GRC anyone can do.
Self-hosted governance, risk and compliance for small and mid-sized security teams.
Website · Documentation · Community Edition · Enterprise · Trust Center
--- OpenGRC is a governance, risk and compliance platform built for teams who need to run a real security program without a six-figure budget or a three-week onboarding. It is not trying to replace a large enterprise GRC suite — but for a lot of organisations, it does. We built it because we were tired of platforms that cost $30k a year, required a consultant to operate, and still nickel-and-dimed on every module. **Self-host it for free. Run your whole program. Own your data.** ## What it does - **Frameworks and controls** — import common security frameworks, then connect standards, controls and your actual implementations rather than maintaining three spreadsheets. - **Risk management** — a risk register that links to the controls and assets it actually concerns, with scoring and treatment tracking. - **Audit management** — run internal and external audits end to end: requests, evidence, findings and remediation, with reports you can hand to an auditor. - **Vendor risk (TPRM)** — vendor inventory, security questionnaires and document tracking. - **Incident response** — incidents, playbooks, tasks and timelines. - **Policy management** — author, review and publish policies with approval workflows. - **Asset and application inventory** — know what you have before you try to secure it. - **Dashboards and reporting** — progress you can show a board without building a deck. ## Requirements - PHP 8.4+ - MySQL / MariaDB (or PostgreSQL) - Composer and Node.js 20.19+ (20.x) or 22.12+ Built on [Laravel 13](https://laravel.com) and [Filament](https://filamentphp.com). ## Quick start The fastest path is Docker: ```bash git clone https://github.com/LeeMangold/OpenGRC.git cd OpenGRC cp .env.docker.example .env docker compose up -d ``` To install directly onto a server instead: ```bash git clone https://github.com/LeeMangold/OpenGRC.git cd OpenGRC ./install.sh ``` Full installation, upgrade and configuration guides live at **[docs.opengrc.com](https://docs.opengrc.com)**. ## Community and Enterprise The **Community Edition** in this repository is the complete self-hosted platform. No seat limits, no data caps, no crippled trial. It covers the core program: risk, controls and implementations, vendor management, project management and incident response. **[Enterprise](https://opengrc.com/enterprise)** is the hosted, supported edition. It adds the AI and premium modules — AI risk assessments, AI gap assessments, automated vendor survey responses — along with an **MCP server** that connects OpenGRC directly to Claude and ChatGPT, so you can ask your assistant which controls lack evidence and have it actually read your program. It comes with an uptime commitment, SOC 2 Type II attestation and support. See [pricing](https://opengrc.com/pricing) and [security](https://opengrc.com/security). Running GRC for a book of clients? There is an [MSSP edition](https://opengrc.com/mssp) with isolated instances per client. ## Contributing Contributions are welcome — issues, pull requests and ideas alike. Start with [CONTRIBUTING.md](CONTRIBUTING.md), and please open an issue before starting anything large so we can agree on the approach first. Questions and ideas are best raised in [Discussions](https://github.com/LeeMangold/OpenGRC/discussions). ## Security Please do not report security issues in public issues. See [SECURITY.md](SECURITY.md) for how to report a vulnerability, or use the contact details published at [opengrc.com/.well-known/security.txt](https://opengrc.com/.well-known/security.txt). ## License OpenGRC is **source-available** under the [Elastic License 2.0](LICENSE.txt). In plain terms, you may: - ✅ Use OpenGRC for free, including inside a commercial business - ✅ Self-host it on your own infrastructure, for your own organisation - ✅ Read, modify and redistribute the source What you may **not** do: - ❌ Offer OpenGRC to third parties as a hosted or managed service - ❌ Circumvent the licence key functionality - ❌ Remove or obscure licensing and copyright notices If you want to provide OpenGRC as a service to your own clients, that is what the [MSSP edition](https://opengrc.com/mssp) is for — [talk to us](https://opengrc.com/contact). > **Licence history.** Commits prior to 14 April 2025 were released under the MIT License. > Commits from 14 April 2025 were released under CC BY-NC-SA 4.0. Those releases remain > available under their original terms; the Elastic License 2.0 applies from the date noted > in this file forward. OpenGRC™ is a trademark of OpenGRC, LLC.