CISO Assistant From €39/mo · Free plan 9.4 Visit ComplianceOS
grcompliance.com
What it is
ComplianceOS is an open-core governance, risk and compliance platform for organizing work across frameworks including SOC 2, ISO 27001, HIPAA, GDPR and NIST. Its AI policy generator tailors policies to an industry and selected frameworks, while Smart Mapping links a control to several frameworks at once. Evidence Collection assigns tasks, tracks progress, supports reviews and sets due dates. Risk tools include a register, heat maps, calculations and treatment workflows; vendor management keeps third-party vendors and their security posture in one registry. Audit dashboards show each framework’s status, and other modules cover threat intelligence and business impact analysis, including RTO/RPO, criticality scoring and continuity planning. Consultants and MSPs can switch between clients through multi-tenancy. The Community edition is MIT-licensed and lists 30+ frameworks and 1,000+ pre-built controls. It can be self-hosted with Docker or Node.js and PostgreSQL, with self-hosted AI tasks routed to named providers or compatible endpoints. Community and SaaS trial plans are free; paid plans start at $149 a year.
Spec sheet
- What it does
- ComplianceOS is presented as an open-source governance, risk and compliance operating system for managing controls, evidence, audits and regulatory frameworks.Read 15 Oct 2026 · github.com
- Integrations
- The repository names Jira, Slack and GitHub integrations and storage connectors for AWS S3, Azure Blob and Google Cloud.Read 15 Oct 2026 · github.com
- AI extensibility
- Self-hosted deployments can route AI work to OpenAI, Anthropic, Google Gemini, DeepSeek, vLLM or Ollama through environment settings.Read 15 Oct 2026 · grcompliance.com
- AI integrations
- Self-hosted deployments can route AI tasks to OpenAI, Anthropic, Google Gemini, DeepSeek or OpenAI-compatible endpoints such as vLLM and Ollama.Read 30 Sep 2026 · grcompliance.com
- AI policy generator
- Its AI policy generator creates audit-ready policies tailored to an industry and selected frameworks.Read 30 Sep 2026 · grcompliance.com
- API and plugins
- The repository describes a tRPC API and an addon system intended for custom integrations, while the community page says a public plugin registry is planned for Q2 2026.Read 15 Oct 2026 · github.com
- Audit management
- Audit Hub centralizes evidence, provides auditor-specific views and can freeze compliance state in point-in-time snapshots.Read 15 Oct 2026 · github.com
- Audit readiness
- Audit Readiness provides real-time dashboards showing status for each framework.Read 30 Sep 2026 · grcompliance.com
- Business continuity
- Business-impact analysis, RTO/RPO workflows, recovery plans and emergency call trees are listed as built-in capabilities.Read 15 Oct 2026 · github.com
- Business impact analysis
- Business Impact Analysis covers RTO/RPO, criticality scoring and continuity-plan generation.Read 30 Sep 2026 · grcompliance.com
- Company legal record
- A Companies House-derived listing identifies an active INTELLFENCE LTD incorporated on 5 December 2024 at 71-75 Shelton Street, Covent Garden, London.Read 15 Oct 2026 · ukcompanies.lursoft.lv
- Company social presence
- A LinkedIn post identifies Intellfence BV and showed about 1,243 followers when opened.Read 15 Oct 2026 · linkedin.com
- Control mapping
- Its Mesh architecture maps one implemented control to requirements in several frameworks and identifies overlapping requirements.Read 15 Oct 2026 · github.com
- Cyber resilience
- The repository lists centralized incident reporting and recurring cyber-maturity assessments.Read 15 Oct 2026 · github.com
- Data sovereignty
- The community page says self-hosted installations keep compliance data in the customer environment and make no phone-home or telemetry calls.Read 15 Oct 2026 · grcompliance.com
- Documentation
- The repository links separate addon-development, architecture, API-reference and database-schema documents, indicating documentation beyond a single installation guide.Read 15 Oct 2026 · github.com
- Evidence collection
- Evidence Collection assigns tasks, tracks progress, supports review workflows and sets due dates.Read 30 Sep 2026 · grcompliance.com
- Framework library
- The repository lists built-in ISO 27001, SOC 2, HIPAA, PCI-DSS, NIST 800-53 and GDPR support.Read 15 Oct 2026 · github.com
- Frameworks
- The platform lists ISO 27001, SOC 2, HIPAA, GDPR, NIST 800-53, PCI-DSS, NIST 800-171 and CMMC among its supported frameworks.Read 30 Sep 2026 · grcompliance.com
- Government compliance
- Federal workflows cover NIST 800-171, CMMC, system-security-plan editing, POA&M tracking and FIPS 199 categorization.Read 15 Oct 2026 · github.com
- Independent company-data limitation
- The external legal-record page covers INTELLFENCE LTD in London, while the product footer names Intellfence BV; the opened sources do not establish that these are the same legal entity.Read 15 Oct 2026 · ukcompanies.lursoft.lv
- Licence
- The repository states that the Community Edition is AGPLv3 and that an Enterprise Edition is commercially licensed with advanced features and support.Read 15 Oct 2026 · github.com
- Limit: advanced features
- The repository says advanced automation, specialized frameworks, threat intelligence, unlimited workspaces and advanced API integrations are reserved for Enterprise in its open-core comparison.Read 15 Oct 2026 · github.com
- Limit: independent reviews
- Gartner Peer Insights has a ComplianceOS listing with no reviews yet, so there is no Gartner user-rating evidence for this product.Read 15 Oct 2026 · gartner.com
- Limit: plan inconsistency
- The pricing page currently shows Community, Professional and Lifetime tiers, while older indexed material referenced Consultant and Business tiers, so buyers should verify the live offer before purchase.Read 15 Oct 2026 · grcompliance.com
- Limit: product identity on Gartner
- The Gartner listing is explicitly for ComplianceOS by Caveonix, not the Intellfence product at grcompliance.com.Read 15 Oct 2026 · gartner.com
- Managed security claims
- The managed cloud offering is described as having managed backups, a 99.9% uptime SLA, SOC 2 compliant infrastructure and SAML/OIDC enterprise SSO.Read 15 Oct 2026 · grcompliance.com
- Multi-tenancy
- Multi-Tenancy lets MSPs and consultants switch between clients instantly.Read 30 Sep 2026 · grcompliance.com
- Open source
- The Community edition is described as fully open source under the MIT license, with 30+ frameworks and 1000+ pre-built controls.Read 30 Sep 2026 · grcompliance.com
- Privacy workflows
- Privacy Center includes records-of-processing generation, data-subject-request workflows and DPIA support.Read 15 Oct 2026 · github.com
- Product scope
- ComplianceOS is an open-core GRC platform for compliance infrastructure covering SOC 2, ISO 27001, HIPAA, GDPR and NIST.Read 30 Sep 2026 · grcompliance.com
- Repository activity
- The public GitHub repository showed 3 stars, 1 fork and 0 open issues when opened.Read 15 Oct 2026 · github.com
- Risk management
- The platform describes an ISO 31000-aligned risk engine with heatmaps, asset-linked risks and treatment plans with audit trails.Read 15 Oct 2026 · github.com
- Self-hosting
- The quickstart supports Docker Compose or a manual Node.js and PostgreSQL installation and exposes the app locally on port 5173.Read 15 Oct 2026 · grcompliance.com
- Smart mapping
- Smart Mapping maps one control to ISO 27001, SOC 2, HIPAA, GDPR and NIST simultaneously.Read 30 Sep 2026 · grcompliance.com
- System requirements
- Self-hosting documentation requires Node.js 18 or newer, PostgreSQL 15 or newer and Git, with Docker and docker-compose optional.Read 15 Oct 2026 · grcompliance.com
- Technical architecture
- The documented stack uses React and TypeScript on the frontend, Node.js and Express on the backend, tRPC for the API, PostgreSQL with Drizzle ORM, and JWT/OAuth2 authentication.Read 15 Oct 2026 · github.com
- Threat intelligence
- Threat Intelligence provides a living threat library, vulnerability mapping and industry-standard threats.Read 30 Sep 2026 · grcompliance.com
- Vendor management
- Vendor Management tracks third-party vendors and their security posture in a centralized registry.Read 30 Sep 2026 · grcompliance.com
- Vendor risk
- Third-party-risk features include vendor onboarding, questionnaires, scoring, contract tracking and a vendor catalog.Read 15 Oct 2026 · github.com
Plans and prices
Community Free free forever core GRC modules · standard framework controls · single-command Docker deployment · bring-your-own AI keys · 1 workspace · community GitHub support Read 15 Oct 2026 · grcompliance.com
Free SaaS Trial Free No credit card 1 workspace · 5 users max · 100 AI generations/mo · 500MB storage Read 30 Sep 2026 · grcompliance.com
Consultant $149 a year per year 3 workspaces · email support · no SSO · no white-label Read 30 Sep 2026 · grcompliance.com
Secure Install Service $499, paid once one-time service fee AWS, Azure, GCP or private VPS deployment · Docker provisioning · SSL/TLS reverse proxy · firewall hardening · encrypted backups · SSO integration · administrator walkthrough Read 15 Oct 2026 · grcompliance.com
Professional $1,592 a year annual; founding price shown, regular price $1,990/year unlimited workspaces · SOC 2, ISO 27001, HIPAA, GDPR and NIST frameworks · continuous evidence collection · vendor risk management · AI policy generator · questionnaire responder · white-label reports · priority support Read 15 Oct 2026 · grcompliance.com
Business $1,990 a year per year Unlimited workspaces · unlimited users · SSO/OIDC · premium integrations · priority support Read 30 Sep 2026 · grcompliance.com
Lifetime $3,992, paid once one-time; founding price shown, regular price $4,990 everything in Professional · permanent license · unlimited users and workspaces · all frameworks and AI features · lifetime updates and support Read 15 Oct 2026 · grcompliance.com
Enterprise $4,990 a year per year White-label · SLA guarantee · dedicated support · custom onboarding · training session Read 30 Sep 2026 · grcompliance.com
Audit Ready Sprint $5,510, paid once add-on fee; page states $7,500 total with base license 30-day gap assessment · custom policy drafting · evidence collection and mapping · mock audit walkthrough · auditor introductions Read 15 Oct 2026 · grcompliance.com
Enterprise Priced on request from $9,990; tailored deployment custom SLA · air-gapped deployment · dedicated compliance engineers · executive board reporting dashboards Read 15 Oct 2026 · grcompliance.com
Strong points and limits
Strong points
- Maps one control across several frameworks.
- Evidence workflows include task tracking and due dates.
- Risk tools include heat maps and treatment workflows.
- Self-hosting supports Docker or Node.js with PostgreSQL.
- Community edition is MIT-licensed.
Limits
- Free SaaS trial is limited to one workspace and five users.
- Consultant plan costs $149 a year.
- Business and Enterprise plans cost 1990.00 and $4,990 a year.
Who it suits
Compliance teams needing tools across multiple frameworks may find its mapping, evidence and risk workflows relevant. Consultants and MSPs can use multi-tenancy to switch between clients, while organizations requiring local deployment can self-host.
ComplianceOS in depth
Read the full write-up
ComplianceOS is a governance, risk and compliance platform for organizations managing several security or privacy frameworks. It is best suited to teams that want to coordinate control, evidence and risk work, and to consultants or MSPs handling multiple clients. Its strongest distinction is a genuinely self-hostable, MIT-licensed Community edition; buyers who need larger SaaS workspaces will need to move to a paid plan.
Overview
ComplianceOS brings framework mapping, evidence collection, risk and vendor management together. It supports ISO 27001, SOC 2, HIPAA, GDPR, NIST 800-53, PCI-DSS, NIST 800-171, CMMC, FedRAMP, CCPA and NIST CSF. Smart Mapping links one control across ISO 27001, SOC 2, HIPAA, GDPR and NIST, a practical advantage when a team is pursuing overlapping standards and wants to avoid treating each as a separate control set.
The open-source Community edition includes 30+ frameworks and 1,000+ pre-built controls. Customers can deploy it with Docker or Node.js and PostgreSQL on their own infrastructure; compliance data stays in that environment, with no phone-home behavior or telemetry. That is a meaningful option for data-sovereignty needs, but self-hosting also means taking responsibility for the deployment.
Key features
Controls, policies and evidence
The AI policy generator creates audit-ready policies tailored to an industry and selected frameworks. Self-hosted deployments can route AI tasks to OpenAI, Anthropic, Google Gemini, DeepSeek, or OpenAI-compatible endpoints such as vLLM and Ollama. Evidence Collection assigns tasks, tracks progress, supports review workflows and sets due dates, helping teams turn requirements into accountable work rather than static checklists.
Risk, vendors and readiness
Risk Management combines a register and heat maps with calculations and treatment workflows. Vendor Management keeps third-party vendors and their security posture in one registry, while Audit Readiness dashboards show status by framework. Threat Intelligence adds a living threat library and vulnerability mapping. Business Impact Analysis covers RTO/RPO, criticality scoring and continuity-plan generation. Together, these modules suit teams looking for a broad GRC workflow; organizations seeking only a narrow policy or audit tool may not need the full scope.
Client workspaces
Multi-Tenancy lets MSPs and consultants switch between clients instantly. That makes ComplianceOS more relevant to service providers than a single-workspace tool, though the plan limits matter: the Consultant tier includes three workspaces, while unlimited workspaces start at Business.
Pricing
ComplianceOS has a free Community edition, a free SaaS trial and three annual paid plans. The Community edition is free under the MIT license and includes one workspace, core GRC modules, Docker deployment, bring-your-own AI and community support. It is the clearest fit for technically capable teams that value source access and control over where data resides.
The Free SaaS Trial is $0.00 per free, requires no credit card, and caps usage at one workspace, five users, 100 AI generations per month and 500MB of storage. It is useful for a small evaluation, but those ceilings make it a limited long-term home for a growing team.
Consultant costs $149 a year for three workspaces and email support. It has no SSO and no white-label option, so it fits smaller client-service practices that can work without those capabilities. Business is $1,990 a year and adds unlimited workspaces and users, SSO/OIDC, premium integrations and priority support; it is the more suitable tier for larger organizations or providers managing many clients. Enterprise is $4,990 a year, adding white-labeling, an SLA guarantee, dedicated support, custom onboarding and a training session. That premium is most defensible when those service commitments and branded delivery matter.
Platforms
ComplianceOS runs on the web or can be self-hosted. Self-hosting requires Docker or Node.js plus PostgreSQL on the customer’s infrastructure, giving deployment control at the cost of operating the environment.
Who it's for
ComplianceOS is a strong fit for organizations coordinating multiple frameworks, and for consultants or MSPs that need client workspaces. Its Community edition is especially compelling for teams able to self-host and prioritize data sovereignty. Buyers who need a simple SaaS evaluation can start with the capped trial, but should account for its user, AI and storage limits before relying on it beyond evaluation.
Pros and cons
Pro: Smart Mapping spans five major frameworks, reducing duplicated control work for teams pursuing several of them.
Pro: MIT licensing, self-hosting and local data retention give technically capable organizations meaningful deployment control.
Pro: Evidence, risk, vendor, threat and business-impact modules cover more of the compliance workflow than control mapping alone.
Con: The free SaaS trial is capped at five users, 100 AI generations a month and 500MB, limiting its usefulness for larger evaluations or ongoing programs.
Con: Consultant lacks SSO and white-labeling, while unlimited users and workspaces require the substantially more expensive Business plan.
Alternatives
Compliance Management Software is a useful starting point for comparing products across the category.
Choose CISO Assistant if you want a self-hosted community option with unlimited users, or a Pro SaaS plan priced at €39 a month. Drata is an alternative for buyers looking at paid GRC plans, including a Foundation tier for up to 50 FTEs and one pre-mapped framework. Strike Graph may suit teams starting with its free Launch plan for SOC 2 security TSC, limited policy templates and specified cloud and document integrations. ComplianceBridge Policy Management is an alternative focused on policy management. IsoMetrix is another paid option with self-hosted and web platforms. NAVEX EthicsPoint Incident Management is an alternative for incident management. OpenGRC offers a free self-hosted Community plan with full source access, as well as paid Enterprise plans. Probo is another option for buyers considering a managed service.
Verdict
Choose ComplianceOS if you need broad framework coverage, connected GRC workflows and the option to keep compliance data on your own infrastructure. Its open-source Community edition is the main reason to shortlist it; look elsewhere if you need generous SaaS capacity at a low tier, since the trial is tightly capped and the Consultant plan omits SSO and white-labeling.
Verdict
ComplianceOS brings framework mapping, evidence collection, risk and vendor management into one platform. The free Community edition and self-hosting option are distinct choices; paid plans add higher-tier workspace and support options.
Where Specifiction places it
- Compliance Management Software#2 of 519.1
