# heyGRC Docs

> Customer documentation for heyGRC: compliance review for pull requests. English index for agents. US and EU teams are first-class (SOC 2, HIPAA, NIST, ISO 27001, GDPR, DORA, NIS 2). Hosting region is a choice, not a reason to skip US buyers.

> Site: https://docs.heygrc.com

## How agents should read this site

1. Prefer **plain markdown** (append `.md` to any docs URL, e.g. `/docs/setup-with-an-agent.md`) or **llms-full.txt** for bulk ingest.
2. HTML pages work for curl too, but include chrome/nav; markdown is cleaner.
3. English is authoritative product truth. Locale HTML may exist; this index is EN-only.
4. Human hub: https://docs.heygrc.com/docs/for-ai-agents - agent search: https://docs.heygrc.com/api/agent-search?q=
5. Configure heyGRC as code: `PUT https://api.heygrc.com/v1/config` with Bearer `hgrc_…` key.

## Product endpoints agents use

- [API base](https://api.heygrc.com): REST control plane (`/v1/config`, `/v1/frameworks`)
- [GitHub App install](https://github.com/apps/heygrc/installations/new): owner-only install step
- [Console](https://app.heygrc.com): sign in with GitHub, Google, Microsoft, or email. Then API keys, review modes, org settings
- [Docs full dump](https://docs.heygrc.com/llms-full.txt): all English docs as plain markdown
- [Agent search](https://docs.heygrc.com/api/agent-search?q=frameworks): keyword search over EN titles/descriptions/bodies

## Docs pages (HTML + .md)

- [API reference](https://docs.heygrc.com/docs/api-reference) · [md](https://docs.heygrc.com/docs/api-reference.md): heyGRC public API: endpoints for frameworks and review configuration, with request and response shapes.
- [Console and API keys](https://docs.heygrc.com/docs/console-and-api-keys) · [md](https://docs.heygrc.com/docs/console-and-api-keys.md): Use app.heygrc.com to manage API keys, review modes, and org settings for heyGRC.
- [Console language](https://docs.heygrc.com/docs/console-language) · [md](https://docs.heygrc.com/docs/console-language.md): Choose the language of the heyGRC console. This is your personal interface language, separate from Review language.
- [EU inference](https://docs.heygrc.com/docs/eu-inference) · [md](https://docs.heygrc.com/docs/eu-inference.md): Optional org setting that sends heyGRC compliance reviews to Mistral on the EU regional endpoint, with no silent fallback to the default global path.
- [Does heyGRC block merges?](https://docs.heygrc.com/docs/faq-does-heygrc-block-merges) · [md](https://docs.heygrc.com/docs/faq-does-heygrc-block-merges.md): heyGRC does not block merges by default. How GitHub conversation-resolution rules can still require resolving inline findings.
- [What does heyGRC look for?](https://docs.heygrc.com/docs/faq-what-heygrc-looks-for) · [md](https://docs.heygrc.com/docs/faq-what-heygrc-looks-for.md): Not a fixed checklist. heyGRC reads the pull request for compliance-relevant changes against the frameworks you configured, and cites the clause.
- [For AI agents](https://docs.heygrc.com/docs/for-ai-agents) · [md](https://docs.heygrc.com/docs/for-ai-agents.md): How coding agents should read heyGRC docs and configure the product as code without browser scraping.
- [GitHub App permissions](https://docs.heygrc.com/docs/github-app-permissions) · [md](https://docs.heygrc.com/docs/github-app-permissions.md): What the heyGRC GitHub App can read and write, and what it never does to your source.
- [Overview](https://docs.heygrc.com/docs) · [md](https://docs.heygrc.com/docs.md): heyGRC reviews every pull request against your compliance frameworks and posts control-grounded findings as a GitHub check.
- [Cursor Origin](https://docs.heygrc.com/docs/origin) · [md](https://docs.heygrc.com/docs/origin.md): Install heyGRC on Cursor Origin. Native Origin-hosted repositories only. GitHub-synced copies stay on the GitHub App.
- [Pricing and plans](https://docs.heygrc.com/docs/pricing-and-plans) · [md](https://docs.heygrc.com/docs/pricing-and-plans.md): heyGRC Free, Starter, Pro, and Business plans. Included private reviews hard-stop unless you enable on-demand at $0.49 each. Public repos always free.
- [Review language](https://docs.heygrc.com/docs/review-language) · [md](https://docs.heygrc.com/docs/review-language.md): Choose the language of heyGRC compliance review comments on GitHub. Control IDs and the check name stay English.
- [Security and data](https://docs.heygrc.com/docs/security-and-data) · [md](https://docs.heygrc.com/docs/security-and-data.md): How heyGRC handles code in review: secret stripping, transient diffs, worker location, default inference path, optional EU inference, and where binding legal docs live.
- [Set up with your agent](https://docs.heygrc.com/docs/setup-with-an-agent) · [md](https://docs.heygrc.com/docs/setup-with-an-agent.md): Point your AI coding agent at the heyGRC docs to install the GitHub App, connect your org, and configure frameworks.
- [Configure US frameworks](https://docs.heygrc.com/docs/us-frameworks) · [md](https://docs.heygrc.com/docs/us-frameworks.md): Select SOC 2, HIPAA, CCPA, and other US catalog IDs on an existing heyGRC org. GET the current config, merge IDs, PUT the full state, then read back.
- [What a review looks like](https://docs.heygrc.com/docs/what-a-review-looks-like) · [md](https://docs.heygrc.com/docs/what-a-review-looks-like.md): How heyGRC posts findings on a pull request: neutral Checks status, inline comments, one sticky summary, and /heygrc on demand.
- [Use with your code reviewer](https://docs.heygrc.com/docs/works-alongside) · [md](https://docs.heygrc.com/docs/works-alongside.md): How heyGRC runs next to Cursor Bugbot, CodeRabbit, Copilot code review, or any other reviewer.