PCI DSS and DORA are code-review problems now.
For fintech and payments teams whose regulators moved into the repository: card-data handling, operational resilience, and vendor risk all change one diff at a time.
Fintech carries the heaviest overlap of obligations that actually live in code: PCI DSS if you touch card data, DORA if you serve or are a financial entity in the EU, SOC 2 because your customers ask. None of these degrade on a schedule. A card number starts landing in a log, a failover job gets disabled in a cleanup, a payment path quietly loses a control, and each of those is a pull request someone reviewed for correctness only.
Resilience and card-data duties, named at the diff
What makes fintech different is that the regulators wrote requirements concrete enough to check against a change: PCI DSS says protect stored account data and authenticate access; DORA says protect, detect, and recover. heygrc is built to read each pull request against the frameworks you selected and cite the requirement a change touches, so the engineer deciding whether to merge knows they are also deciding a control.
It does not scope your CDE, run your DORA testing programme, or replace your QSA. It catches the moment a reviewed change starts eroding a requirement, in the review itself.
Changes that read as ordinary code.
A few of the control-relevant changes heygrc is built to flag for this case, each cited to the clause it touches.
A card number starts landing in application logs
PCI DSS Req 3An MFA check is removed from admin access to the payments system
PCI DSS Req 8A failover path on a critical payments call is removed
DORA Art. 11
The frameworks that matter most here.
Guide: Make compliance a required check
heygrc flags control-relevant changes and cites the clause so the issue can be handled in the pull request. It does not certify you, run your audit, or replace your own judgment.