Self-host OpenGRC
v0.1.0-alpha-3Governance, risk and compliance platform for security teams
- Stars
- 157
- Port
- 80 (HTTP web application)
- Requires
- MySQL/MariaDB
What is OpenGRC?
A GRC web application built for smaller security teams that need a full program without enterprise cost or complexity. It delivers risk registers tied to controls and assets, audit workflows with evidence tracking, vendor questionnaires, incident playbooks, policy authoring with approvals, asset inventories, and executive dashboards. The Community Edition is the complete self-hosted platform with no seat limits, under Elastic License 2.0. It requires PHP 8.4+, Laravel, Filament, and MySQL/MariaDB or PostgreSQL. Deploy via Docker Compose, standalone container, or install script. The hosted Enterprise tier adds AI assessments, an MCP server for AI assistants, and managed infrastructure.
OpenGRC alternatives
proboProbo is a self-hosted GRC platform for engineering teams to manage SOC 2, GDPR, ISO 27001, and HIPAA compliance with a web console, CLI, GraphQL API, and MCP tools.Compareprobo with OpenGRC
AiSOCSelf-hosted, open-source AI SOC with 2,535 detection rules and agents that record every step in an auditable ledger. MIT licensed, no API keys needed.CompareAiSOC with OpenGRC
compOpen-source, self-hosted compliance platform that automates evidence, policies and controls for SOC 2, ISO 27001, HIPAA or GDPR, pitched as a Vanta alternative.Comparecomp with OpenGRC
open-sparrowOpenSparrow is a self-hosted, open-source PHP platform generating CRUD apps, dashboards, calendars from JSON schema on PostgreSQL. Includes RAG, workflows, Kanban, 2FA.Compareopen-sparrow with OpenGRC
FleetOpen-source MDM and endpoint management for macOS, Windows, Linux and mobile: self-hosted software patching, vulnerability tracking and live device reports.CompareFleet with OpenGRC
marbleMarble is a self-hosted, open-source fraud and AML platform: no-code transaction monitoring, sanctions and PEP screening, case management and AI-assisted investigations.Comparemarble with OpenGRC
GetMCPGetMCP is a self-hosted Zero Trust proxy for AI agents that generates MCP servers from OpenAPI specs and enforces per-agent policies with tamper-evident audit logs.CompareGetMCP with OpenGRC
CockpitCockpit is a self-hosted, open-source headless CMS with GraphQL and REST APIs, flexible content modeling, and multi-language support. Runs on PHP with SQLite or MongoDB.CompareCockpit with OpenGRC
Should you self-host OpenGRC?
OpenGRC scores 40/100 on selfhost.directory (how scoring works) and ranks #7 of 8 in Compliance. It has 157 GitHub stars.
There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.
Setup is moderate: expect some configuration beyond a single command. It is Other-licensed and written mostly in PHP.
Its closest alternative on selfhost.directory is probo (62/100, 1 487 stars). It scores higher overall, so compare the two before you pick. See OpenGRC vs probo side by side.
Features
- AI-Powered Risk AssessmentsAvailable only in Enterprise hosted edition
- Asset and Application Inventory
- Audit Management
- Controls and Frameworks Management
- Dashboards and Reporting
- Incident response
- MCP Server IntegrationAvailable only in Enterprise hosted edition
- Policy Management
- REST API
- Risk Management
- Single Sign-On (OAuth/OIDC)
- Vendor Risk Management (TPRM)
OpenGRC README
GRC anyone can do.
Self-hosted governance, risk and compliance for small and mid-sized security teams.
Website · Documentation · Community Edition · Enterprise · Trust Center
FAQ
Are there any additional fees I need to be aware of?
Enterprise intends to offer best value with some features free and some for sale, but will not paywall common-sense features. A marketplace for vetted vendors is planned.
How do you ensure data security and compliance?
OpenGRC uses dedicated virtual hardware and databases per deployment (no multi-tenancy), conducts routine security audits and penetration testing, maintains SOC 2, and aligns with OWASP ASVS and CSA STAR.
Do you support any 3rd party integrations?
No built-in third-party integrations currently, but a full REST API is available for custom integrations. Some integrations are on the roadmap.
More in Compliance
OpenSignA self-hosted, open-source DocuSign alternative for e-signing PDFs: templates, sequential multi-signer flows, audit trails and a document vault.
PatchMonSelf-hosted open-source platform for patching Linux, FreeBSD, and Windows fleets with outbound-only agents, dry-run validation, and browser SSH/RDP.
PIAPIA is a free, open-source tool from the French CNIL for GDPR Data Protection Impact Assessments. Available as a portable desktop app or self-hosted web application.- proboProbo is a self-hosted GRC platform for engineering teams to manage SOC 2, GDPR, ISO 27001, and HIPAA compliance with a web console, CLI, GraphQL API, and MCP tools.
rudderRudder is a self-hosted, open-core infrastructure security automation platform for configuration, patching, and compliance across Linux and Windows.
TeampassSelf-hosted, open-source team password vault on PHP/MySQL: folder and role access control, AES-256-GCM encryption, LDAP/OAuth2 SSO, TOTP and compliance reports.
ThreatMapperSelf-hosted, open-source CNAPP: Deepfence ThreatMapper scans cloud, Kubernetes and container workloads for vulnerabilities, exposed secrets and CIS compliance gaps.
tirrenoA self-hosted PHP security framework that spots account takeovers, fraud, and logic abuse inside your app using a dashboard, rule engine, and audit trails.
WazuhSelf-hosted, open-source XDR and SIEM platform: endpoint agents plus server, indexer and dashboard for log analysis, file integrity, vulnerabilities and compliance.
WikiSuiteWikiSuite is the most comprehensive and integrated Open Source enterprise solution, offering a suite of tools for communication, collaboration, data management, and more.
ackifySelf-hosted platform for cryptographic proof of document reading via Ed25519 signatures. Supports OAuth2 and MagicLink for compliance and GDPR.
auliteSelf-hosted HTTP proxy that checks AI interactions for EU AI Act compliance, records them in a tamper-proof audit log, and produces legal-grade PDF reports.
0 comments