Fission Accountant

Self-hosted, tamper-evident SOC 2 evidence automation from Fission Solutions.

Seed-stage startups get blocked in enterprise procurement without SOC 2 evidence, and the incumbent platforms cost $10k–$15k a year. Fission Accountant runs on your own infrastructure, collects the technical evidence automatically, and stores it in a hash-chained ledger so timestamps are not vendor-controlled.

• Fission Accountant Free — GitHub and AWS collection, the full 61-control catalog, manual evidence, ledger verification, ledger export, policy starters. Free forever, no license file, no expiry.
• Fission Accountant Pro — adds Google Cloud and Google Workspace collection, scheduled unattended runs, drift alerts, policy approvals, remediation tasks, the auditor portal, database-backed auditor exports, and additional user accounts. One-time purchase, perpetual license for the major version you buy, verified offline.

See OPEN_CORE.md for the exact boundary, LICENSE for source terms, and EULA.md for Pro purchase terms.

Control coverage

Every control carries its Trust Services Criteria reference, collection cadence, and remediation guidance (soc2_evidence/control_catalog.py).

Important trust boundary

Fission Accountant collects and organizes technical evidence. It does not certify SOC 2 compliance and does not replace an auditor's scope, judgment, policy review, or control testing. Never market an export as an attestation.

The local ledger and the application audit log are hash-chained, which makes tampering detectable. For retention an auditor can evaluate independently, publish snapshots to an S3 bucket created with Object Lock enabled and write them under COMPLIANCE retention.

Architecture

GitHub / AWS / GCP / Google Workspace
            │  read-only API calls
            ▼
    collectors (versioned, per source)
            │  normalized control evaluations
            ▼
    collection service ──► hash-chained ledger ──► optional S3 Object Lock
            │
            ▼
    Postgres (evaluations, artifacts, policies, tasks, audit log)
       │            │                │
       ▼            ▼                ▼
   dashboard   auditor portal   export package (ZIP + HTML)

Quick start — Docker Compose

cp .env.example .env
# Set POSTGRES_PASSWORD, SOC2_ENCRYPTION_KEY, and the collector credentials.
docker compose up --build

The web service migrates the database, seeds the control catalog, and serves the dashboard on http://localhost:8080. Create the first administrator in the browser, then add integrations under Integrations. Compose binds to 127.0.0.1; put it behind HTTPS and your identity-aware proxy before exposing it.

Optional profiles:

docker compose --profile marketing up   # marketing site on :8081
docker compose --profile objectstore up # MinIO for local Object Lock testing

Quick start — Railway

See docs/RAILWAY.md for the full walkthrough. In short: add Postgres, deploy this repository as a web service (FISSION_APP_MODE=product), add a second service running fission-accountant worker, and optionally a third service with FISSION_APP_MODE=site for the marketing pages. PORT is honored automatically and migrations run on boot.

Quick start — CLI

python -m venv .venv
source .venv/bin/activate       # PowerShell: .\.venv\Scripts\Activate.ps1
pip install .

export GITHUB_TOKEN="fine-grained-read-only-token"
fission-accountant collect --github-org your-org --skip-aws
fission-accountant verify
fission-accountant export --output auditor-evidence.zip
fission-accountant license

Useful flags: --fail-on-findings exits 2 after retaining a snapshot that contains failures, --s3-object-lock-bucket publishes an immutable copy, and --gcp-project / --workspace-admin-email enable the Pro sources. When AWS credentials are absent the collector fails fast and records UNAVAILABLE controls instead of hanging on credential discovery.

fission-accountant serve starts the web application, fission-accountant worker starts the scheduler, and fission-accountant init-db migrates and seeds.

Credentials and permissions

• GitHub — fine-grained token with read access to organization administration, members, and repository metadata. Do not reuse a human admin token.
• AWS — read-only IAM, S3, RDS, CloudTrail, Config, GuardDuty, Security Hub, KMS, EC2, and CloudWatch Logs inspection. The Object Lock publisher additionally needs s3:PutObject on the evidence prefix. See docs/AWS-SETUP.md.
• Google Cloud (Pro) — service account with roles/viewer plus roles/iam.securityReviewer, and a JSON key.
• Google Workspace (Pro) — service account with domain-wide delegation for the read-only admin directory scopes, plus a super-admin email to impersonate.

Credentials submitted through the dashboard are encrypted at rest with SOC2_ENCRYPTION_KEY. Set that value before storing any integration, and back it up: without it, stored credentials cannot be decrypted.

Pro licensing

Install a license in the dashboard under License, or mount the file and set FISSION_LICENSE_FILE. Verification is offline and never blocks a request: an invalid or superseded license resolves to Free with a visible notice, and all previously collected evidence stays readable.

Vendors issue licenses with fission-accountant-license — see the release process in OPEN_CORE.md.

Auditor access (Pro)

Create a scoped link under Auditor access, choosing the observation window and validity period. The auditor opens /auditor, pastes the token, reviews control status, and downloads the export package. Links are revocable, and only a hash of each token is stored.

Policy starters

policies/ contains editable access control, change management, incident response, and data retention templates; the same set is seeded into the database for the Pro approval workflow. Replace every {{PLACEHOLDER}}, obtain management approval, and only claim controls that match real practice. These templates are not legal advice.

Development

pip install -e ".[dev]"
ruff check .
ruff format --check .
pytest

CI runs the same lint, format, and test steps on every push and pull request (.github/workflows/ci.yml). .github/workflows/collect.yml is the scheduled GitHub Actions collection workflow for customers who prefer CI-driven runs.

Release checklist

See docs/RELEASE-CHECKLIST.md before publishing a build or selling a license.