A law describes the behavior a society expects of itself. A regulation defines roles, deadlines and consequences. A compliance obligation states what must be true inside an organization, every day, with proof.
Engineering has a name for that: a specification.
And a good specification does not live in a PDF. It runs.
What we value
We arrived at these convictions by building and operating rules-as-code systems for over ten years: elections, data protection, public management, protection of women at risk. We value:
- Working software over compliance PDFs.
- Auditable evidence over promises of conformity.
- Open code over black boxes.
- A state maintained every month over a project that ends at delivery.
There is value in the items on the right. We value the items on the left more.
The principles
1. If the rule exists, it can run. Every rule can be read as a requirement: flow, deadline, role, exception, sanction. What can be read as a requirement can be modeled, implemented and verified.
2. Whoever interprets the rule writes the code. Every layer of translation between the person who understands the rule and the person who implements it is a place where the system goes wrong. We remove the layers.
3. Don't trust. Inspect. The algorithm that applies the law to someone must be inspectable by that someone. Public rules in closed code are a black box, and a black box is not compliance, it is faith. Our code is open by requirement, not by ideology.
4. Compliance is a state, not an event. An audit should not be a week of panic chasing evidence. If the system records every step while the work happens, the proof exists before anyone asks.
5. What leaves no trail does not count. A meeting is not evidence. An intention is not evidence. A record with authorship, timestamp and verifiable chaining is evidence.
6. Built to outlive administrations. Regulatory systems live longer than the governments, boards and technology fashions that created them. We build and operate on that horizon.
7. The exit door stays open. The data belongs to the client, in open formats, with full export as a contract clause. Leaving is easy by design. That is why clients stay.
8. Small on purpose. A senior team, no commercial layers, no body shop. Growth at any cost would create exactly the layers principle 2 forbids.
What we refuse
Regulatory theater: the document that exists for the record. The checklist nobody audits. The black box applying public rules. Generic ERPs and CRMs anyone can build. And any project that ignores the most important question: who keeps this working five years from now?
Hold us to it
- Our code is public at github.com/appcivico.
- Every claim on this site is verifiable: a repository, a contract or a public number.
- Everything we operate produces auditable evidence, including evidence to audit us.
AppCívico
São Paulo, Brazil, 2026