Advisors & compliance pros — build your own governance practice on Bylaw

We ran the whole system before any client did.

A firm that sells proof should hold itself to the same bar. So we built our own companies to test it — ten fictional businesses across five industries, plus one deliberately oversized stress case — and ran each end to end through the live, real-time system. None of these are customers. They are test simulations on real software, with every step recorded the way a real client’s would be.

Reviewing paperwork at a desk
fig. 01 · the office at work on the record

Ten fictional companies. Five industries. Two postures.

Each industry got two test companies: a mature one with a full, well-kept policy set, and a scrappy one with thin, messy documents — because real governance has to survive both. Every one was run through the same pipeline: documents in, rules cleaned and mapped, controls signed off by three separate roles, simulations against new laws and partners, and a full hash-chained audit trail.

HealthcareMercy Ridge HealthMature hospital group — full policy set, ~84 live controls.
Healthcare · scrappyCareBridge TelehealthLean startup — five thin, messy documents to clean up.
Financial servicesKeystone National BankMature bank — books-and-records discipline, ~86 controls.
Financial services · scrappyPocketPayFintech under-documented for its risk — gaps surfaced.
Manufacturing & logisticsAtlas Forge IndustriesMature manufacturer — multi-site operating rules.
Manufacturing · scrappySwiftLane FreightFast-growing carrier — rules trailing the operation.
Retail & e-commerceHartline Retail GroupMature multi-channel retailer — broad obligations.
Retail · scrappyEmberglow GoodsDTC brand — minimal governance, maximal change.
SaaS & technologyNimbus PlatformMature SaaS — the most controls in the regular fleet.
SaaS · scrappyBrightStack StudioEarly-stage studio — shipping AI faster than policy.

Then we built one designed to break it.

Meridian Holdings is a fictional conglomerate we made deliberately monstrous: 1,408 pages of policy across four volumes. We pushed it through to see where the system bends under real scale — and it mapped 11,125 live controls while keeping its audit trail intact end to end.

Scale wasn’t the only test. Across the fleet we ran 94 simulations — new laws, new territories, partner companies connected with evidence-only handoffs — and built 50 reports, all with their hashes embedded so a tampered one is detectable.

Hands with documents
fig. 02 · reviewed, not assumed verified
11 / 11audit chains verified end to end
11,125controls on the stress test
94simulations run
0fabrications found in audit

Three independent audits, one verdict.

We didn’t grade our own homework. Three separate independent audits re-checked the work from different angles — rebuilding the hash chain from scratch, proving the system can’t bypass its own audit gate, and recomputing every published statistic against the raw records.

audit 01 / chain

The record is real.

An independent reviewer rebuilt the hash chain from the spec — not trusting our code — and verified every record across all eleven workspaces. Verdict: no fabrication found.

audit 02 / engine

The right paths produced it.

A second reviewer proved the system physically cannot skip its audit gate, then recomputed every verdict against the sealed engine — zero mismatches.

audit 03 / claims

The numbers are honest.

A third reviewer recomputed every statistic on this page from the raw snapshots, and corrected anything that read rosier than the records. What you see here is what actually ran.

A note on honesty: these companies are fictional and the runs are simulations — but the system underneath is the real, live product, run in real time, with every action hash-chained exactly as a paying client’s would be. We show the method because we can’t yet show client names.

Ten companies. Ten case studies.

Each test company was run end to end through the live system. We are publishing the full account of each — what it faced, what the engine caught, and what the record proved. New studies land here as they are written.

Healthcare · matureMercy Ridge HealthRegional health system, 10 policies, 84 live controls, 88% proven.Read the case study →
Healthcare · scrappyCareBridge TelehealthFive thin documents, gaps surfaced before they became findings.Read the case study →
Financial services · matureKeystone National BankBooks-and-records discipline, 86 controls, 90% proven.Read the case study →
Financial services · scrappyPocketPayFintech under-documented for its risk — the gaps named.Read the case study →
Manufacturing · matureAtlas Forge IndustriesMulti-site operating rules across 10 governing documents.Read the case study →
Manufacturing · scrappySwiftLane FreightFast-growing carrier, rules trailing the operation.Read the case study →
Retail & e-commerce · matureHartline Retail GroupMulti-channel retailer, broad cross-department obligations.Read the case study →
Retail & e-commerce · scrappyEmberglow GoodsDTC brand, minimal governance, maximal change.Read the case study →
SaaS & technology · matureNimbus PlatformMature SaaS, the most controls in the regular fleet (104).Read the case study →
SaaS & technology · scrappyBrightStack StudioEarly-stage studio shipping AI faster than policy.Read the case study →