Scrutora

Many compliance tooling checks whether you wrote the right policy. Scrutora checks what your code actually does. It's a compliance evidence platform for teams shipping regulated software in healthcare, fintech, and AI. It scans across four surfaces, application code (AST-level analysis with interprocedural taint tracking, not regex), infrastructure-as-code, cloud posture across AWS/Azure/GCP, and consent/data-flow, then maps every finding to a specific clause: DPDP Rule 6, HIPAA §164.312, GDPR Article 32, and 19 more frameworks in all. The core idea: give away detection, charge for evidence. The CI scanner runs free, fully offline, no login, no API key, your code never leaves your runner, and outputs SARIF into GitHub, GitLab, CircleCI, Azure DevOps, Bitbucket, and pre-commit. Paid plans add the layer auditors and customers actually ask for: clause-mapped PDF evidence reports, per-commit history, Claude-powered remediation with copy-paste fixes, sensitive data-flow analysis, and a PR bot. Why it matters now: India's DPDP Rules make security-safeguard obligations enforceable around May 2027, and HIPAA has been enforced for two decades with penalties running into the millions per incident. The gap is the same under both: teams write the policy, then ship code that contradicts it. Scrutora turns "we have a policy" into "here is machine-verified proof, per commit, that our software does what the regulation actually requires." Free forever tier, no credit card. Paid from $40/developer/month.