Skip to content
ComplianceOSSign in

Under the hood

For the person who asks how it actually works.

IT leads, security reviewers and CTOs: this page is for you. ComplianceOS is a browser console, an application tier, one Postgres database and an agent on every device. Here is what each one runs, how they talk, and why it is built that way.

database migrations
305
Postgres tables
117
row-level security policies
230+
edge functions
28
scheduled database jobs
10
operating systems, one agent
3

01The system

What connects to what.

Five layers, top to bottom. The console and the agent never talk to each other directly: everything meets in the database, behind its access rules.

  1. 01Console

    React in the browser, server-rendered first

    • React 19
    • TanStack Router
    • TanStack Query
    • Tailwind CSS 4 · shadcn/ui

    Console ↔ Application · DataHTTPS · server functions · supabase-js under RLS

  2. 02Application

    Cloudflare Workers or Docker, plus Deno edge functions

    • TanStack Start on Nitro
    • 37 server functions
    • 28 Supabase Edge Functions
    • Installer & backup downloads

    Application ↔ DataSQL · RPC

  3. 03Data

    Supabase: Postgres, Auth and Storage

    • Postgres · 117 tables
    • Row-level security
    • pg_cron · Vault
    • Auth · Storage

    Data ↔ Devicesoutbound HTTPS · per-agent tokens

  4. 04Devices

    SentinelGo, a native service on each machine

    • Windows · macOS · Linux
    • PowerShell · Bash
    • 8 package managers

    Application ↔ OutsideOAuth 2.0 · REST · syslog over TLS

  5. 05Outside

    Systems you already run, each optional

    • Microsoft Entra ID
    • Odoo HR
    • NVD
    • Wazuh
    • AI gateway
    • S3 · SFTP

02Principles

Four decisions that shape everything else.

  1. 01

    The database decides who sees what

    Role and ownership checks live in Postgres as row-level security, more than 230 policies of them. The app isn't the only thing standing between a person and data they shouldn't see.

  2. 02

    Typed from the button to the table

    TypeScript types are generated from the database schema and shared by the console, the server functions and the edge functions. Zod checks what crosses each boundary.

  3. 03

    Devices pull; nothing pushes in

    The agent opens every connection, outbound over HTTPS. No inbound ports and no VPN, so a laptop on hotel Wi-Fi still checks in.

  4. 04

    Nothing unsigned runs

    Agent releases are Ed25519-signed and checksummed with SHA-256. A command's script is snapshotted when it is sent, so what runs is what was approved.

03End to end

One command, traced through the whole system.

The same path carries app installs, policy actions and alert remediations.

  1. 1Console

    An admin picks a script

    From the command library, for one device or a group, with variables filled in.

  2. 2Data

    It is queued

    A database function checks the admin's permission and stores a task holding a snapshot of the exact script.

  3. 3Device

    The agent asks for work

    SentinelGo checks in over HTTPS with its own short-lived token and picks the task up.

  4. 4Device

    It runs

    PowerShell on Windows, Bash on macOS and Linux, under a timeout.

  5. 5Data

    The result comes back

    Exit code and output are stored against the task, for the admin to read.

  6. 6Console

    It stays on the record

    Who sent what, to which device, and what came back, kept for the next audit.

04The stack

Chosen deliberately, and kept small.

Mainstream, well-supported tools, so the next engineer who opens the code already knows most of it.

Interface

  • React 19The console and the employee portal
  • TanStack RouterFile-based, fully typed routes
  • TanStack QueryServer state, caching and refetching
  • Tailwind CSS 4Design tokens, light and dark themes
  • shadcn/ui · RadixAccessible primitives we own
  • react-hook-form · ZodForms validated by one schema

Runtime and hosting

  • TanStack StartServer rendering and server functions
  • NitroThe server runtime underneath
  • Vite 7Dev server and production build
  • TypeScript 5Across the console, server and functions
  • Cloudflare WorkersDefault deploy, via Wrangler
  • DockerFor self-hosting on your own servers

Data

  • Supabase Postgres117 tables, 305 migrations
  • Row-level security230+ policies enforced in the database
  • Supabase AuthMicrosoft Entra SSO and email sign-in
  • Supabase StorageInstallers, icons and backups
  • pg_cron10 scheduled jobs: alerts, backups, cleanup
  • Supabase VaultIntegration secrets, encrypted at rest

Agent and functions

  • SentinelGoOne native agent for Windows, macOS, Linux
  • Ed25519 · SHA-256Signed, checksummed agent updates
  • PowerShell · BashCommands, with {{variables}}
  • winget · Homebrew · apt…Installs through native package managers
  • Supabase Edge Functions28 Deno functions: agent sign-in, scans, sync
  • .msi · .pkg · .debPer-platform installers, built on demand

Integrations

  • Microsoft Entra IDSingle sign-on, device owners, MFA status
  • Odoo HREmployee directory sync
  • NVDCVE data matched to installed versions
  • WazuhEvents forwarded as syslog over TLS
  • AI gatewayAny OpenAI-compatible endpoint, Ollama too
  • S3 · SFTPScheduled backups, restored per table

Reports and tooling

  • RechartsDashboards and compliance trends
  • MonacoThe script editor
  • jsPDFPDF summaries for auditors
  • BunPackage manager and test runner
  • ESLint · Prettier · HuskyChecked before every commit
  • Supabase CLIMigrations, types and local database