compliventory

The company’s vendors and systems, accounted for.

Get started How it works

The problem

Every company runs on third parties and internal systems — Slack, AWS, the HR portal, that CRM nobody remembers buying. Someone has to know what is in use, who is accountable for it, where the data lives, and how risky it is — for security reviews, for GDPR records of processing, for the auditor who asks “show me your vendor register”. Spreadsheets go stale the week they’re written.

What compliventory does

compliventory is a self-hosted inventory of vendors and systems that stays current because keeping it current is cheap:

  • Any employee can submit a new vendor/system or propose an edit — no gatekeeping at the door.
  • Change control routes every change to the right reviewer: new entries and compliance-gated (⚖) fields go to the compliance team; regular edits by non-owners go to the asset’s owner; owner/delegate edits apply immediately.
  • Everything is audited — who, what, when, the diff, and the justification, in an append-only log.
flowchart LR
  E["Any employee<br/>submit / propose"] --> CC{"Change<br/>control"}
  CC -->|"new entries, ⚖ fields"| C["Compliance team"]
  CC -->|"regular fields,<br/>non-owner edit"| O["Owner / delegates"]
  CC -->|"owner's regular edit"| A["Applied immediately"]
  C --> A
  O --> A
  A --> L["Audit log"]

It is the companion product to governauthzer: compliventory owns the asset catalog (what exists, who owns it, how sensitive it is), governauthzer owns access decisions. Deliberately a separate product, not a module.

Early stage. The inventory MVP is feature-complete; vendor assessment and GDPR RoPA (Art. 30) records are planned on top of it.

Start here