Linked document

heyGRC is never the primary place you keep a DPA or policy. You keep that document where you already govern it. A linked document is a snapshot heyGRC reads from that source, so a pull request that conflicts with it can quote your own words instead of asking whether a DPA exists.

A linked document is optional. An organization with none gets exactly today's review.

The card is on the Company page at app.heygrc.com, sibling of implementation commitments.

In the console

Open Company and use the Linked document card.

1. Paste an HTTPS URL, or upload a file (text, Markdown, HTML, or PDF, 8 MiB maximum). PDF over URL is rejected; upload the PDF instead.
2. Read the warning: this document is used across the organization's connected repositories, and short quotes may appear in pull request comments, including public repositories.
3. Click Use this document. Pasting a URL or choosing a file does nothing until this click.

That click authorizes heyGRC to read the source and, if the snapshot validates, put it in use. There is no clause list, no drop checkboxes, and no confirm step.

Then the card is one of:

• Reading. heyGRC is fetching and compiling. If you already had a snapshot in use, reviews keep using it while the update is read.
• In use. Source (URL or filename) and last-read date. Refresh is manual: heyGRC does not watch the URL in the background.
• Could not read. Public-safe reason and Retry. Reviews stay as they were (framework-only, or the previous in-use snapshot if this was a refresh).
• Could not produce a usable snapshot. The compiler could not extract a complete interpretation. An incomplete snapshot is never put in use.

Refresh failed: the previous snapshot stays live. The card says so, with the last-read date.

Remove stops new reviews from using the document. Comments already on GitHub, including quotes, stay exactly as they are.

v1.1 does not connect to Google Drive, SharePoint, or Vanta. There is no scheduled auto-refresh.

How a review uses it

Frameworks still run. The linked document only speaks when the diff touches something the document is about (a named processor, a retention rule, a region, a purpose).

• A CSS-only or test-only PR: the overlay is idle. That review is today's review.
• A PR that conflicts with the document: the finding quotes a short verbatim span of your source (at most 120 characters), not a paraphrase and not the contract body.
• A PR that only triggered "I don't see a DPA for this vendor," when the linked document covers that vendor: the nag can stop.
• A vendor the document never names is unknown, not banned. Ordinary framework findings may still fire.

Short quotes of your document on your pull request are the point, including on public repositories. Do not put secrets in a DPA you link.

As code (any agent or harness)

Upload is console-only. Agents attach a live HTTPS URL. Writes need a key with config:write. Reads need config:read.

GET /v1/review-packs returns pack metadata plus draft and confirmed snapshots. It never returns extracted source text.

Submit. use defaults to true: the same authorization as Use this document. When compile validates, the worker activates the snapshot. There is no confirm endpoint.

curl -X POST https://api.heygrc.com/v1/review-packs \
  -H "Authorization: Bearer $HEYGRC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "Vendor DPA 2026",
    "source": { "type": "url", "url": "https://example.com/dpa.md" },
    "use": true
  }'

source.type must be url. HTTP URLs, credentials in the URL, and private or local hosts are rejected. Set "use": false only if you want a draft that is not put in use (console never does this).

Poll GET /v1/review-packs until confirmed is present, or the draft compiler_status is failed or needs_review. needs_review never activates.

DELETE /v1/review-packs removes the linked document. Past reviews keep citation text they already posted; new reviews stop using it.

A natural agent prompt: "Our DPA is at this HTTPS URL. POST it to heyGRC /v1/review-packs with a short label and use true. Poll GET until confirmed is set, or until the draft failed. Do not call /confirm. Do not upload a file. Do not put the contract body on GitHub."

Limits

• One linked document per organization.
• Compile cap: 10 reads per organization per UTC day (429 compile_cap_exceeded).
• Label: 1 to 80 characters, no control characters.
• HTTPS URL only, 12 to 2048 characters, no credentials.
• Upload (console): text, Markdown, HTML, or PDF, up to 8 MiB.
• Quotes on GitHub: verbatim source spans, at most 120 characters, at most 3 quotes or 360 characters per review.