From checkout to a passing gate.

1. Activate your team

On the activation page, enter your checkout email — it shows how many engineer accounts your plan includes and how many are in use. Add each engineer's GitHub username, now or whenever someone joins; every one receives a read-only repository invitation from terrasov. Startup includes 5 accounts, Company 15; if you outgrow them, ask.

2. Clone and look around

git clone https://github.com/terrasov/library.git
cd library && cat docs/getting-started.md

docs/getting-started.md covers deployment order (org foundation first, baselines next, workload modules last) and what each module costs to run.

3. Pin modules by tag

Every module is released with its own semver tag. Reference them pinned — never track main:

module "data_bucket" {
  source = "git::https://github.com/terrasov/library.git//modules/s3-secure?ref=s3-secure/v1.2.0"

  bucket_name         = "acme-prod-customer-data"
  kms_key_arn         = module.kms.key_arn
  data_classification = "confidential"
  environment         = "prod"
}

The secure posture is not configurable — if a setting matters to a control, the module enforces it and the annotation above the resource cites the exact clauses.

4. Install the gate

Copy workflows/gate.yml from the library into each repo that holds Terraform, and point it at the policy pack. From then on, any pull request that breaks a control fails with a review comment citing the violated clauses across all six frameworks — the reviewer argues with the regulation, not with a colleague.

Want to see it before subscribing? The public gate-demo repository keeps an open pull request that the gate is failing right now, clause citations included.

5. Evidence day

python tools/collect_evidence.py --framework iso27001

The collector runs every control's live AWS CLI check against your account and writes a timestamped bundle — bundle.md, per-control JSON, and a sha256 manifest — you hand to the auditor as-is. Per-framework walkthroughs live in docs/evidence/.

6. Staying compliant

Regulation and provider changes ship as tagged releases with compliance patch notes. Renewals follow your audit cycle: subscriptions are annual, and access includes every release published while subscribed.

Try before you buy

• Three open-source modules — the same hardening style, minus the compliance layer. The trial is the code, not a timer.
• gate-demo — watch the PR gate block a real change with clause-cited comments.
• Security & trust — how the platform behind this product applies the same controls to itself.