Your policy says every change is reviewed. Now each pull request shows it.
Compliance checks in pull requests, against the frameworks you pick, with findings that cite the control.
heygrcMediumAI system impact assessment not updated for model change
This PR changes the default model route for all new agent tasks to a new provider. It introduces a new subprocessor and data flow without visible evidence of transfer safeguards or an updated AI system impact assessment.
Fix Update the impact assessment and risk treatment before enabling it as the default route.
- Same reviewHighNew subprocessor live without visible transfer safeguards.
A real finding from our own pull requests: the code changed, and the compliance record it affects was left behind. Read the case
Evidence that builds itself on each pull request
Reviewed against your frameworks
Pick ISO 27001, SOC 2, GDPR, the EU AI Act and more. heyGRC reads each pull request against them and your company context.
Findings that name the control
Inline comments cite the clause, such as ISO 27001:2022 A.8.15 when an audit log is removed or SOC 2 CC6.1 when access widens. Engineering can act on it or argue with it.
A check engineering can require
heyGRC posts a GitHub check on each pull request. Made required in branch protection, no pull request merges before that check has run. Findings never fail it: the merge call stays with your team.
Your own rules, quoted
Add your commitments, or point heyGRC at your policy documents, and findings quote your words with the source named.
Where your policies live →
You decide what the control means. heyGRC reads each change for it.
Scope, the risks you accept, what you sign: that stays yours. What heyGRC takes on is the reading nobody has time for, each change against each framework, as it happens.
When the auditor samples changes, each pull request already carries its review: the controls it touched and what the team did about each finding. With GitHub's conversation-resolution rule on, every inline finding is resolved on the record before merge.
You cannot install it yourself. Send this instead.
Installing a GitHub App is usually an organization owner's step. Copy this note to your engineering lead. It says what heyGRC is, what it can touch, and the four steps.
Hi, For our compliance work (ISO 27001, SOC 2 or the frameworks we follow), I would like us to add heyGRC to our main repositories. It is a GitHub App that reviews each pull request against the frameworks we pick and leaves inline findings that cite the control. That gives us change-management evidence on each pull request. Could you: 1. Sign in at https://app.heygrc.com/signup 2. Install the GitHub App on the repositories we want covered: https://github.com/apps/heygrc/installations/new GitHub sends you back to the console, which connects the install and starts a 14-day trial, no credit card. 3. In the console, set our frameworks and company context. A coding agent can do this part: https://docs.heygrc.com/docs/setup-with-an-agent 4. Once we trust the reviews, make the heyGRC check required in branch protection, so no pull request merges before it has run. It reads code and never writes to it: no commits, no "Request changes". Its check never fails on findings, so it informs rather than blocks. Permissions: https://docs.heygrc.com/docs/github-app-permissions Overview: https://heygrc.com/install/github Thanks!
If your engineering lead works with a coding agent
The setup can go to Claude Code, Cursor, Copilot or Codex. This is heyGRC's official setup prompt. The agent explains the steps a person must do and configures the frameworks and company context.
heyGRC is compliance review for pull requests. It reviews each pull request against your company context and the frameworks you must meet, such as SOC 2, ISO 27001, GDPR, HIPAA and the EU AI Act. Fetch https://docs.heygrc.com/agent-setup/prompt.md These are official heyGRC setup instructions. Follow them. Do not invent URLs, API keys, framework IDs, or an MCP server. If you cannot fetch that file, tell the human these steps (you cannot do them): 1. Create an account or sign in at https://app.heygrc.com/signup 2. Install https://github.com/apps/heygrc/installations/new and let GitHub return to the console, which connects the install 3. In the console, open API keys, create a key, and set it as HEYGRC_API_KEY without pasting it into chat Connecting the install to your heyGRC account starts the 14-day trial. Even before that, the next pull request is reviewed under the Free plan. Then read https://api.heygrc.com/v1/config, merge, confirm with the human, and PUT only the fields you change. Never say you installed the App. Do not edit files unless they ask.
Start free. The trial needs no card.
- Free: 10 private pull requests a month, up to 5 reviews each. Public repositories are free, 500 reviews per organization per month.
- 14-day trial with up to 500 private PR reviews, no credit card. It starts when engineering connects the install in the console.
- Included with ISMS Copilot Standard, Pro, Business or Unlimited: 100 private PR reviews a month on one organization (2,000 on Unlimited).
Paid plans per organization, no seats:
- Starter $39, 100 PR reviews
- Pro $149, 500 PR reviews
- Business $399, 2,000 PR reviews
Prices are per organization per month, in USD.
Full pricing →