Security

11 November 2026

GRCompliance is self-hosted software. This page explains how to report a flaw, which release to run, what a self-hosted install sends off the machine, and how release images are built and checked. We do not publish a SOC 2 report, an ISO 27001 certificate, or a penetration-test report for the product itself.

Reporting a flaw

Email security@grcompliance.com. Include the version you are running, whether the install is Core or Premium, and the smallest steps that show the problem. Do not send passwords, licence keys, or customer evidence.

The same address is listed in /.well-known/security.txt and in the repository security policy.

Supported releases

Run the latest published release, and the container image published with it. Each image is also tagged with the commit it was built from. When a newer release is published, older images are not updated on their own.

What leaves a self-hosted install

Policies, risks, evidence files, and the other compliance records stay in that install. The application does not send usage statistics.

  • Activating a licence online sends a request to /v1/lease on the licence server (https://license.grcompliance.com, unless you set a different address). The request contains the licence id, the instance id, and the app version. An offline licence file does not make that call.
  • A self-hosted install can check for updates. You can turn that check off. The public demo does not run it. Core reads the latest public GitHub release. Premium asks the licence server which release is current. Neither request uploads your records.
  • Downloading a Premium update sends the licence credential with the download. It does not upload evidence.
  • A cloud model, a GitHub or AWS evidence collector, a webhook, or outbound mail sends data only if you turn it on, and only to the service you choose.

How releases are built and checked

  • Changes are typechecked, linted, and tested. The repository is scanned for secrets with gitleaks. A separate check refuses large SQL data dumps.
  • The self-hosted container is built for 64-bit Intel and ARM and published to GitHub Container Registry. The image is tagged with the commit it was built from.
  • That publish step does not pin the image to a digest, and it does not attach a software bill of materials.
  • The image starts from Node.js 20 on Alpine. That base image is not pinned to a digest.
  • When an update is downloaded, the install can check the SHA-256 of the file. If the release includes a signature, the install checks it with the published key grc-prod-2026-10. A container digest in the release file is optional.

This website

grcompliance.com is the product website, not the place your install stores evidence. The starter-kit form posts the email address to Ghost at killswitch.work. Licence checkout continues on the licence server, where Stripe takes the card payment. See the privacy notice and the terms.