Based on 4 reviews
AI-generated from reviews on this page. Verify anything important with the company directly.
The ability to run a SOC 2 program directly within Git feels like a genuine step forward for engineering teams. Keeping policies as Markdown and controls as JSON means the data stays portable and transparent. The local CLI tool works smoothly for scaffolding records, and having a zero software bill for the MIT-licensed platform makes this an attractive option for founder-led groups managing compliance without heavy overhead.
The CLI integration and Git-native approach make this service perfect for engineering teams who want to keep compliance close to their code.
From the information available, filegrc presents a compelling alternative to traditional compliance platforms by treating the repository as the program. The approach of keeping evidence as JSON and Markdown in Git allows for a focused history with reviewable diffs, which is reassuring for audit trails. However, the distinction between record status and Git branches requires careful understanding. While the agent can handle routine work and the browser provides a helpful interface, the fact that the browser is not strictly required suggests some familiarity with the command line is beneficial. The separation of the source systems that operate controls from the filegrc workspace is clear, though it demands that teams maintain discipline in their workflow. It seems like a robust tool for those already comfortable with version control, but might require setup time to fully appreciate the five-step path from scope definition to audit preparation. For someone considering this company, the open-source nature and local execution reduce vendor lock-in risks significantly.
The open-source model and MIT license make this a very accessible option. Running locally with Node.js is straightforward and keeps all records in our own Git repository. It is a clean, efficient solution for managing policies and evidence without paying for unnecessary software features.
No news yet. This is where the business shares its own updates and press.
filegrc is an open-source tool that lets founder-led engineering teams run a SOC 2 compliance program as files stored in their own Git repository. It provides a workspace for adopting policies, implementing controls, managing recurring compliance work, collecting evidence, and preparing for an audit. The platform records compliance data as JSON and Markdown files, allows agents to create and update records, and commits each change directly to the repository through a local web app or CLI. It is MIT licensed and offered free of charge, with the source systems that operate controls and the CPA audit handled externally.