Scorifya Controls's answer

It runs on your own server. Every other compliance platform I know of is SaaS, which means your cloud credentials, security evidence, and audit trail all sit in someone else's database. Controls ships as a single Docker container. You connect your AWS, GCP, Azure, and GitHub accounts, the checks run locally, and nothing leaves your infrastructure. For PCI DSS this has a nice side effect: the tool itself never touches your cardholder data environment, so it doesn't expand your audit scope.

Scorifya Controls's answer

Two reasons: price and data custody. The big platforms quote $10k to $25k a year and hold all your evidence on their side. Controls is $99 a month flat, no per-seat pricing, and self-hosted. You get 38 automated checks mapped to SOC 2 criteria and PCI DSS 4.0.1 requirements, manual control tracking with file evidence, cryptographic timestamps on every attestation (RFC 3161, so an auditor can verify them independently), and a read-only portal you hand to your auditor. If you're a 5-person startup facing your first SOC 2 because a big customer asked, that's usually everything you need.

Scorifya Controls's answer

Seed-stage startups and small SaaS teams going through their first SOC 2 or PCI DSS audit, usually because an enterprise deal depends on it. Also agencies that manage compliance for several clients, since self-hosting means each client's evidence stays in that client's infrastructure. If you already have a compliance team and 200 employees, the big platforms probably fit you better. This is for the team where the CTO is also the compliance department.

Scorifya Controls's answer

I run Scorifya, a website security scanner. Talking to users, the same thing kept coming up: what actually forced them to take security seriously wasn't a scan score, it was a customer asking for a SOC 2 report. The tools for that were priced for later-stage companies, and every one of them wanted read access to your entire cloud setup, stored on their servers. That seemed backwards for a security product. So I built the version I'd want to use: self-hosted, flat price, with tamper-evident timestamps so the evidence holds up on its own.

Scorifya Controls's answer

Next.js and Node for the app, Python for the cloud check workers, SQLite for storage so there's no separate database to run. The whole thing ships as one Docker container. Attestation timestamps use RFC 3161 timestamp authorities, which means the proofs are verifiable by anyone, not just by us.