Every cloud compliance tool begins with the same negotiation: another data-processing agreement, another data-breach notification clause, another series of questions about where your evidence actually lives. Compass takes a different starting point — your evidence stays on your machine.
The DPA Tax of Cloud GRC
Every time a team adopts a cloud-based GRC or compliance platform, the first deliverable isn't a configuration — it's a data-processing agreement (DPA). Then a data-breach notification addendum. Then a sub-processor list. Then a jurisdiction assessment for each region the vendor's infrastructure touches.
For teams operating across multiple regulatory regimes, these documents multiply. A US-based SaaS vendor serving a European customer needs GDPR-compliant data processing. A vendor whose infrastructure runs through AWS Frankfurt may need a different commitment than one running through us-east-1. The compliance team's job — already burdened with frameworks, evidence collection, and audit cycles — now includes vetting the compliance posture of the tool that was supposed to help them.
The deeper issue is architectural. Cloud GRC platforms are built on multi-tenant databases: your policies, evidence artifacts, risk register, and control narratives all reside on infrastructure you do not control, alongside other customers' data. The provider manages security, but the fundamental arrangement requires you to trust their cloud boundary, their access controls, and their incident-response timeline.
This is not a criticism of cloud GRC vendors. Many organizations need shared dashboards, centralized admin, and real-time team access. The question is whether every compliance artifact must follow that model — including the most sensitive documents your organization produces.
| Compliance point solutions | General AI chatbots | Local-first workspace (Compass) | |
|---|---|---|---|
| Evidence collection | Strong | No workspace | Works with your own workspace |
| Produces the output (policies, answers, packets) | Rarely | Fluent but generic | Core — cited output |
| Knows your workspace | Partially | No | Yes — reads your files |
| Admits when it's guessing | n/a | No | Yes — marks "Not Provided" |
| Review/approval gate | Outside the tool | None | Built in (pending changes) |
| Data location | Cloud/SaaS | Vendor cloud | Local, BYOK |
What "Local-First" Actually Means for Trust Work
Local-first software stores data primarily on the user's own device rather than on remote servers — a concept formalized in the 2019 Ink & Switch manifesto and adopted by a growing number of application developers. For a compliance tool, this translates into specific architectural choices:
Native desktop application. Compass runs on macOS and Windows as a native Tauri/Rust/React app. There is no web client, no browser-based workspace, and no background sync to a vendor-hosted server. The application and its data live on your machine.
Local SQLite workspaces. Every policy, evidence artifact, risk entry, control narrative, and framework mapping is stored in a local SQLite database on your computer — not in a cloud database, not in a vendor's S3 bucket, not in a shared multi-tenant cluster. You control the database file.
Telemetry off by default. No background telemetry, no usage-data collection, no "product improvement" pipeline that ships your interaction patterns to a vendor's analytics stack. Telemetry is off unless you explicitly opt in.
Bring your own key. Compass does not mark up API tokens or lock you into a single model provider. You bring your own API key for OpenAI, Anthropic, DeepSeek, or any OpenAI-compatible endpoint, or you run local models through Ollama, LM Studio, or MLX. The choice of model — and the cost of running it — is yours. No vendor key margin, no per-token surcharge.
The harness works locally too. Hallucination catching, fabrication blocking, grounding in your own documents, and the "Not Provided / no source found" behavior — the entire compliance harness runs against your local workspace, not against a vendor-hosted knowledge base. Every claim carries a citation to your document or evidence ID.
The Honest Trade-Off
Local-first is not universally better than cloud. It is better for specific work, and the trade-offs are worth stating directly.
No shared cloud dashboard. Because data stays on individual machines, there is no live multi-user dashboard, no org-wide view of active risks, no centralized admin console where leadership can see every team's compliance status in real time. Collaboration happens through exported artifacts: you share a risk-treatment plan, an evidence summary, or a framework crosswalk as a document, not as a shared view into a live database.
Multi-machine sync is manual. If you work across a desktop and a laptop, there is no automatic sync, no cloud relay that keeps both machines current. You move your workspace file or work from a single machine. (The signed .compass artifact format and cross-machine sync are areas the team is actively exploring, but they are not shipping features today.)
No SaaS-style instant onboarding. There is no "sign up, invite your team, start collaborating in five minutes" flow — because Compass is not a SaaS product. The setup is: download, create a workspace, import your documents, add your model key. You trade frictionless onboarding for full data control.
These are real limitations. They matter less for teams that already work with exported evidence packages, single-machine audit prep, and document-based review cycles — and they matter not at all for practitioners whose primary concern is keeping evidence on their own infrastructure.
Who This Architecture Matters Most For
Fully regulated industries. Financial services, healthcare, and government entities often operate under data-sovereignty requirements that make cloud uploads complicated or impossible. A local-first compliance tool removes whole categories of due diligence — no third-party attestation to review, no data-center location to verify, no sub-processor chain to map.
Global teams navigating conflicting data laws. Over 65 countries have enacted data localization laws requiring that certain data types be stored within national boundaries. For a compliance team serving multiple regions — EU (GDPR), India (DPDP Act), China (PIPL), Russia (Federal Law 242-FZ) — a cloud tool's data center locations can become a compliance constraint. A local-first workspace sidesteps the question entirely.
Solo practitioners and small teams. The vCISO managing several clients, the privacy consultant preparing DPIA deliverables, the compliance manager running a single-framework programme — these practitioners need the power of AI-assisted drafting without the overhead of a shared platform. Local-first gives them the harness without the shared-infrastructure complexity.
Teams that already export everything. Many trust professionals already work in exported document workflows: policies as PDFs, evidence as file attachments, risk registers as spreadsheets sent by email. A local-first tool that produces cited, reviewable artifacts matches the way they already operate.
FAQ
What about backups? Can I lose my workspace? Your workspace is a regular file on your machine. Back it up like any other critical document — Time Machine, rsync, cloud storage of your choice. Compass does not hold a copy on its servers, because there are no servers holding copies.
Can I use Compass across multiple machines? Not with automatic sync today. You can copy your workspace file between machines, but real-time multi-device sync across the local-first architecture is a forward-looking area of work. For context on how Compass's architecture differs from cloud-based tools, see the positioning comparison above.
Does local mean I lose AI assistance offline? If you run a local model (Ollama, LM Studio, MLX), the full harness works without internet access. If you use a cloud API like OpenAI or Anthropic, you need a connection for inference — but your workspace data never leaves your machine during the process.
Is there a cloud option if my team needs it later? Compass is designed as a local-first desktop application and there are no current plans for a cloud-hosted version. The product's trust stance — "control before scale" — is architectural, not temporary.
What happens if my machine is stolen? The local SQLite file is encrypted at rest by your operating system's native encryption (FileVault, BitLocker). Your API keys are stored in the OS keychain. No data is accessible from a vendor's cloud because no data exists in a vendor's cloud.
Compass by Truvara is built on a local-first architecture by design, not by constraint. The product's starting position is that your policies, evidence artifacts, risk register, and control narratives should live on your machine — not in someone else's cloud database. The compliance harness — hallucination catching, citation-backed drafting, pending-change review, honest-gap marking — runs against your local workspace. Collaboration happens through exported artifacts, not a hosted dashboard. If a shared live view of your compliance programme is essential, Compass's current design may not fit; if keeping your evidence on your own infrastructure is a requirement, it is built from that starting point. Join the waitlist to try the preview.