SOC 2, HIPAA, and NIST land in your pull requests.
For US SaaS teams whose customers ask for SOC 2, HIPAA, NIST, CMMC, or CCPA. The controls that actually show up in a diff, named at the clause.
A US SaaS company usually picks up frameworks because a customer asked, not because a regulator mailed a letter. SOC 2 for enterprise buyers, HIPAA technical safeguards if you touch ePHI, NIST 800-53 or 800-171 when a federal-adjacent contract shows up, CCPA if you meet the thresholds, PCI if you touch cards. Much of that is process and evidence. A real slice is decided in code, and it is the slice a pull request can quietly undo.
The US stack, reviewed at the diff
The hard part is not picking a framework. It is noticing that a one-line IAM change is SOC 2 CC6.1, that a debug log of a request body can expose ePHI outside the store that should hold it, or that dropping MFA on an admin path is NIST IA-2(1). heygrc is built to read each change against the frameworks you selected and name the criterion or safeguard it touches, so a US engineering team does not have to hold the TSC, the Security Rule, and 800-53 in their head to spot that a diff matters.
If you also sell to the EU, turn GDPR, DORA, or NIS 2 on in the same review. Those stay first-class. Inference region is a choice you configure. The review worker itself runs in Paris.
It does not sign a BAA or handle ePHI as a business associate. It is not FedRAMP authorized and is not intended to process CUI. It does not determine CCPA applicability. It reviews the code change against the frameworks you selected and cites the control.
Changes that read as ordinary code.
A few of the control-relevant changes heygrc is built to flag for this case, each cited to the clause it touches.
An IAM role widens to a wildcard
SOC 2 CC6.1A patient-records store loses encryption at rest
HIPAA 164.312(a)(2)(iv)A new events table ships with no retention bound
CCPA § 1798.100(a)(3)
The frameworks that matter most here.
Guide: What HIPAA actually checks in your repo
heygrc flags control-relevant changes and cites the clause so the issue can be handled in the pull request. It does not certify you, run your audit, or replace your own judgment.