For everyone evaluating CME

We're building the audit tool we wished existed.

Every compliance tool we'd used — vendors and the in-house spreadsheets at three different employers — encoded framework controls by hand. Engineers wrote rule files. PMs prioritized which controls to add this quarter. Re-reading NIST was an "engineering exercise." That isn't how compliance should work.

CME is the bet that an LLM agent — given a clean framework corpus, an AWS environment, and the customer's own published claims — can reason about compliance better than a hand-coded rule library. We don't maintain the controls. We maintain the corpus and the loop. New version of NIST drops, we re-ingest the document.

We're AWS-only on purpose. Depth beats breadth when the agent has to reason about Organizations + Identity Center + KMS policies + Bedrock guardrails in the same audit. Three-cloud breadth would dilute the brain.

What we believe

01
Compliance is reading + reasoning, not pattern-matching.
The agent reads the standard. The standard doesn't need to be re-encoded into our internal DSL.
02
Every finding cites its evidence.
Auditors don't accept a black box. We persist the corpus chunks + the AWS API observations behind every claim.
03
Your trust page is also an asset.
What you publicly committed to is the most valuable hypothesis source we have. We mine it before we touch the framework controls.
04
Pricing follows audits, not resources.
If you grow from 50 to 5,000 EC2 instances, your audit bill shouldn't 100x. It shouldn't move at all.
05
No Azure, no GCP. Yet.
AWS depth is the wedge. Multi-cloud is a future-Series-B problem; today the obsession is doing one cloud right.

Where we are

Pre-launch as of May 2026. SOC 2 + pen test are on the roadmap; we'll update this page when we engage an auditor. Currently onboarding design partners under NDA — see /contact if that's you.

The team

We're a small group with backgrounds at AWS, Datadog, Anthropic, and a couple of regulated-industry shops. Hiring slots on the careers page.