Overview
S.E.T (Secure · Enforce · Train) is a multi-tenant security-posture & compliance (GRC) platform, delivered as two portals:
Brand & UI/UX
Locked design direction: Neumorphism (soft UI). The interface is built from a single tinted surface, with depth created entirely by paired soft shadows — a light highlight top-left, a darker shadow bottom-right. Elements that are actionable or elevated are raised (extruded out of the surface); inputs, active states, progress tracks and wells are inset (pressed into it). Both a light and a dark theme ship first-class.
Tech Stack
This section is being locked item by item via discussion. Each item below shows the Decision, the Why, and the Field signal (what comparable compliance SaaS run today, based on 2025–2026 research across Vanta, Drata, Scytale, Secureframe, Sprinto, Hyperproof, Wiz, Snyk, Thoropass).
Architecture
This section describes the production architecture (one region). Environment topology (dev / nonprod / production / Phase 2 IL) is covered separately — see the "Environments" section.
Authentication & Identity
- Provider: WorkOS (with AuthKit for hosted login UI)
Multi-Tenancy
Model: Schema-per-Tenant ✅ Locked
Observability & Logging
Two distinct logging tiers, each serving a different audience.
Data Model
This section documents the domain data model — the entities, their relationships, and the conventions every table follows. It reconciles two things:
Environments
Two-tier model — nonprod + prod — on AWS using an AWS Organizations multi-account structure. Referenced by the Architecture and Supply Chain & CI/CD Security sections.
User Flows — Admin
Status: Admin portal — complete. Customer portal — now detailed from the updated MVP code (zip dated 2026-05-25). Screens that are still genuine placeholders in the code are marked [PLANNED — not yet built] with their intended purpose. Written in plain language (no technical/function detail) for inclusion in the formal document.
User Flows — Customer
Used by the MSSP's clients. Mostly read-only — real inputs are filling assigned questionnaires, uploading documents/policies, building org structure, managing the vendor list, and ticking off remediation steps. Organized as 6 top domains (Compliance, Security, Supply Chain, Training, BCP, Monitoring), each with its own sub-menu. Clicking a domain swaps the left sidebar to that domain's sub-tabs and opens its main dashboard.
Report & PDF Generation
The formal, multi-section compliance report is the headline deliverable the client pays for — and the Final Report plus many smaller printable reports (system analysis, data-flow, supply-chain, process cost) all render to PDF. Reports are produced in one selected language at a time — Hebrew (default), English, Arabic, Russian, or French — so the engine must handle right-to-left (Hebrew, Arabic), mixed bidirectional text, and embedded fonts for all five scripts. This page locks that engine.
Notifications & Scheduled Jobs
The product's flows imply a steady stream of user-facing events — document awaiting review, questionnaire assigned, response needs revision, policy approved, report ready, member invited, vendor questionnaire assigned — and one business-critical scheduled job: a client's portal access auto-expires one year after creation (the "Annual License Expired" wall), the recurring-revenue lever. This page locks the notification subsystem and the scheduling mechanism behind it.
Testing & QA
The Architecture commits to "automated cross-tenant isolation tests in CI on every deploy." This page defines the full test strategy around that — the layers, the tools, defensible coverage targets, how a schema-per-tenant compliance product proves isolation, how an LLM-heavy product tests non-deterministic output, and the CI gate that blocks a bad merge. Correctness and tenant isolation are paramount (SOC 2 / ISO 27001 / Amendment 13), and the SET scope budgeted zero QA hours — this page is the corrective.
Search
A GRC platform is document-heavy multilingual full-text quality (Hebrew especially) and tenant isolation — a cross-tenant leak in a compliance product is catastrophic. This page locks the search approach and its graduation path.
Downloads & Reports
Interactive and downloadable artifacts that accompany the specification.