Open source · MIT

Run your SOC 2program as filesin Git.

filegrc gives a founder-led engineering team one place to adopt policies, implement controls, run recurring work, collect evidence, and prepare an audit.

$npx create-filegrc@latest company-grc
View on GitHubNode.js 20+ · Git
Why filegrc

Let your agent handle SOC 2, for free.

Don't pay tens of thousands of dollars for a set of basic create, read, update, and delete screens wrapped around data you don't control. filegrc is open source. Your records stay in your repository, where your agent can do the routine work.

01

Own the source

Your policies, controls, risks, evidence indexes, and audit work stay as JSON and Markdown in your Git repository.

02

Put your agent to work

Your agent can create records, link evidence, work the queue, run readiness checks, and prepare the audit packet.

03

Keep a focused history

Each browser save validates, creates one focused commit on the authoritative branch, and pushes it. The exact files, author, date, and diff stay reviewable.

04

$0 software bill

filegrc is MIT licensed and runs locally. The source systems that operate controls and the independent CPA audit remain separate.

How it works

The repository is the program.

There is no separate application database. The source stays useful in a text editor, the local web app, the CLI, and CI because every interface reads and writes the same files through the same rules.

JSON holds records the engine validates, filters, and connects.

Markdown holds policies, procedures, plans, minutes, and narratives.

Git supplies authors, timestamps, revisions, diffs, and commit messages.

Use a dedicated private repository for your FileGRC workspace. The browser commits and pushes each saved program change, so a standalone repository keeps the compliance audit trail separate from application development history. Record status represents approval; Git branches do not.

MARKDOWNAccess Control Policypolicy-access-control.md
JSONQuarterly access reviewcontrol-access-review.json
{
  "status": "implemented",
  "ownerId": "person-security",
  "evidenceSourceIds": [...]
}
GITOne reviewable change47ebdcc · main
+ approvedOn: 2026-07-25
+ evidenceId: evidence-q3
- status: draft
One path

Prepare, operate, then audit.

Start with how the company actually works. Build reliable evidence before you create the normal audit engagement.

1

Define scope

Confirm program owners, criteria, commitments, vendors, and in-scope systems, including evidence roles and access owners.

2

Approve policies

Tailor the proposals and record real owners, separate reviewers, approval dates, and effective dates.

3

Implement controls

Replace prompts with the procedure, scope, cadence, and complete authoritative evidence sources.

4

Operate the program

Work the queue, trigger Policy Events, maintain risks, and preserve dated evidence.

5

Audit

Engage the CPA firm, record its agreed period, support fieldwork, and build the packet.

Program Overview Data valid
filegrc program overview showing the five-step SOC 2 path
For engineers and agents

The browser is helpful. It is not required.

An agent with no filegrc context can discover the model, inspect valid relationships, follow the same five steps and page instructions, create records, complete scheduled work, trigger Policy Events, and check the result without opening the renderer.

The browser and CLI call the same domain functions, so headless work gets the same validation and readiness calculations.

$ npx filegrc program-path --json

Follow the same five-step path, instructions, and current status shown in the browser.

$ npx filegrc guide risk-assessment --json

Read the exact Instructions, Use, and Policy Basis shown in the browser, plus fields and relationships.

$ npx filegrc scaffold risk-assessment

Create the same validated JSON and Markdown shape used by the browser.

$ npx filegrc obligations --json

See upcoming, due, and overdue policy work.

$ npx filegrc trigger person-started --occurred-on 2026-07-25 --subject person-id

Add every required hiring task to the Work Queue in one validated write.

$ npx filegrc program-readiness --json

Check whether management can begin a reliable evidence period.

$ npx filegrc evidence-packet --audit audit-id

Build the scoped delivery from a clean Git revision.

filegrc manages GRC records and audit evidence.

Your source systems still operate controls. The independent CPA firm still tests them, judges the evidence, and issues the report.