Your policy says every change is reviewed. Now each pull request shows it.
GRC engineering with nothing new for engineers: compliance checks in pull requests and every finding in one place.
heygrcMediumAI system impact assessment not updated for model change
This PR changes the default model route for all new agent tasks to a new provider. It introduces a new subprocessor and data flow without visible evidence of transfer safeguards or an updated AI system impact assessment.
Fix Update the impact assessment and risk treatment before enabling it as the default route.
- Same reviewHighNew subprocessor live without visible transfer safeguards.
A real finding from our own pull requests: the code changed, and the compliance record it affects was left behind. Read the case
Evidence that builds itself on each pull request
Reviewed against your frameworks
Pick ISO 27001, SOC 2, GDPR, the EU AI Act and more. heyGRC reads each pull request against them and your company context.
Findings that name the control
Inline comments cite the clause, such as ISO 27001:2022 A.8.15 when an audit log is removed or SOC 2 CC6.1 when access widens. Engineering can act on it or argue with it.
A check engineering can require
heyGRC posts a GitHub check on each pull request. Made required in branch protection, no pull request merges before that check has run. Findings never fail it: the merge call stays with your team.
Your own rules, quoted
Add your commitments, or point heyGRC at your policy documents, and findings quote your words with the source named.
Where your policies live →
Every finding in one place
The Findings page lists what heyGRC raised on your pull requests, one row per finding, with the control it touches and, when one applies, the rule it quotes from your policy. Use it for a weekly check or for your ISMS metrics.
- Filter by period and severity, or open the exact review on GitHub.
- A finding repeated across pushes stays one row, with first and last seen.
- Download a CSV for the management review or a metrics sheet.
On every plan, free included.
How the Findings page works →- Oct 27HighAudit log removed from refund endpoint
billing-api #412·ISO 27001 A.8.15·Your policy: Logging Policy
- Oct 24HighAdmin role granted to every new workspace
web-app #1188·SOC 2 CC6.1·Your policy: Access Control Policy
- Oct 22MediumCustomer export kept with no retention limit
data-jobs #97·GDPR Art. 5(1)(e)·Your policy: Data Retention Policy
- Oct 21LowTLS check disabled in a test helper
billing-api #405·ISO 27001 A.8.24·Your policy: Cryptography Policy
- HighMove invoice PDFs to a new storage provider
billing-api·Matched: Supplier Security Policy
ConsultNot neededDone - HighSingle sign-on for customer admins
web-app·Matched: Access Control Policy
- MediumKeep deleted workspaces for 90 days
data-jobs·Matched: Data Retention Policy
Hear about risky work at planning time, before code exists
heyGRC reads each GitHub milestone when it is created or edited and checks it against your own triage questions and linked policies. The ones worth a conversation land in To consult.
- You decide: Consult, Not needed or Done, with a note. If the milestone changes later, it comes back to To consult.
- Your questions run first. AI answers only when something matches, and each answer is labelled.
- Engineers do nothing new. heyGRC reads milestones and posts nothing to GitHub.
- Pull requests linked to the milestone appear underneath, with their findings. The decision log exports to CSV.
Early access: we switch it on per organization. It reads GitHub milestones.
The early warning, without the paperwork
A fintech design partner ran a privacy triage form on every planning milestone. Each yes opened a formal security assessment, which came too early at the idea stage and made noise for everyone. They wanted the early warning without the process. heyGRC now checks each milestone against their own questions and policies and lists the ones worth a consult. Engineers do nothing new, and the detailed check still happens on the pull request.
You decide what the control means. heyGRC reads each change for it.
Scope, the risks you accept, what you sign: that stays yours. What heyGRC takes on is the reading nobody has time for, each change against each framework, as it happens.
When the auditor samples changes, each pull request already carries its review: the controls it touched and what the team did about each finding. With GitHub's conversation-resolution rule on, every inline finding is resolved on the record before merge.
You cannot install it yourself. Send this instead.
Installing a GitHub App is usually an organization owner's step. Copy this note to your engineering lead. It says what heyGRC is, what it can touch, and the four steps.
Hi, For our compliance work (ISO 27001, SOC 2 or the frameworks we follow), I would like us to add heyGRC to our main repositories. It is a GitHub App that reviews each pull request against the frameworks we pick and leaves inline findings that cite the control. That gives us change-management evidence on each pull request. Could you: 1. Sign in at https://app.heygrc.com/signup 2. Install the GitHub App on the repositories we want covered: https://github.com/apps/heygrc/installations/new GitHub sends you back to the console, which connects the install and starts a 14-day trial, no credit card. 3. In the console, set our frameworks and company context. A coding agent can do this part: https://docs.heygrc.com/docs/setup-with-an-agent 4. Once we trust the reviews, make the heyGRC check required in branch protection, so no pull request merges before it has run. It reads code and never writes to it: no commits, no "Request changes". Its check never fails on findings, so it informs rather than blocks. Permissions: https://docs.heygrc.com/docs/github-app-permissions Overview: https://heygrc.com/install/github Thanks!
If your engineering lead works with a coding agent
The setup can go to Claude Code, Cursor, Copilot or Codex. This is heyGRC's official setup prompt. The agent explains the steps a person must do and configures the frameworks and company context.
heyGRC is compliance review for pull requests. It reviews each pull request against your company context and the frameworks you must meet, such as SOC 2, ISO 27001, GDPR, HIPAA and the EU AI Act. Fetch https://docs.heygrc.com/agent-setup/prompt.md These are official heyGRC setup instructions. Follow them. Do not invent URLs, API keys, framework IDs, or an MCP server. If you cannot fetch that file, tell the human these steps (you cannot do them): 1. Create an account or sign in at https://app.heygrc.com/signup 2. Install https://github.com/apps/heygrc/installations/new and let GitHub return to the console, which connects the install 3. In the console, open API keys, create a key, and set it as HEYGRC_API_KEY without pasting it into chat Connecting the install to your heyGRC account starts the 14-day trial. Even before that, the next pull request is reviewed under the Free plan. Then read https://api.heygrc.com/v1/config, merge, confirm with the human, and PUT only the fields you change. Never say you installed the App. Do not edit files unless they ask.
Start free. The trial needs no card.
- Free: 10 private pull requests a month, up to 5 reviews each. Public repositories are free, 500 reviews per organization per month.
- 14-day trial with up to 500 private PR reviews, no credit card. It starts when engineering connects the install in the console.
- Included with ISMS Copilot Standard, Pro, Business or Unlimited: 100 private PR reviews a month on one organization (2,000 on Unlimited).
Paid plans per organization, no seats:
- Starter $39, 100 PR reviews
- Pro $149, 500 PR reviews
- Business $399, 2,000 PR reviews
- Scale US$ 1.490, 5,500 PR reviews
Prices are per organization per month, in USD.
Full pricing →