Why We Built Aegis Firma

A few years ago, I made a decision: I was going to stop building things that didn't matter, and build one thing that did.

I have two daughters. I wanted to build something real — something that solved a problem I genuinely believed in, and something durable enough to keep running and keep serving its customers for the long haul. Not a quick flip. Not a side project. A product that earns its place.

The problem I chose is one most people don't think about until it's expensive: compliance.

The actual problem

Every company that uses AI — which is now almost every company — is subject to a growing set of laws they probably don't fully understand. The EU AI Act. CMMC for defense contractors. GDPR, CCPA, and a growing wave of state privacy laws. ADA website accessibility. The list is long, and it keeps getting longer, and it changes.

The standard answer to this problem has always been: hire lawyers. Or hire compliance consultants. Or buy expensive enterprise software that requires a dedicated admin team to operate.

Those answers work if you're a large company with a compliance team. They don't work if you're a 30-person defense subcontractor, or a 50-person SaaS company selling into Europe, or a small healthcare tech startup facing HIPAA and EU AI Act simultaneously.

The founders I kept meeting — smart people, good products — were spending $50,000, $80,000 on compliance lawyers just to understand what the law required. Then spending again when the law changed. Many of them couldn't afford it. But the regulators came anyway.

Why compliance software has been bad

Most compliance software is built for the enterprise. The sales cycle is 6 months. The implementation is 3 months. The annual contract is $80,000. It assumes you have a dedicated compliance officer, a GRC team, and an IT department.

The enterprise software companies aren't wrong to target enterprises — that's where the money is. But it leaves everyone else without a real option. SMBs get told to either spend money they don't have on consultants, or use a compliance checklist spreadsheet that's immediately out of date.

There's also a structural problem: most compliance software treats compliance as a documentation exercise. Upload your policy. Check the box. Generate a report. But documentation isn't the same as compliance. A company with a beautiful GDPR policy document and no actual data protection controls isn't compliant — they're just better at paperwork.

What we built instead

Aegis Firma is built around real evidence, not paperwork. You collect proof that your controls are actually implemented and store it in a cryptographically signed evidence vault, organised against the control it satisfies. Not documents that describe what you intend to do. Evidence — the kind a C3PAO assessor or EU regulator actually checks. (Automated evidence connectors for Microsoft 365, Okta, and AWS are on the roadmap.)

It tracks 169 jurisdictions of AI compliance law — from the EU AI Act to CMMC to state privacy laws — and monitors regulator websites nightly for changes. When something changes, it tells you what changed, what it means for your company, and creates a task to address it.

It generates your System Security Plan, DPIA, and compliance documentation from your actual evidence — not from stock templates. When the C3PAO assessor asks for the document, the narrative cites your actual systems. That matters.

And it costs what a small company can actually afford to pay. Not $80,000. Not even $10,000. A monthly subscription that you cancel anytime.

The honest version

We're not done. The product I want to build is bigger than what we have today. The 10-month roadmap still has months left.

We're one person building something that replaces what a whole compliance department does. That's ambitious. It may be too ambitious. But I'd rather try and ship something real than spend years building something no one can use.

If you're a defense contractor trying to get CMMC Level 2 before a contract deadline, try the free assessment. If you're selling into Europe and worried about EU AI Act enforcement, run the free classification check. If you get value from it, pay for it. If you don't, don't.

That's the whole pitch.