One change can touch several frameworks.
The same ordinary code change often implicates a control in more than one framework at once. Pick a common one below and see which clauses it tends to touch, each linking to how heygrc reads that framework in a pull request. It runs entirely in your browser and is an illustration, not a compliance verdict.
Pick a change
Controls it tends to implicate
A debug or audit log starts capturing more personal data than the feature needs.
Data minimisation: personal data should be limited to what the purpose needs.
GDPR Art. 5(1)(c)Security of processing: how that data is then protected at rest in the log store.
GDPR Art. 32If it is cardholder data, the PAN must be rendered unreadable and the log is now in scope.
PCI DSS Req 3
An illustration of the framework-in-code idea, not a compliance verdict. Which obligations actually apply depends on the frameworks your company holds.
Free tool
Generate a starter .heygrc.md
heyGRC can read a repo-root .heygrc.md as company context for reviews (self-described scope, data types, controls to emphasize). Build a starter file here, download it, commit it, then install the GitHub App so reviews cite your own context. Runs entirely in your browser. No account required.
Frameworks in scope
Company context (optional)
Not a certificate or compliance attestation. Keep secrets out of the file. Public repos make this file public.
Preview
<!-- heygrc_context_version: 1 -->
<!-- Generated on 2026-08-12 from the free heygrc.com starter tool.
Commit as `.heygrc.md` at the repository root.
Self-described company context only (no secrets). In a PUBLIC repo this file is public. -->
# heyGRC compliance context
Self-described context about this company so heyGRC's pull-request reviews can reference your own
systems, data, and controls. This is context for review, not a compliance attestation.
## Frameworks in scope for review
- SOC 2
- GDPR
## Self-described company context
- (fill the form fields, or edit this section after download)
## Systems and controls to emphasize
<!-- Add your specific systems and control IDs so reviews can cite them. For example:
- The billing service handles cardholder data; control DS-LOG-03 forbids logging it.
- Access control: control AC-MFA-01 requires MFA for all human access. -->
Commit the file at the repository root, open a PR that does not only add the file (the first PR that adds it is reviewed without it, by design), then install heygrc so later PRs can use the context.
Install heygrc on GitHubThis is the mapping heygrc is built to do on every PR.
This explorer is a static, hand-built map of common patterns. heygrc is built to do the same kind of reasoning on the actual diff: read each change against the frameworks your company selected and cite the specific control it touches, as a review comment. It does not certify you or run your audit.