Firm Stack Map

About

Most firms cannot list every piece of software they run on, let alone say which ones touch client data or whether an AI feature is switched on. Firm Stack Map fixes that in an afternoon.

• Inventory the stack. Start from a guided catalog or a starter pack, then arrange tools on a Canvas by category. Click a tile to launch it.
• Profile each tool. A wizard asks five questions per tool: what data classes it holds, how data moves in and out, whether AI is in use, its disposition, and whether it holds customer information. Quit halfway and your work is saved.
• Get the audit. A pure rules engine grades findings by severity: unvetted AI on tax-return data, unknown AI settings on customer-info systems, manual-only handoffs, replacement candidates, incomplete profiles. Copy it as Markdown or print it.
• Map the workflows. A guided mapper turns common firm processes into ordered tool-to-tool handoffs, with integration method and health, and surfaces fragile flows and automation opportunities.
• Keep the firm’s memory. A searchable Firm Brain holds published procedures with drafts, revisions, and archive, plus a light client registry and a grounded concierge for wayfinding.

Honest status: a live pilot on a development auth instance, aimed at the AI Lab for Accountants community. The stack map, audit, and workflow mapper are built. The WISP inventory export and the Claude-drafted advisory layer on top of the audit are next. This tool belongs to my firm, Charles J. Barmore CPA PC. It is free; the paid part is the advisory engagement that follows the audit.

How I built it

• Audit findings are a function, not a prompt. The rules live in one testable module with golden fixtures. An LLM may narrate on top later, but it never decides a finding.
• The app never asserts a vendor’s terms. Catalog capability claims default to unknown and require a docs URL. Safety verdicts come from my Tool Safety Index and only the published tier is carried, so the app can never contradict the Lab about a named vendor.
• Tenant isolation is the first rule. Org id comes from the server session on every query, with composite ownership constraints on child records as a second line.
• Concierge on a leash. Launch URLs never enter the prompt, likely SSNs, EINs, and account numbers are blocked in both the browser and the route, and OpenAI response storage is disabled.
• Built solo with Claude Code, with a collaborator agreement so Rebecca can push and open pull requests against the same repo.

Stack