heygrc is a pull‑request compliance review tool that automatically checks every PR for changes that could violate security or audit frameworks, whether the code was written by a person or an AI agent.
What is heygrc?
heygrc reviews every GitHub pull request the moment it opens, detects code changes that put a compliance control at risk, and posts inline comments with the specific clause that would be violated (e.g. ISO 27001:2022 A.8.15 or SOC 2 CC7.2). It accepts a GitHub repository as input and outputs a compliance review with a pass/fail check status that can be required in branch protection. The product is built by ISMS Copilot, an AI compliance platform covering 76 frameworks.
Key Features
- Framework coverage — Supports 76+ compliance frameworks including ISO 27001, SOC 2, SOC 1, GDPR, DORA, NIS 2, ISO 42001, EU AI Act, PCI DSS, HIPAA, ISO 27701, NIST CSF, FedRAMP, CCPA, Cyber Essentials, TISAX, CIS Controls, and others. You select which frameworks apply to your company.
- Inline, control‑specific comments — Every finding cites the exact control (e.g. “ISO 27001:2022 A.8.15 expects logs kept to your defined retention policy”) so the developer knows what to fix and why.
- GitHub check status — Posts a pass/fail status that you can make a required check in branch protection settings, turning compliance into a CI gate.
- Works with AI‑generated code — Reviews PRs from Claude Code, Cursor, Copilot, Codex, and any AI coding agent, catching compliance issues in code that moves too fast for manual checks.
- Company‑specific context — Reviews against your sector, data types, and hosting region rather than a generic checklist.
- No CI config required — Installs as a GitHub App; no YAML files, no separate CI pipeline to maintain.
Who is it for?
- Development teams heading into their first SOC 2 or ISO 27001 audit — They can catch retention‑policy violations or logging changes during code review instead of during the audit.
- Engineering managers responsible for compliance‑gated releases — They can enforce compliance checks as a required status on every PR before merge.
- Security and compliance engineers — They offload manual PR‑by‑PR review to an automated tool that cites the exact control clause.
Use cases
- Audit‑log retention change flagged: A developer changes
AUDIT_LOG_RETENTION_DAYS from 365 to 30. heygrc posts a comment citing ISO 27001:2022 A.8.15 and SOC 2 CC7.2, requiring confirmation before merge.
- AI‑agent‑written PR compliance check: An AI coding agent submits a PR that modifies encryption settings. heygrc reviews it identically to a human‑written PR, flagging changes that affect NIST 800‑53 controls.
- Pre‑audit cleanup: The week before a SOC 2 audit, the team enables heygrc on all repositories to catch any lingering PR that would violate CC6.1 or CC7.2.
How does heygrc work?
- Install the GitHub App on your repositories — no CI configuration or YAML files needed.
- Select your compliance frameworks and optionally add company context (sector, data types, region). Onboarding takes under two minutes.
- Every PR is reviewed automatically — heygrc posts inline comments, a summary review, and a GitHub check status that you can require in branch protection before merging.
Pricing
heygrc offers a freemium model. Public repositories are always free. Private repositories get 25 free reviews per month. New installs start with a 14‑day unlimited trial (no credit card required). After the trial, usage beyond the free tier costs $0.49 per review; a review is never blocked for non‑payment.
FAQ
Which frameworks does heygrc cover?
76 frameworks, including ISO 27001, SOC 2, SOC 1, GDPR, DORA, NIS 2, EU AI Act, PCI DSS, HIPAA, NIST CSF, FedRAMP, CCPA, Cyber Essentials, TISAX, SOX, CIS Controls, and many more. You select the ones that apply to your company.
