Compliance infrastructure
built for accountability
Written in Adelaide since 2022, for regulated teams who need more than a spreadsheet to prove they are in control.
Why an engineer built this
Ejaz Hussain
Founder & Chief Engineer
Adelaide · building FormaOS since 2022
FormaOS is my first project in compliance infrastructure. I've been writing it from Adelaide since 2022, fitting it around freelance work: websites and web apps for whoever was paying that month. FormaOS was always the bigger thing, the one I actually cared about. I just needed the freelance to fund the runway.
Compliance picked me as much as I picked it. Australian regulators have spent the past decade tightening expectations on NDIS providers, aged-care operators, healthcare networks, and AFS licensees. The software answering that pressure has, almost without exception, stayed at the level of a document repository with a workflow tab on top. I kept looking at it and thinking the actual problem was an engineering one. There was no executable layer connecting an obligation to a control to a task to a piece of evidence to an auditor who could verify any of it. Nobody was building that. So I started.
Today FormaOS ships 286 control evaluators across 11 framework packs covering 10 standards: NIST CSF, CIS Controls, SOC 2, ISO 27001:2022, GDPR, HIPAA, PCI DSS, AU Financial Services, NDIS Practice Standards, National Mental Health Standards. Of those, 124 evaluate automatically against your live data and the other 162are surfaced as human attestations, labelled as such. The audit log is hash-chained in Postgres, with append-only enforced at the database layer by an immutability trigger and RLS deny policies, not application code, and the chain head anchors daily at 05:30 UTC to Sigstore Rekor, the same transparency log the Linux Foundation uses for signed open-source releases. It's bootstrapped, sole-engineered, AU-hosted. The roadmap is short on purpose.
Why FormaOS exists
Regulated organisations face a structural gap: governance requirements that grow faster than the tools available to meet them.
The goal
Operational clarity for regulated industries: controls, evidence, and accountability connected in one compliance operating system.
Why it matters
Regulators expect defensible evidence, not just documentation. FormaOS provides the audit trail and proof required to protect leadership teams and their organisations.
The problem it solves
Compliance teams are stuck managing obligations across spreadsheets, shared drives, and disconnected tools, with no single source of truth when auditors arrive.
The commitment
FormaOS is built for the organisations where compliance failure has real consequences: clinical, financial, reputational. That accountability sets the bar for what ships.
What this is built on
These are not aspirational values on a poster. They are the engineering decisions that shape what ships.
Transparency over promises
Security review material is available early in evaluation. The architecture, encryption, and operating controls are documented plainly, and anything restricted is handled deliberately rather than oversold in public copy.
Infrastructure over features
This is compliance infrastructure, not a feature checklist. Every capability connects to the operating model: controls link to evidence, evidence links to owners, owners link to audit trails.
Execution over documentation
Documentation without execution is liability. FormaOS enforces compliance as work: tasks with deadlines, evidence with verification, controls with named owners, not PDFs in a folder.
Accountability over aspiration
FormaOS is built for organisations where compliance failure has real consequences: sanctions, registration loss, enforcement action. It is designed for the teams regulators hold accountable.
What ships today
Counts from the running product, not customer outcomes. There are no deployments to report yet, and every number here can be checked in the product during evaluation.
Installable and scored, covering 10 distinct standards. SOC 2 ships as two packs, which is why the two numbers differ
Each one carries its framework reference and the evidence it expects, so a gap is visible before an auditor finds it
Evaluated against your live data. The remaining 162 evaluators need a person to attest, and say so on screen
The hash-chained audit log anchors its head to Sigstore Rekor every day, so an event can be verified without trusting us
Who it is built for
FormaOS is built for organisations operating in regulated environments where accountability is mandatory, not aspirational.
Healthcare Providers
Clinical governance, credentialing, incident response, and accreditation evidence
AHPRA, NSQHS, RACGP, Privacy Act
NDIS & Aged Care
Practice standards compliance, SIRS reportable incidents, worker screening
NDIS Commission, Aged Care Quality & Safety Commission
Financial Services
Regulatory breach reporting, CPS 234 controls, board governance evidence
ASIC, APRA, AUSTRAC, AML/CTF Act
Government Bodies
Protective security obligations, information security controls, audit readiness
PSPF, ISM, Essential Eight, Privacy Act
Education & Workforce
Quality framework compliance, workforce credentials, WHS obligations
ACECQA, NQF, WWC, SafeWork
Technology & SaaS
Information security governance, vendor assurance, continuous compliance
ISO 27001, SOC 2, GDPR, HIPAA
The audit trail never lies
Every action timestamped, attributed to a role, and preserved, exactly as regulators expect. Illustrative sample.
See the compliance operating system in action
Request a scoped compliance plan and evaluate FormaOS against your own operating requirements: your frameworks, your controls, your evidence.