Pramana logo
Product In Progress

Pramana

A compliance-training tracking platform that produces auditable proof of completion. Named for प्रमाण ("valid means of knowledge"), the first release is SOX-scoped, with a tamper-evident, hash-chained audit trail.

By Siva Mambakkam
PythonFastAPISQLAlchemyPostgreSQLCelerySOXComplianceSAML/OIDCAWS S3

What is Pramana?

Pramana — Sanskrit प्रमाण, “proof” or “valid means of knowledge” — is a compliance-training and tracking platform. It assigns mandatory training, tracks completion across an organization, and produces the auditable evidence that the training actually happened. The name is literal: the system’s job is to generate pramana of compliance.

The problem it solves

Regulated companies must prove — to auditors, not just to themselves — that the right people completed the right training on time. That proof has to be tamper-evident and survive long retention windows. Pramana treats the audit trail as the product: every assignment, reminder, completion, and exception is recorded in an append-only log archived to immutable object storage.

v1 scope

The first release is a single-tenant system scoped to SOX (Sarbanes-Oxley) compliance training. The architecture is framework-aware from the start — HIPAA, ISO/IEC 27001, GDPR, and PCI DSS are mapped on the roadmap — but v1 stays deliberately narrow to ship a correct, defensible SOX workflow first.

Architecture

  • Service: Python 3.12+ with FastAPI, specified API-first against an OpenAPI 3.1 contract
  • Data: SQLAlchemy 2.x with Alembic migrations on PostgreSQL
  • Core domain: a pure, well-tested assignment state machine that drives every training assignment from assigned → completed (or escalated)
  • Background work: Celery + Redis for reminders, escalations, and report generation
  • Identity: enterprise SSO via SAML / OIDC
  • Audit archive: AWS S3 with Object Lock, so the compliance log is write-once and tamper-evident

Status

In active build — not yet deployed. The requirements and data model are locked; the FastAPI service layer and quiz generation are in progress. Development runs in governed phases — scaffolding, API specification, state machine, data model — using an AI-assisted workflow operating under version-controlled conventions, with every change ticketed and reviewed.

Case study

The architecture decisions behind Pramana — a tamper-evident, hash-chained audit log written to both the database and S3 Object Lock, the assignment lifecycle proven with property-based tests, and a spec-first API contract — are written up in a public case study. Source code is private.

← All work