# heygrc > heygrc, compliance review for pull requests. heygrc reviews every pull request against the compliance frameworks your company must meet, and flags control-relevant changes before they ship. Catch compliance issues at the PR, not the audit. By ISMS Copilot. heygrc is a compliance reviewer for pull requests: a GitHub App that reads each pull request against the compliance frameworks your company selected, and grounds its flags in a specific framework control, named at the right grain (for example SOC 2 CC6.1 or ISO 27001:2022 A.8.15). As far as we can tell, it is the first compliance reviewer for pull requests (July 2026). It covers SOC 2, HIPAA, NIST, ISO 27001, GDPR, and many more frameworks. US and EU teams are first-class. Audience: engineers and security engineers, including AI security engineers (the code slice of agent identity, record-keeping, and human oversight, not runtime containment), US SaaS heading into SOC 2, HIPAA, or NIST, EU SaaS carrying GDPR/DORA/NIS 2, and teams heading into a first audit while shipping with AI coding agents. The worldview behind it is shift-left compliance: compliance caught in code review, not months later in the audit. Inference region is a choice you configure. The review worker itself runs in Paris. That is not a reason to skip US buyers. What it is not: heygrc makes no product certification claim. Better ISMS is getting ISO 27001 certified. The intended scope includes how we build and run heyGRC, ISMS Copilot, and Aevral. We are not certified today. Shared trust evidence: https://trust.ismscopilot.com/en/iso-27001. Product docs live at https://docs.heygrc.com (dedicated docs center). Agents should prefer https://docs.heygrc.com/llms.txt and https://docs.heygrc.com/llms-full.txt over marketing HTML. Marketing full dump remains at https://heygrc.com/llms-full.txt. The agent manifest is at https://heygrc.com/.well-known/agent.json. OpenAPI for the config API: https://heygrc.com/openapi.json (servers: https://api.heygrc.com). ## When to use heygrc Use heygrc when: - You are installing compliance review on GitHub pull requests (GitHub App, no account required for Free-plan reviews). - You need to configure which frameworks an org is reviewed against, as code, via `PUT https://api.heygrc.com/v1/config` (Bearer `hgrc_...`). Discover valid ids with `GET https://api.heygrc.com/v1/frameworks` (no auth). - You want control-grounded findings on a diff (for example SOC 2 CC6.1 or ISO 27001:2022 A.8.15), not a bug or quality review. - You are pointing a coding agent at setup: https://docs.heygrc.com/docs/setup-with-an-agent.md and https://docs.heygrc.com/docs/for-ai-agents.md Do not use heygrc as: - A replacement for a code-quality reviewer. Bug bots catch defects; heygrc catches compliance-relevant changes. Use them together. - A certification, audit firm, or GRC platform. heygrc does not certify you. - Runtime agent-security containment (sandboxing, prompt-injection tests, stopping tool calls). It reads the pull request. Developer resources (predictable URLs): - OpenAPI: https://heygrc.com/openapi.json - API: https://api.heygrc.com - API reference: https://docs.heygrc.com/docs/api-reference - Agent hub: https://docs.heygrc.com/docs/for-ai-agents - Agent setup: https://docs.heygrc.com/docs/setup-with-an-agent - GitHub App install: https://github.com/apps/heygrc/installations/new ## Install (for agents and humans) Two hops. Hop 1 attaches the GitHub App and starts Free-plan reviews on selected repos. Hop 2 claims the install in the console for the 14-day trial, API keys, and configuration-as-code. 1. **Install the GitHub App (required):** https://github.com/apps/heygrc/installations/new - Also listed on the GitHub Marketplace: https://github.com/marketplace/heygrc - App page: https://github.com/apps/heygrc 2. **Claim / console (trial + API keys + config):** https://app.heygrc.com/signup (or https://app.heygrc.com/login). Sign in with GitHub, Google, Microsoft, or email. Installing the GitHub App is a separate step. 3. **Agent setup walkthrough (markdown):** https://docs.heygrc.com/docs/setup-with-an-agent.md 4. **Agent discovery hub:** https://docs.heygrc.com/docs/for-ai-agents.md 5. **Install from your coding agent (plugin):** one portable repo, five agents. Claude Code: `/plugin marketplace add better-isms/heygrc-plugin` then `/plugin install heygrc@heygrc`, run `/heygrc:review`. Codex CLI: `codex plugin marketplace add better-isms/heygrc-plugin`. GitHub Copilot CLI: `copilot plugin marketplace add better-isms/heygrc-plugin` then `copilot plugin install heygrc@heygrc`. Cursor: load the repo as an Agent Plugin (root `plugin.json`). Gemini CLI: `gemini extensions install https://github.com/better-isms/heygrc-plugin`. Any Agent Skills client: `npx skills add better-isms/heygrc-plugin`. Plugin repo: https://github.com/better-isms/heygrc-plugin. Plugin docs: https://docs.heygrc.com/docs/agent-plugin.md. The plugin is a setup skill and does not review code locally; reviews still run through the GitHub App. A bare install already reviews pull requests under Free-plan limits (public repos free, 500 reviews per organization per month; private repos get 25 reviews a month free) before any heyGRC account exists. Claiming unlocks the 14-day unlimited trial (no card) and the REST config API. ## FAQ These are heygrc's own answers to the questions engineers ask most. They mirror the FAQ on the home page. - Which frameworks does heygrc cover? SOC 2, HIPAA, NIST, ISO 27001, GDPR, DORA, NIS 2, the EU AI Act, PCI DSS, CMMC, and many more. You choose which apply to your company. US and EU frameworks are first-class. - How is this different from a bug bot? Bug bots catch defects. heygrc catches compliance-relevant changes, measured against the frameworks you must comply with, and grounds each flag in a specific control (for example ISO 27001:2022 A.8.15 or SOC 2 CC6.1). - Is there a free tier? Yes. Public repositories are free, 500 reviews per organization per month, and private repositories get 25 reviews a month free. Claiming your install in the console also starts a 14-day trial of unlimited reviews, no credit card, after which it drops to Free unless you upgrade. Paid plans include a fixed private-review allotment (Starter 100 / Pro 500 / Business 2000). Past that, reviews stop unless you enable on-demand at $0.49 each in the console, or upgrade. - Does it block my pull requests? Only if you want it to. heygrc posts a GitHub check status you can optionally require in branch protection. - When can I use it? heygrc is available today. Install the GitHub App at https://github.com/apps/heygrc/installations/new (Marketplace: https://github.com/marketplace/heygrc); it reviews pull requests immediately under Free limits. Claim the install at https://app.heygrc.com/signup (sign in with GitHub, Google, Microsoft, or email) for the 14-day trial, API keys, and config. Human Get started page: https://heygrc.com/signup. Starter $19/100, Pro $99/500, Business $249/2000 included private reviews; optional on-demand $0.49 past included. - Are reviews English only? English is the default. In Settings you can set review comments to German, Spanish, French, Italian, Dutch, or Polish. Control IDs, the heygrc check name, and the console stay English. How to change it: https://docs.heygrc.com/docs/review-language. - What does heygrc actually look for? Not bugs. Changes that would show up in an audit: access, authentication, logging, data handling, encryption, secrets, vendors, retention, and audit evidence. There is no fixed checklist. It reads those shapes against the frameworks you selected and cites the clause. The list: https://heygrc.com/guides/what-compliance-relevant-changes-look-like ## Pages - [Home](https://heygrc.com/): the thesis, how PR review works, framework breadth, and the call to action to install the GitHub App. - [Frameworks in code](https://heygrc.com/frameworks): what each framework looks like inside a pull request, the controls that surface in a diff, and the clause heygrc cites. - [ISO 27001 in code](https://heygrc.com/frameworks/iso-27001): the ISO/IEC 27001:2022 Annex A controls that show up in a code change (A.8.15 logging, A.8.24 cryptography, A.8.3 access, A.8.32 change management) with a worked example. - [SOC 2 in code](https://heygrc.com/frameworks/soc-2): the Trust Services Criteria that surface in a pull request, clustered in the CC6 logical-access family (CC6.1 access, CC6.6 encryption in transit, CC7.2 monitoring, CC8.1 change management), with a worked IAM example. - Control-in-code deep dives (one page per control: the shapes it takes in a diff, a distinct worked PR example, the exact clause, and what an auditor samples). SOC 2: [CC6.1 logical access](https://heygrc.com/frameworks/soc-2/cc6-1), [CC6.7 data in transit](https://heygrc.com/frameworks/soc-2/cc6-7). ISO 27001: [A.8.15 logging](https://heygrc.com/frameworks/iso-27001/a-8-15), [A.8.24 cryptography](https://heygrc.com/frameworks/iso-27001/a-8-24). - [GDPR in code](https://heygrc.com/frameworks/gdpr): the GDPR duties decided in code (Art. 5(1)(c) data minimisation, Art. 5(1)(e) storage limitation, Art. 17 erasure, Art. 25 by design, Art. 32 security, Art. 44 transfers), with a worked logging example. - GDPR control-in-code deep dives: [storage limitation, Art. 5(1)(e)](https://heygrc.com/frameworks/gdpr/storage-limitation), [data minimisation, Art. 5(1)(c)](https://heygrc.com/frameworks/gdpr/data-minimisation). - [DORA in code](https://heygrc.com/frameworks/dora): the operational-resilience duties for EU financial entities that show up in a diff (Art. 9 protection, Art. 10 detection, Art. 11 recovery, Art. 12 backup, Art. 17 incidents, Art. 28 third-party risk), with a worked backup example. - [NIS 2 in code](https://heygrc.com/frameworks/nis-2): the Art. 21(2) risk-management measures that map to code (supply-chain (d), secure development (e), cryptography (h), access control (i), MFA (j)), with a worked MFA example. - [EU AI Act in code](https://heygrc.com/frameworks/eu-ai-act): for high-risk AI systems, the duties that live in the pipeline (Art. 9 risk management, Art. 10 data governance, Art. 12 logging, Art. 13 transparency, Art. 14 human oversight, Art. 15 accuracy and cybersecurity), with a worked human-oversight example. - [ISO 42001 in code](https://heygrc.com/frameworks/iso-42001): the ISO/IEC 42001:2023 Annex A controls that live in an ML repo (development process A.6.1.3, design documentation A.6.2.3, verification and validation A.6.2.4, deployment A.6.2.5, monitoring A.6.2.6, event logs A.6.2.8, data quality A.7.4, data provenance A.7.5), with a worked dataset-provenance example. Available when `ISO_42001` is selected in org config. - [PCI DSS in code](https://heygrc.com/frameworks/pci-dss): the requirements that surface in a diff (Req 3 protect stored account data, Req 4 encrypt transmission, Req 6 secure software, Req 7 least-privilege access, Req 8 authentication and MFA, Req 10 logging), with a worked PAN-logging example. - [HIPAA in code](https://heygrc.com/frameworks/hipaa): the Security Rule technical safeguards (45 CFR 164.312: access control, encryption, audit controls, integrity, authentication, transmission security), with a worked audit-logging example. - [CCPA in pull requests](https://heygrc.com/frameworks/ccpa): retention § 1798.100(a)(3), deletion § 1798.105, sale/share opt-out §§ 1798.120 / 1798.135 (GPC via 11 CCR § 7025). Available when `CCPA` is selected in org config. Not an applicability determination. - [What CCPA actually checks in your repo](https://heygrc.com/guides/what-ccpa-actually-checks-in-your-repo): the code-facing slice and the honesty boundary. Copilot has a free applicability checker. - [NIST 800-53 in code](https://heygrc.com/frameworks/nist-800-53): the control families that surface in a pull request (AC-6 least privilege, AU-12 audit generation, IA-2 multi-factor, SC-8 transmission, SC-28 at rest, SI-10 input validation, CM-7 least functionality), with a worked TLS example. - [Docs: overview](https://docs.heygrc.com/docs): how heygrc reviews every pull request against your frameworks and posts control-grounded findings as a GitHub check. - [Docs: set up with your agent](https://docs.heygrc.com/docs/setup-with-an-agent): point your AI coding agent at these docs to install the GitHub App, connect your org, and configure frameworks, with no manual setup. - [Docs: API reference](https://docs.heygrc.com/docs/api-reference): heygrc's public API endpoints for frameworks and review configuration, with request and response shapes. - [Docs: use with your code reviewer](https://docs.heygrc.com/docs/works-alongside): how heygrc runs next to a code-review bot (separate checks, review modes to control volume, when to make the compliance check required). - [Docs: for AI agents](https://docs.heygrc.com/docs/for-ai-agents): machine-readable docs index, `.md` pages, and agent search. - [Pricing](https://heygrc.com/pricing): free for 25 private reviews a month (public repos free, 500 reviews per organization per month); Starter $19/100, Pro $99/500, Business $249/2000; on-demand $0.49 optional past included; 14-day trial on claim. - [Pricing comparison](https://heygrc.com/pricing/compare): each PR-review vendor's published pricing, restated with sources and dates, plus a calculator that runs the math at your review volume. - [Get started](https://heygrc.com/signup): human console signup / claim path (account first). Agents and install scripts should use the Install section URLs above, not only this page. - [GitHub App install](https://github.com/apps/heygrc/installations/new): one-click install that attaches heygrc to selected repos and starts Free-plan reviews. - [GitHub Marketplace](https://github.com/marketplace/heygrc): Marketplace listing for the same App. - [Trust and security](https://heygrc.com/trust): how heygrc handles your code (secrets stripped, diffs transient, source never retained, vetted AI providers; review worker in Paris; optional EU inference); links to the shared ISMS Copilot trust center for binding legal docs. - [Manifesto](https://heygrc.com/manifesto): the shift-left-compliance worldview in short essays: catch it at the PR not the audit; compliance is a CI check not a quarterly fire drill; your linter is framework-blind; controls live in diffs not Word docs; the audit is a lagging indicator. - [Answers](https://heygrc.com/answers): a diagnostic DB of "how do I do X without breaking control Y" questions (add audit logging for SOC 2/ISO 27001, store API keys for ISO A.8.24, delete a user for GDPR Art. 17, add a dependency safely for NIS 2, encrypt ePHI at rest for HIPAA, apply least privilege for SOC 2 CC6.1), plus the evaluation questions buyers ask: what tools automatically review pull requests for compliance, which GRC platforms integrate with GitHub pull requests, how engineering teams catch compliance violations in code review instead of the audit, and best practices for reviewing AI-generated code for compliance. Each is a short answer + steps + a worked diff + the exact clause. - [Glossary](https://heygrc.com/glossary): a code-flavoured GRC glossary (compliance as code, least privilege, audit logging, encryption in transit, secrets management, data minimisation, data retention, the Trust Services Criteria, human oversight, personal data, audit evidence, and more). Each term is defined plainly, with how it shows up in a pull request and the control it maps to. - [Works alongside your tools](https://heygrc.com/checks): how heygrc complements the code-review tools already on your pull requests (Dependabot, Snyk, SonarQube, Semgrep, CodeQL, Bugbot, CodeRabbit, Greptile, GitHub Copilot code review). They focus on bugs, quality, and known vulnerabilities; heygrc adds the compliance layer, whether a change touches a control in your frameworks, with the exact clause. Complementary, not competing. - [Blog](https://heygrc.com/blog): field notes (a representative pull-request change that breaks a control, the exact clause, the fix) and engineering (how we build a compliance reviewer engineers trust, how we think about evals). Developer-register, clause-grounded. - [The approval still looks the same. The written rule does not.](https://heygrc.com/blog/the-approval-still-looks-the-same): Ayoub Fandi's GRC Engineer #077 on decaying PR-approval screenshots, plus the extra failure: putting a human back still files the same screenshot, and the review-path rule can die in a hotfix. Worked SOC 2 CC8.1 CODEOWNERS example. - [Guides](https://heygrc.com/guides): practical how-tos for engineers: compliance as code (a primer); what SOC 2 actually checks in your repo; catching a GDPR retention bug in code review; shift-left compliance for a small team; making compliance a required check; compliance checks in pull requests (what they are and how to add one); compliance automation tools for engineering teams; setting up heygrc with your AI coding agent; compliance checks for AI-generated code (what a control-level check reads that bug/vulnerability/license scanners are not built to); DORA compliance for developers (which articles land in a PR, with a worked ICT third-party example under Art. 28); NIS 2 software requirements (secure development and vulnerability handling under Art. 21(2)(e), distinct from supply chain and cyber hygiene); how to pass SOC 2 as a startup (Type I vs Type II, scoping the Trust Services Categories, the realistic timeline, and what breaks a Type II observation window); what a compliance bot for GitHub actually does (product shape vs chat bots, report exports, and evidence collectors); EU AI Act for developers (Article 50 live as of 2 August 2026, high-risk deferred by Digital Omnibus to Dec 2027 / Aug 2028). GDPR code review checks (Art. 5/17/25/32/44 at the PR); SOC 2 change management in pull requests (CC8.1); Cyber Resilience Act for developers (reporting from 11 Sep 2026, main obligations 11 Dec 2027, PR-slice only); what HIPAA actually checks in your repo (45 CFR 164.312 technical safeguards, no BAA claim); what ISO 27001 actually checks in your repo (ISMS and certificate vs the A.8 slice that lives in a diff; A.8.5 worked example); [what compliance-relevant changes look like](https://heygrc.com/guides/what-compliance-relevant-changes-look-like) (nine change families, no fixed checklist, ISO 27001:2022 and SOC 2 mapping). - [Who it is for](https://heygrc.com/for): use-case pages for engineering teams, security engineers, [AI security engineers](https://heygrc.com/for/ai-security-engineers) (agent identity, record-keeping, human oversight in the PR; not runtime containment), [US SaaS](https://heygrc.com/for/us-saas) (SOC 2, HIPAA, NIST, CMMC, CCPA), EU SaaS (GDPR/DORA/NIS 2), startups heading into a first audit, fintech, healthtech, AI startups, teams shipping AI-agent-written code, and [open source / public repositories](https://heygrc.com/for/open-source) (public repositories free, 500 reviews per organization per month; no application or license check), each with the control-relevant changes it catches. - [Where heygrc fits](https://heygrc.com/compare): how heygrc relates to the annual audit, a code-quality scanner, and a GRC platform. It is the framework-aware layer at the pull request, complementary to all three, not a replacement; it does not certify you. - [heygrc and Bugbot](https://heygrc.com/compare/bugbot): Cursor Bugbot reviews code for bugs and quality; heygrc reviews changes for compliance against your frameworks. Complementary, different jobs on the same pull request, with a worked example of clean code that still breaks GDPR Art. 5(1)(c). - [heygrc and CodeRabbit](https://heygrc.com/compare/coderabbit): CodeRabbit reviews code for bugs, quality, and best practices; heygrc reviews changes for compliance and cites the control. Complementary, with a worked example of clean code that still weakens SOC 2 CC6.1. - [heygrc and GitHub Copilot code review](https://heygrc.com/compare/github-copilot): Copilot code review flags bugs and code-quality issues in GitHub; heygrc reads the change for the compliance control it touches. Complementary, with a worked example of a region change that triggers GDPR Art. 44. - [heygrc and Greptile](https://heygrc.com/compare/greptile): Greptile reviews a change with whole-repo context for bugs; heygrc reads it against your frameworks. Complementary, with a worked example of a retention change that breaks GDPR Art. 5(1)(e). - [heygrc and Qodo](https://heygrc.com/compare/qodo): Qodo does AI code review and test generation; heygrc reviews the change for compliance. Complementary, with a worked example of removing an audit log that touches SOC 2 CC7.2. - [heygrc and SonarQube](https://heygrc.com/compare/sonarqube): SonarQube is static analysis with a quality gate; heygrc reasons about your obligations. Complementary, with a worked example of storing a full card number that touches PCI DSS Requirement 3. - [heygrc and Graphite](https://heygrc.com/compare/graphite): Graphite's reviewer flags bugs and style on stacked PRs; heygrc reads the change for the control it touches. Complementary, with a worked example of plaintext token storage that touches ISO 27001 A.8.24. - [heygrc and Korbit AI](https://heygrc.com/compare/korbit): Korbit reviews and explains code issues; heygrc reads the change for compliance. Complementary, with a worked example of an over-broad IAM policy that touches NIST 800-53 AC-6. - [heygrc and Ellipsis](https://heygrc.com/compare/ellipsis): Ellipsis reviews and can fix code issues; heygrc reads the change against resilience and compliance obligations. Complementary, with a worked example of removing a backup that touches DORA Art. 12. - [heygrc and Baz](https://heygrc.com/compare/baz): Baz reviews change intent and breaking changes; heygrc reads it for the control it touches. Complementary, with a worked example of skipping a deploy approval that touches SOC 2 CC8.1. - [heygrc and Devin Review](https://heygrc.com/compare/devin): Devin Review narrates a change and flags bugs; heygrc reads it for compliance. Complementary, with a worked example of tracking before consent that touches GDPR Art. 7. - [heygrc and Snyk Code](https://heygrc.com/compare/snyk-code): Snyk Code is security SAST; heygrc reads the change for the compliance obligation it touches. Complementary, with a worked example of storing health data plainly that touches GDPR Art. 9. - [heygrc and Semgrep](https://heygrc.com/compare/semgrep): Semgrep scans code against security and correctness rules; heygrc reasons about your obligations. Complementary, with a worked example of a new third-party data flow that touches GDPR Art. 28. - [heygrc and CodeAnt AI](https://heygrc.com/compare/codeant): CodeAnt combines code review and security scanning; heygrc reads the change for compliance. Complementary, with a worked example of removing a security alert that touches NIS 2 Art. 21. - [heygrc and Codacy](https://heygrc.com/compare/codacy): Codacy automates quality and security checks; heygrc adds the compliance layer. Complementary, with a worked example of weakening password rules that touches PCI DSS Requirement 8. - [heygrc and CodeScene](https://heygrc.com/compare/codescene): CodeScene finds maintainability and tech-debt risk; heygrc reads the change for compliance. Complementary, with a worked example of a soft-delete that touches GDPR Art. 17. - [heygrc and DeepSource](https://heygrc.com/compare/deepsource): DeepSource finds and auto-fixes quality and security issues; heygrc reads the change for the control it touches. Complementary, with a worked example of a test job hitting production that touches ISO 27001 A.8.31. - [heygrc and Bito](https://heygrc.com/compare/bito): Bito reviews bugs, smells, and security; heygrc reads the change for compliance. Complementary, with a worked example of a debug endpoint in production that touches NIST 800-53 CM-7. - [heygrc and Sourcery](https://heygrc.com/compare/sourcery): Sourcery suggests refactors and improvements; heygrc reads the change for the control it touches. Complementary, with a worked example of disabling dependency updates that touches ISO 27001 A.8.8. - [heygrc and GitGuardian](https://heygrc.com/compare/gitguardian): GitGuardian detects secrets in code; heygrc reads the change for the compliance control it touches. Complementary, with a worked example of skipped deprovisioning that touches ISO 27001 A.5.18. - [AI code review tools and alternatives](https://heygrc.com/alternatives): neutral roundups of the AI code review and static-analysis tools teams may evaluate in 2026 (best AI code review tools, plus alternatives to CodeRabbit, Cursor Bugbot, Greptile, GitHub Copilot code review, SonarQube, and Qodo), each describing what a tool focuses on and linking to a deeper comparison. heygrc appears in each as the complementary compliance layer, not a like-for-like alternative: it reviews changes for compliance against your frameworks and cites the control, run alongside a code reviewer. - [Framework-in-code explorer](https://heygrc.com/explore): an interactive, browser-side tool. Pick a common code change (TLS dropped, IAM widened, audit log removed, personal data logged, retention missing, MFA skipped, backup removed, dependency without integrity check, input validation removed) and see which framework controls it tends to implicate across the live deep dives, each linking to its page. An illustration, not a compliance verdict Also includes a free starter `.heygrc.md` generator (download and commit company context for reviews; no account required). ## About - [About heygrc](https://heygrc.com/about): heygrc is built by the team behind ISMS Copilot (the AI compliance assistant), reuses the same framework knowledge, and shares one trust center. No certification claim. - [Rate heygrc](https://heygrc.com/rate): we do not send review emails. If the GitHub App helped, rate it on the GitHub Marketplace (https://github.com/marketplace/heygrc). - [ISMS Copilot](https://ismscopilot.com): the parent brand. heygrc is "by ISMS Copilot". - [Trust center](https://trust.ismscopilot.com): the single, shared trust and security evidence surface for ISMS Copilot and heygrc. - [ISO 27001 programme](https://trust.ismscopilot.com/en/iso-27001): Better ISMS is getting certified. It is on the way. We are not certified today. Intended scope includes how we build and run heyGRC. Not a product certificate.