Compliance as code: moving our management system documentation into GitLab, from one month to 30 minutes

2026.08.26 Clever Cloud Bannière Blog Compliance as Code EN
Updating our security policy set used to take almost a month, once a year. Today it takes 30 minutes. And the result is more reliable than it was.

A compliance manager’s field report.

When I joined Clever Cloud four years ago, I walked into a deeply technical culture: no collaborative suite, no conventional project management tool. Everything lives in GitLab, GitHub and terminals.

Running an integrated management system (ISO 9001, ISO 27001, HDS, regulatory compliance) is formalisation work: policies, procedures, security rules.

So we started out the conventional way, on a collaborative suite.

Some of the habits that came with it quickly turned into a time sink. Version numbers tracked by hand in a spreadsheet. PDFs sent to the steering committee for sign-off. Signatures. Folders labelled “approved” and “in progress”. Links breaking every time a format changed.

Human checks everywhere, so mistakes waiting to happen. And above all: developers never go into those tools. Their documentation sits in GitLab.

So we made a simple call. The entire documentation set in Markdown, version-controlled in GitLab, in the same place as the technical documentation.

What that changes in practice:

  • a complete, native history: commits, diffs, authors
  • every change goes through a merge request, with at least one approval from a third party. Segregation of duties no longer rests on a declared process, it is carried by the tool
  • the technical population reads the policies all year round, not only at the annual awareness session (the new challenge is the non-technical profiles, who now learn GitLab during onboarding, as I did four years ago)

Then we automated. A monthly script reads the platform changelogs, drafts the updates in the right places across the policies, and opens the merge requests. What is left for me is the review, then approval by whoever owns the subject. That is where the month becomes 30 minutes.

And the real change is somewhere else. We no longer update documents for the audit, once a year. We update them at every actual change to the information system. In front of the auditor, the sources, the versions and the approvals are right there. Compliance becomes a measured state rather than a declared one.

That is how I picture compliance as code from an integrated management system governance standpoint. What it changes at a deeper level is the tempo: compliance now moves at the speed of the information system, not at the speed of the audit calendar.

Blog

À lire également

Compliance as code: moving our management system documentation into GitLab, from one month to 30 minutes

Updating our security policy set used to take almost a month, once a year. Today it takes 30 minutes. And the result is more reliable than it was.
Engineering

The audit as a weapon: compliance, another battlefield of economic warfare

I recently read the Flash ingérence published by the DGSI in May 2026 on the risks associated with foreign audits. It concerns three French companies confronted, under cover of regulatory procedures, with practices that end up weakening them. One of these examples struck me in particular, because it shows the extent to which the compliance reflex can sometimes turn against the party who believes they are doing the right thing.
Company

Managed Kubernetes: benefits, limitations and selection criteria

A managed Kubernetes service is an offering in which the cloud provider manages the Kubernetes control plane on the user’s behalf. Provisioning, updates, availability and certificate rotation are handled by the provider. The user retains control over their workloads and node pools but does not administer the cluster’s critical infrastructure.
Engineering Features