Security programs built on black boxes are compliance theater. Real trust requires transparency — in your controls, your tools, and your code.
Every algorithm, every control mapping, every audit log — fully inspectable. No hidden logic, no vendor lock-in. Your auditors can see exactly how decisions are made.
Self-host on your own infrastructure. Your compliance data — risk registers, evidence, policies — never leaves your environment unless you choose it. True data sovereignty.
Control frameworks, threat libraries, and policy templates built and validated by hundreds of security practitioners — not just one vendor's opinion.
Not just the frontend. The risk engine, the policy generator, the mapping logic — all of it.
Quantitative & qualitative risk assessment, heatmaps, treatment workflows
AI-assisted policy drafting with version control, approvals, and distribution
ISO 27001, SOC 2, NIST CSF, CMMC, HIPAA, GDPR, and 25+ more built in
Role-based access, workspace isolation, perfect for MSPs and consultants
Structured evidence tasks, intake forms, audit trails for every artifact
Bring your own LLM key. Gap analysis, policy refinement, control suggestions
TPRM workflows, vendor risk scoring, contract repository, DPA templates
Extend with your own modules. Public plugin registry coming Q2 2026
Whether you write code or write policies — there's a place for you here.
The simplest way to support the project. Stars help us reach more security professionals who need a free, open alternative.
Star on GitHubFound a bug? Have an idea for a new framework or feature? Open an issue or join a discussion — every report makes the platform better for everyone.
Open an IssueAdd a new compliance framework, improve the UI, or fix a bug. Pull requests are reviewed promptly and contributors get credit in the changelog.
Submit a Pull RequestRun ComplianceOS on any server — on-premise, your own cloud, or a VPS. Full Docker support with a single compose file. No phone-home, no telemetry, no license fees.
version: '3.9'
services:
app:
image: complianceos/app:latest
ports: ["5173:5173"]
environment:
DATABASE_URL: ${DATABASE_URL}
SUPABASE_URL: ${SUPABASE_URL}
OPENAI_API_KEY: ${OPENAI_API_KEY}
server:
image: complianceos/server:latest
ports: ["3002:3002"]
depends_on: [app]Self-host for full control, or let us manage it for you.