backed workflows
10 frameworks scored out of the box, including ISO 27001, SOC 2, NDIS Practice Standards and HIPAA.
Policy and register templates are written against the NDIS Commission, AHPRA, ACECQA and ASIC, so the language matches what your assessor expects to see.
Three paths to conviction, visible before the first call
Operators see accountable workflows. Security reviewers see defensible evidence. Procurement sees a structured evaluation path. Each audience gets substance without waiting for a demo.
Enterprise buyers
One evaluation flow from security review to rollout
Identity controls, audit exports, hosting posture, and procurement artifacts stay in a single narrative buyers can verify.
See enterprise pathSecurity reviewers
Trust evidence is visible before the first call
Trust documentation, evidence defensibility, and review-ready context surface early so reviewers can verify substance upfront.
Visit trust centreFrom obligation to enforced evidence chain
FormaOS turns compliance into a continuous operating loop rather than a document clean-up project before an audit.
Define compliance workflow
Map the operational process, owners, due dates, evidence, and review points.
Assign rules
Set what must be present before work can move forward.
System enforces execution
FormaOS runs checks continuously and blocks incomplete paths.
Evidence generated automatically
Actions, approvals, timestamps, and context become audit evidence.
Audit ready anytime
Export the evidence chain instead of rebuilding it under pressure.
Verifiable, not just “we have logs”
Every org's audit log is hash-chained, RLS-locked against mutation, and anchored daily to Sigstore Rekor, the same append-only transparency log the Linux Foundation runs for signed open-source releases.
HMAC-chained rows
Tamper-evident by construction
Each row carries a sequence number and an HMAC-SHA256 signature linking it to the previous row. A nightly cron re-walks the chain; any drift surfaces as a chain-integrity break before the next audit.
External anchor at 05:30 UTC
Verifiable without trusting us
Daily, each org's chain top is submitted to Sigstore Rekor as an RFC 6962-style Merkle entry. An auditor can verify the timestamp of any event without trusting us, the proof goes through Linux Foundation infrastructure.
Append-only at the database
Immutable, even to platform admins
A BEFORE UPDATE OR DELETE trigger rejects any mutation of audit rows, backed by restrictive RLS deny policies. Even a platform admin with service-role credentials, which bypasses RLS, is stopped by the trigger. Enforced by Postgres, not application code.
- Row signature
- HMAC-SHA256
- Merkle proof
- RFC 6962
- Daily anchor
- 05:30 UTC
- DB trigger + RLS
- Append-only
- External log
- Sigstore Rekor