Vamu: Compliance on autopilot for cloud-first teams

Hey Product Hunt 👋 We're Faris and Ahmad, co-founders of Vamu. Before we started this company, we both spent years inside compliance projects — Faris on the business and audit side, Ahmad in the engineering trenches — and we kept running into the same wall. A company would decide to get SOC 2 or ISO 27001 certified, and the next six months would turn into a spreadsheet nightmare: hundreds of manual screenshots, endless Slack pings asking engineers to "please just confirm this control is in place," and auditors chasing evidence that was already stale by the time it was collected. Then, a year later, the same company would need a second framework — say GDPR or a local regulator's standard — and the entire process would start over from scratch, even though 60-70% of the controls overlapped. That redundancy is what pushed us to build Vamu. We wanted a platform that connects directly to the infrastructure a company already runs — AWS, GitHub, Microsoft 365, Azure — and continuously pulls read-only evidence in the background, then maps it automatically across every framework a company needs at once. No more re-doing the same work for every new certification. We also built Vamu with our own region in mind. Most GRC tools are designed for US and EU frameworks and treat regulators like Saudi Arabia's SAMA and NCA as an afterthought, if they support them at all. We wanted MENA-based fintechs, healthtechs, and enterprise vendors to get first-class support for the frameworks that actually govern them. Today, teams using Vamu are cutting manual compliance work by up to 80% and getting certified roughly 5x faster. We're incredibly proud of what the team has built, but we're even more curious what this community thinks. Try it, break it, and tell us honestly what's missing — we're in the comments all day and would love your feedback. — Faris & Ahmad