Skip to content
SPECIFICTION
Get listed

OpenGRC

opengrc.com

From $375/mo Free plan Open source WebAPISelf-hosted
Visit opengrc.com
Spec score 8.8 #3 of 51 in Compliance Management Software

What it is

OpenGRC is a web application for cyber governance, risk and compliance aimed at small and midsized businesses and teams. It covers risk management, controls and implementations, audits, vendor management, incident response and project management. Audit workflows handle evidence requests, progress tracking and report generation. Vendor assessments can use a dedicated portal, customizable questionnaires and weighted scoring. Listed frameworks include NIST 800-171, ISO 27001, SOC 2, CMMC and PCI DSS. The platform has no third-party integrations built in, but provides a REST API; the API limit is 60 requests per minute per user, or per IP for unauthenticated requests. Enterprise includes AI risk assessments, automated vendor survey responses and AI gap assessments. The free Community edition is self-hosted and requires a web server and database server. Enterprise Basic costs $4,500 per year, while Enterprise Enhanced costs $7,500 per year. Hosted plans state a 99.5% monthly uptime commitment and say customer data is not used to train AI models.

Spec sheet

What it does
OpenGRC is a cyber governance, risk and compliance web application for small and midsized security teams.Read 15 Oct 2026 · opengrc.com
Product
OpenGRC is a cyber Governance, Risk, and Compliance web application intended for small and midsized businesses and teams.Read 30 Sep 2026 · docs.opengrc.com
Integrations
OpenGRC says it has no third-party integrations currently built into the platform, but provides a REST API for integrations.Read 30 Sep 2026 · opengrc.com
Security
Hosted plans state a 99.5% monthly uptime commitment, encryption in transit and at rest, instance-specific data keys, and an annual independent SOC 2 Type II examination.Read 30 Sep 2026 · opengrc.com
License
Current source is under Elastic License 2.0, allowing internal commercial use, self-hosting and modification while prohibiting third-party hosted service resale; earlier history includes MIT and CC BY-NC-SA 4.0 releases.Read 15 Oct 2026 · github.com
Founded
2025Read 28 Sep 2026 · opengrc.com
Company
The maker identifies itself as OpenGRC, LLC and says OpenGRC started as a side project in December 2024.Read 30 Sep 2026 · opengrc.com
AI data policy
The company says customer data and subprocessors’ processing are not used to train or improve AI models.Read 15 Oct 2026 · opengrc.com
AI data use
OpenGRC states that it does not use hosted-plan customer data to train AI models.Read 30 Sep 2026 · opengrc.com
AI gap assessment
Enterprise AI gap assessment evaluates control effectiveness and prioritizes improvements.Read 15 Oct 2026 · opengrc.com
AI integrations
The Enterprise MCP server supports compatible clients including Claude, ChatGPT, and Cursor, with OAuth 2.1 authentication.Read 30 Sep 2026 · docs.opengrc.com
AI risk assessment
Enterprise Assessor analyzes an organization’s environment, technology stack and implementations against industry risk profiles.Read 15 Oct 2026 · opengrc.com
AI tools
Enterprise includes AI risk assessments, automated vendor survey responses, and AI gap assessments.Read 30 Sep 2026 · opengrc.com
API limits
The REST API is limited to 60 requests per minute per user, or per IP address for unauthenticated requests.Read 30 Sep 2026 · docs.opengrc.com
API permissions
API operations enforce role permissions and return authorization errors when a token lacks the required permission.Read 15 Oct 2026 · docs.opengrc.com
Audit management
The platform creates audits around standards, implementations and programs, assigns evidence and produces reports.Read 15 Oct 2026 · opengrc.com
Authentication integrations
Documentation describes SSO through Microsoft Entra ID, Okta, Google Workspace and Auth0 with automatic user provisioning.Read 15 Oct 2026 · docs.opengrc.com
Automated surveys
Surveyor reads uploaded vendor questionnaires and drafts answers from controls, policies and implementations already in the portal.Read 15 Oct 2026 · opengrc.com
Automation engine
The platform can trigger scheduled or record-change automations performing record changes, tasks, notifications, webhooks, reports, AI steps or waits.Read 15 Oct 2026 · opengrc.com
Availability commitment
Hosted plans commit to 99.5% monthly uptime excluding scheduled maintenance.Read 15 Oct 2026 · opengrc.com
Community hosting
The Community edition is web-based and requires the user to run a web server and database server.Read 30 Sep 2026 · docs.opengrc.com
Community limitation
The maker says Community installation and maintenance require some technical knowledge.Read 30 Sep 2026 · docs.opengrc.com
Company founding
OpenGRC says it began as a side project in December 2024.Read 15 Oct 2026 · opengrc.com
Company profile
LinkedIn lists OpenGRC in computer and network security, headquartered in Casselberry, Florida, with one employee.Read 15 Oct 2026 · linkedin.com
Compliance and frameworks
Users can import common frameworks and connect standards, controls and their implementations.Read 15 Oct 2026 · docs.opengrc.com
GRC features
The platform includes risk management, controls and implementations, audits, vendor management, incident response, and project management.Read 30 Sep 2026 · opengrc.com
Incident response
Incident response includes playbooks, timelines, tasks, findings, lessons learned and reports.Read 15 Oct 2026 · opengrc.com
Independent listing status
AlternativeTo reports no comments or reviews and classifies OpenGRC as freemium, source-available Elastic-2.0 software available as SaaS, online, self-hosted or Docker.Read 15 Oct 2026 · alternativeto.net
Installation
Installation supports Docker or install.sh; production deployments require a queue worker for email, imports and scheduled jobs.Read 15 Oct 2026 · docs.opengrc.com
Legal entity
Florida records identify OPENGRC, LLC as an active LLC filed December 24, 2024, managed by Lee V. Mangold.Read 15 Oct 2026 · search.sunbiz.org
Limit: alpha maturity
The repository security information labels supported version 0.1.x as alpha and not suitable for production use.Read 15 Oct 2026 · github.com
Limit: control import friction
An open GitHub issue requests API or CSV import for controls and implementations, indicating a workflow gap for bulk loading.Read 15 Oct 2026 · github.com
Limit: no built-in integrations
The maker explicitly says third-party integrations are not currently part of the platform, so integrations require the API.Read 15 Oct 2026 · opengrc.com
Limit: self-hosting effort
Independent documentation notes that Community requires running a web server and database and demands technical installation and maintenance knowledge.Read 15 Oct 2026 · docs.opengrc.com
MCP integration
Enterprise includes an MCP server allowing Claude and ChatGPT to read and update records while respecting user permissions.Read 15 Oct 2026 · opengrc.com
Notable news
The founder announced a self-hosted MVP release for October 19, 2024 and described Laravel and Filament as the application stack.Read 15 Oct 2026 · linkedin.com
Policy and asset management
The product includes policy workflows plus asset and application inventory.Read 15 Oct 2026 · github.com
Praise: breadth and free deployment
Independent directory descriptions repeatedly highlight the combination of risk, audits, vendors, incidents and a free self-hosted edition.Read 15 Oct 2026 · alternativeto.net
Rating on G2
0.0 out of 5 from 0 reviews; G2 says there are insufficient reviews for buying insight.Read 15 Oct 2026 · g2.com
REST API
The API uses Laravel Sanctum bearer tokens, supports CRUD across GRC resources, pagination, search, sorting and eager loading, and is limited to 60 requests per minute per user or unauthenticated IP.Read 15 Oct 2026 · docs.opengrc.com
Risk management
Risk tools maintain a register with scoring, treatment tracking and links to related controls and assets.Read 15 Oct 2026 · github.com
Security controls
OpenGRC states annual independent SOC 2 Type II examination and penetration testing, encryption in transit and at rest, instance-specific keys, customizable RBAC, WebAuthn/2FA and activity logging.Read 15 Oct 2026 · opengrc.com
Self-hosting
Community is described as the complete self-hosted edition with no seat limits or data caps.Read 15 Oct 2026 · opengrc.com
System requirements
The repository requires PHP 8.4+, MySQL/MariaDB or PostgreSQL, Composer and Node.js 20.19+ or 22.12+, and is built with Laravel 13 and Filament.Read 15 Oct 2026 · github.com
Third-party integrations
OpenGRC states that it currently has no built-in third-party integrations, while providing a REST API and listing integrations on its roadmap.Read 15 Oct 2026 · opengrc.com
Vendor assessments
Vendor Management supports a dedicated vendor portal, customizable questionnaires, and weighted scoring.Read 30 Sep 2026 · opengrc.com
Vendor risk
Vendor management provides inventory, security questionnaires, document tracking, weighted scoring and a separate vendor portal.Read 15 Oct 2026 · opengrc.com

Plans and prices

Community Free Free Self-hosted · full source code access · community support Read 30 Sep 2026 · opengrc.com
Community Package Free Free Self-hosted · full source access · unlimited users and data · community support Read 15 Oct 2026 · opengrc.com
MSSP 21-30 Priced on request $875 license / quarter 21-30 client deployments · isolated instances per client Read 15 Oct 2026 · opengrc.com
MSSP 11-20 Priced on request $1,000 license / quarter 11-20 client deployments · isolated instances per client Read 15 Oct 2026 · opengrc.com
MSSP 1-10 Priced on request $1,125 license / quarter 1-10 client deployments · isolated instances per client Read 15 Oct 2026 · opengrc.com
Enterprise Basic $4,500 a year $4,500 /year Unlimited internal users · unlimited frameworks · unlimited vendors and applications · AI assessments · MCP integration · dashboards/reports · email support with 24-hour response · hosted Read 15 Oct 2026 · opengrc.com
Enterprise Enhanced $7,500 a year $7,500 /year Everything in Basic · onboarding training · SMB risk assessment · initial consulting · real-time chat · premium hosting and updates Read 15 Oct 2026 · opengrc.com

Every OpenGRC plan and price →

Strong points and limits

Strong points

  • Covers risk management, audits and incident response.
  • Vendor assessments include questionnaires and weighted scoring.
  • Supports five listed compliance frameworks.
  • Enterprise includes AI risk and gap assessments.
  • Hosted plans state a 99.5% monthly uptime commitment.

Limits

  • Community requires a web server and database server.
  • Community installation and maintenance require technical knowledge.
  • No third-party integrations are built in.
  • REST API is limited to 60 requests per minute.

Who it suits

OpenGRC suits small and midsized businesses or teams that need to manage cyber risk, audits, vendors and compliance frameworks. Community may suit technically capable users comfortable running and maintaining a web server and database server.

Verdict

OpenGRC combines compliance workflows with risk, audit and vendor management. The self-hosting requirements, API limit and Enterprise prices are key points to weigh before selecting a plan.

Where Specifiction places it

Alternatives to OpenGRCAll alternatives →