heygrc

About heygrc

heygrc is compliance review that runs in the pull request rather than in the audit six months later. It installs as a GitHub App with no CI config or YAML to maintain, you select the frameworks your company must meet and add company context during a sub-two-minute onboarding, and from the next PR onward it posts a review with inline comments and a check status you can require in branch protection. The findings are grounded in specific clauses rather than generic warnings — the worked example on the homepage catches a one-line change dropping `AUDIT_LOG_RETENTION_DAYS` from 365 to 30 and cites ISO 27001:2022 A.8.15 and SOC 2 CC7.2, noting that monitoring evidence typically needs at least 90 days. Coverage spans 91 frameworks including ISO 27001, SOC 1 and 2, GDPR, DORA, NIS 2, ISO 42001, the EU AI Act, PCI DSS, HIPAA, the ISO 277xx privacy series, NIST CSF and 800-53/800-171, CMMC, FedRAMP, CCPA/CPRA, Cyber Essentials, TISAX, ISO 22301, SOX, and CIS Controls, with the live catalog exposed at an API endpoint. Reviews are scoped to your sector, data types, and hosting region rather than a generic checklist. The explicit target is teams heading into a first SOC 2 or ISO 27001 audit, and the framing is that AI agents now ship code faster than any human can compliance-check it — so it reviews PRs from Claude Code, Cursor, Copilot, Codex, and humans alike. It is built by ISMS Copilot.

Key Features

Tags

More Security & Privacy tools