HFI GRC Work OS — TL;DR Brief

Internal leave-behind. A working self-assessment, not a third-party attestation. Last updated July 2026.

One line: A GRC practitioner workspace — a cohort training program on one side, and a NIST-based compliance reference + client-engagement toolkit on the other — in a single login, with assistive (human-reviewed) AI.

1. What the product does (major functions)

A. Practitioner Program — training / career

• 7-week cohort program hub: current week, progress, full roadmap
• Weekly flow: lessons → live session (Zoom attendance/recording sync) → apply (labs, quizzes, workbooks) → resources
• Hands-on scenario labs, interview prep (strategy/glossary/spoken practice), career + certification tracking, opportunities feed

B. GRC Reference Platform — the "Work OS"

• NIST 800-53 catalog (287 controls) with HFI-authored practitioner guidance
• Anti-pattern catalog (17), implementation guides, cross-framework crosswalks (NIST ↔ CMMC ↔ GovRAMP), MITRE ATT&CK mappings (~30 techniques)
• GovRAMP readiness suite (readiness workspace, evidence guide, tool map, procurement pack, checklist), evidence/tools/resources libraries, Cmd-K palette

C. Client Engagements console (Deliver) — consulting delivery — live on a real multi-tenant backend

• Engagement Overview — the per-client landing hub: shows where a client stands across the whole lifecycle (five stages, live status), the countdown to the quarterly PMO submission, and the latest PMO result — then links straight into whatever's next
• Lifecycle workspace per client: new engagement → intake (async tool assessment or live readiness checklist, same question bank) → Control 360 (per-control evidence status, the working table) → tool coverage → Snapshot Roadmap (submission plan) → evidence checklist → Findings & Gaps register
• Framework-agnostic gap assessment (crosswalk-credited) writes findings to a tenant-scoped table; multi-client portfolio, sprint cadence, evidence aging, score history, monthly review, handoff, templates; Markdown / Word / PDF export

D. Admin & platform plumbing

• Full admin console (weeks, cohorts, calendar, recordings, comms, labs, submissions, users, control authoring)
• Auth with role/persona gating (admin / member), Stripe payments, transactional email, Supabase backend with row-level security

One-liner for the room: "It's a GRC practitioner workspace — cohort training on one side, a NIST-based compliance reference and client-engagement toolkit on the other, in one login."

2. HarvestAI (the AI)

• Models: Anthropic Claude Sonnet 4.5 (drafting, narratives, Q&A) and Claude Haiku 4.5 (lab feedback, recording enrichment). Anthropic only — no OpenAI.
• Where it runs: server-side only, inside Supabase edge functions. The browser never holds the key.
• Grounding: every call ships a slice of our own vetted reference data and is told to cite control IDs only from it. No internet, no browsing.
• Two-lane boundary: HarvestAI in tutor mode (Learn) is grounded only in the public control library (zero path to client data); in working mode (Deliver) it sees the active client. The two never cross.
• Human-in-the-loop: every output is a draft for review; the scoring and mappings underneath are deterministic, not generative.
• Training: per Anthropic's API terms, inputs/outputs are not used to train models; zero-data-retention available.

One-liner: "HarvestAI: assistive AI that drafts and explains, grounded in our own content and kept server-side — not an autonomous agent, and never trained on client data."

3. Data flows & boundaries

• Path: Browser (React/Vite on Vercel) → Supabase (Postgres + RLS, Auth, edge functions). The backend is the only thing that calls AI or any integration — never the browser.
• Always-on subprocessors: Anthropic (AI), Supabase (DB/auth/functions), Vercel (hosting), Stripe (payments), Resend (email).
• Optional, tenant-connected (only when an admin connects them with the tenant's own credentials): Box & Microsoft 365 (evidence, metadata only), HubSpot (CRM, one-way), Zoom + Bunny Stream (recordings).
• We hold: control mappings, evidence metadata & notes, assessment results, accounts.
• We do not hold: CUI; raw evidence files (stay in the client's Box/SharePoint); card data (Stripe); AI training data.
• Isolation: real tenant model (tenant_id + eb_tenant_members) with row-level security on every eb_* table — including the formerly-legacy per-client tables, now migrated onto the tenant model (July 2026); US-based hosting.

One-liner: "Client data stays in the workspace behind row-level security; AI and integrations are called only server-side; sensitive files and payment data never touch our database."

4. IP, licensing, attribution & sources

• Built from scratch, not forked: started from the standard open-source React + Vite + shadcn/ui starter; the data model, GRC content, program system, client-engagement tooling, and design system are original HFI work. LICENSE is proprietary — "All Rights Reserved" to HFI.
• No copyleft anywhere: all 59 runtime dependencies are MIT / ISC / Apache-2.0. Verified zero GPL/AGPL in the tree — nothing obligates us to open-source our code. (This is the question a licensing-savvy reviewer will probe; we're clean.)
• Commercial services, free SDKs: Stripe and Supabase — we pay for the service, not the code. Fonts (Inter, Space Grotesk, Plus Jakarta Sans) are SIL Open Font License, free for commercial use.
• Third-party content/data, all referenced legitimately:
  • NIST 800-53 / 800-171 — U.S. Government, public domain.
  • MITRE ATT&CK — free to use with attribution (MITRE keeps the trademark).
  • cmmc-advisor enrichment (~80 controls) — MIT-licensed; credit surfaced in-product via the EnrichmentAttribution component, satisfying the MIT attribution requirement.
  • Framework names (NIST, CMMC, FedRAMP, GovRAMP, MITRE) — descriptive nominative use; no implied endorsement.
• Auditable: every source, license, pinned commit, and last-verified date lives in THIRD_PARTY_NOTICES.md, with an automated upstream-drift check (scripts/check-upstream-drift.ts).

Two things to confirm internally before saying "100% original":

1. The ported-in Evidence Builder and ServiceNow IRM modules — confirm they originated as HFI work (or a source we own / permissively licensed). They're the only pieces not authored line-one in this repo.
2. The cmmc-advisor overlay (~80 controls) is fine and attributed — accurate framing is "ours, built on an MIT-licensed source we credit," not "invented from nothing."

Bottom line you can deliver: "It's our proprietary application, built on standard open-source web building blocks licensed for commercial use with no copyleft strings. The compliance content maps to public standards like NIST and MITRE that are free to reference, and wherever we built on an outside open-source dataset, we credit it in the product as its license requires."

5. Maturity caveats (so nothing catches you out)

• Not independently certified — self-assessed against the GovRAMP / NIST 800-53 baseline (the same standard the platform helps clients meet). No SOC 2 / FedRAMP of our own yet.
• Client Engagements console is now live on a real backend — the old static sample dataset is gone; the Deliver workspace reads and writes real, tenant-isolated Supabase tables (eb_*) with row-level security. What's not yet done: a full engagement run through it with a real client's data end-to-end — that first live engagement is the validation step, not a missing backend.
• Gap-assessment findings now persist server-side in a tenant-scoped eb_gap_findings table, wired to the Findings & Gaps register (the crosswalk runner writes them; a re-run replaces that client + framework's findings). The write→register round-trip is shipped but not yet exercised by a real engagement.
• No enterprise SSO (SAML/OIDC), no third-party pen test, not cleared for CUI — all on the roadmap. (An application audit log now exists — a consolidated, tenant-scoped eb_audit_log; a formal 90+ day retention SLA is the remaining piece.)
• IP/ownership between the builder (Harvest & Fort) and the organization should be documented before any licensing conversation. (Not legal advice — worth a look at the employment/IP agreement.)