Own the source
Your policies, controls, risks, evidence indexes, and audit work stay as JSON and Markdown in your Git repository.
Run your SOC 2program as filesin Git.
filegrc gives a founder-led engineering team one place to adopt policies, implement controls, run recurring work, collect evidence, and prepare an audit.
$
npx create-filegrc@latest company-grcView on GitHubNode.js 20+ · Git
Why filegrc
Let your agent handle SOC 2, for free.
Don't pay tens of thousands of dollars for a set of basic create, read, update, and delete screens wrapped around data you don't control. filegrc is open source. Your records stay in your repository, where your agent can do the routine work.
Put your agent to work
Your agent can create records, link evidence, work the queue, run readiness checks, and prepare the audit packet.
Review every change
Nothing disappears behind an application. Review the exact files, diff, author, date, and commit before accepting the work.
$0 software bill
filegrc is MIT licensed and runs locally. The source systems that operate controls and the independent CPA audit remain separate.
How it works
The repository is the program.
There is no separate application database. The source stays useful in a text editor, the local web app, the CLI, and CI because every interface reads and writes the same files through the same rules.
JSON holds records the engine validates, filters, and connects.
Markdown holds policies, procedures, plans, minutes, and narratives.
Git supplies authors, timestamps, revisions, diffs, and commit messages.
MARKDOWNAccess Control Policy
policy-access-control.mdJSONQuarterly access review
control-access-review.json{
"status": "implemented",
"ownerId": "person-security",
"evidenceSourceIds": [...]
}GITOne reviewable change
47ebdcc · main+ approvedOn: 2026-07-25
+ evidenceId: evidence-q3
- status: draft
One path
Prepare, operate, then audit.
Start with how the company actually works. Build reliable evidence before you create the normal audit engagement.
Define scope
Confirm program owners, criteria, commitments, vendors, and in-scope systems.
Approve policies
Tailor the proposals and record real owners, separate reviewers, approval dates, and effective dates.
Implement controls
Replace prompts with the procedure, scope, cadence, and evidence source.
Test evidence collection
Complete the generated External Evidence drafts and verify collection from each authoritative System.
Operate the program
Work the queue, trigger Policy Events, maintain risks, and preserve dated evidence.
Audit
Engage the CPA firm, record its agreed period, support fieldwork, and build the packet.
For engineers and agents
The browser is helpful. It is not required.
An agent with no filegrc context can discover the model, inspect valid relationships, follow the same six steps and page instructions, create records, complete scheduled work, trigger Policy Events, and check the result without opening the renderer.
The browser and CLI call the same domain functions, so headless work gets the same validation and readiness calculations.
$ npx filegrc program-path --jsonFollow the same six-step path, instructions, and current status shown in the browser.
$ npx filegrc guide risk-assessment --jsonRead the exact Instructions, Use, and Policy Basis shown in the browser, plus fields and relationships.
$ npx filegrc scaffold risk-assessmentCreate the same validated JSON and Markdown shape used by the browser.
$ npx filegrc obligations --jsonSee upcoming, due, and overdue policy work.
$ npx filegrc trigger person-started --occurred-on 2026-07-25 --subject person-idAdd every required hiring task to the Work Queue in one validated write.
$ npx filegrc program-readiness --jsonCheck whether management can begin a reliable evidence period.
$ npx filegrc evidence-packet --audit audit-idBuild the scoped delivery from a clean Git revision.
filegrc manages GRC records and audit evidence.
Your source systems still operate controls. The independent CPA firm still tests them, judges the evidence, and issues the report.