I have been building
this one thing since 2022
FormaOS is my first project in compliance infrastructure. I write it from Adelaide, around freelance work, for the teams Australian regulators hold to account.
The audit log signs itself.
FormaOS anchors it daily to a public transparency tree so a regulator can verify any event without trusting me.
Every tool I looked at stored the documents.
None of them ran the work.
I started by reading the actual instruments: the NDIS Practice Standards, the Aged Care Quality Standards, ISO 27001 Annex A, the SOC 2 trust services criteria. Then I looked at the software that says it covers them. Almost all of it is a document library with a workflow tab bolted on.
The obligations are not really about documents. They are about who did the thing, when, whether that person was still credentialed at the time, and whether anyone can show it six months later.
What that leaves behind:
None of that is a documentation problem. It is a missing execution layer, and I could not find anyone building one.
What I built instead
FormaOS stores documents too. The difference is that a document is the end of a chain, not the product.
I built it around one rule:
“Compliance should be embedded in how the work is done, not reconstructed after it is done.”
In practice, an organisation can:
The evidence becomes a by-product of the work, instead of a project that starts when the auditor books a date.
I am not a compliance consultant.
That turned out to matter.
I read a standard the way I read a spec: what triggers this, what is the deadline, who is accountable, what proves it happened. Most clauses turn out to be a state machine with a due date attached, which is a thing software is good at.
So the whole product answers one question:
“Can an organisation prove, at any moment, that it is operating in line with its obligations?”
That answer has to hold on an ordinary Tuesday, not only in the week before an audit. It is why the audit log is hash-chained in Postgres with append-only enforced by a database trigger and RLS deny policies rather than application code, and why the chain head is anchored daily to Sigstore Rekor. A regulator can verify an event without taking my word for it.
The four decisions everything else follows from
None of these are settings. They sit in the schema, which is the reason they are hard to switch off when a deadline gets tight.
Governance by design
Compliance is embedded into workflows
Evidence by default
Actions generate audit-ready records automatically
Ownership at every level
Accountability is visible, measurable, and enforceable
Real-time verification
Controls are continuously validated, not reviewed once a year
Passing the audit is the easy consequence. The harder one is answering a question about last March without three people digging through a shared drive.
What I am building towards
The goal has not changed since the first commit:
Turn a regulatory obligation into work that gets done, and evidence that survives review.
A system that does this properly should:
FormaOS is bootstrapped, sole-engineered and AU-hosted. The roadmap is short on purpose.
If a feature does not make an obligation easier to run and easier to prove, it does not get built.
See whether it fits
how your team already works
There are no customer logos on this page yet. What I can do is walk you through the product against your own obligations and let you judge it from there.
If your evidence currently lives in a shared drive and a spreadsheet, that is the gap this was written for.