Overview
heyGRC reviews every pull request against your compliance frameworks and posts control-grounded findings as a GitHub check.
heyGRC is compliance review for your pull requests. Like a code reviewer, but for the frameworks your company must meet (SOC 2, HIPAA, NIST, ISO 27001, GDPR, the EU AI Act, and many more). US and EU teams are first-class. It runs as a GitHub App, posts a neutral Checks status by default, and never blocks merges unless you choose to require the check.
You configure company context and frameworks as code through a small REST API (or the console). Your coding agent can do that for you, but a human can do every step too.
Start here
- Set up with your agent - install the App, create an API key, configure frameworks
- Configure US frameworks - select SOC 2, HIPAA, CCPA, and other catalog IDs on an existing org (GET, then PUT)
- What a review looks like - checks, sticky summary,
/heygrc - What does heyGRC look for? - the change families, not a checklist
- Pricing and plans - free tier, claim-on trial, Starter / Pro / Business ladder, opt-in on-demand
- Console and API keys - app.heygrc.com
- API reference -
/v1/configand the frameworks catalog - Security and data - how code is handled
- EU inference - optional Mistral EU path for compliance reviews
- For AI agents - machine-readable surfaces (llms, search, markdown)
How it works
- Install the heyGRC GitHub App on the repos you want reviewed.
- Configure your company context and the frameworks you care about (console or one API call).
- heyGRC reviews each pull request, grounded in that context, and posts inline comments plus a Checks status.
That grounding is the point: heyGRC measures your diff against your obligations, not generic advice. A change to auth, data handling, logging, or a new dependency is read against the controls of the frameworks you selected.