heygrc and Baz

Different jobs, same pull request.

Baz is built to understand what a change intends and whether it breaks anything. heygrc asks a parallel question: does the change move a control in your frameworks? A change can do exactly what it intends and still route around a process control.

Get early access by ISMS Copilot

Baz

Baz is an AI code reviewer focused on understanding the intent of a change and catching breaking changes and regressions across a pull request.

heygrc

heygrc reviews each pull request against the compliance frameworks your company must meet (ISO 27001, SOC 2, GDPR, and more) and cites the specific control a change touches. It is built for compliance, not code quality.

Where they do not overlap

A change that does what it intends and skips approval.

This change sets the pipeline to deploy to production automatically on green CI, removing the manual approval step. It works, and it ships faster.

.github/workflows/deploy.yml+1 −1

on:  push: { branches: [main] }-    environment: production       # requires approval+    environment: production-auto  # no approval gate

heygrcSOC 2 CC8.1

Removing the approval gate means changes reach production without the authorization step, and change management is SOC 2 CC8.1. heygrc is built to read a workflow change like this against the control it touches.

Use them together

Keep Baz. Add the compliance layer.

This is not a question of which tool wins. Baz catches the bugs and quality problems heygrc never looks for, and heygrc catches the compliance issues a code review is not built to see. Running both means a pull request is checked for whether the code is good and for whether the change is compliant, two different kinds of risk, on the same diff.

heygrc does not replace your code review, and it does not certify you. It reviews changes against your frameworks and cites the control, so the compliance question is answered where the change is made. heygrc is in early access.

Get early access ← Where heygrc fits

Questions

heygrc and Baz, common questions.

Is heygrc an alternative to Baz?

Not exactly. Baz reviews your code; heygrc reviews each change for compliance against the frameworks your company must meet (ISO 27001, SOC 2, GDPR, and more) and cites the specific control it touches. They answer different questions about the same pull request, so heygrc is designed to run alongside it, not replace it.

Can I use heygrc and Baz together?

Yes. They look at different kinds of risk on the same diff: Baz on the code, heygrc on the compliance control a change touches. heygrc does not replace your code review.

What does heygrc check on a pull request?

heygrc reviews each pull request against the frameworks your company selected and cites the specific control a change touches, so the compliance question is answered in code review. heygrc does not certify you and is in early access.