Open source · MIT

Run your SOC 2program as filesin Git.

FileGRC gives a founder-led engineering team one place to adopt policies, implement controls, run recurring work, collect evidence, and prepare an audit.

$npx create-filegrc@latest company-grc
View on GitHubNode.js 20+ · Git
Why FileGRC

Let your agent handle SOC 2, for free.

Don't pay tens of thousands of dollars for a set of basic create, read, update, and delete screens wrapped around data you don't control. FileGRC is open source. Your records stay in your repository, where your agent can do the routine work.

01

Own the source

Your policies, controls, risks, evidence indexes, and audit work stay as JSON and Markdown in your Git repository.

02

Put your agent to work

Your agent can create records, link evidence, work the queue, run readiness checks, and prepare the audit packet.

03

Review every change

Nothing disappears behind an application. Review the exact files, diff, author, date, and commit before accepting the work.

04

$0 software bill

FileGRC is MIT licensed and runs locally. The source systems that operate controls and the independent CPA audit remain separate.

How it works

The repository is the program.

There is no separate application database. The source stays useful in a text editor, the local web app, the CLI, and CI because every interface reads and writes the same files through the same rules.

JSON holds records the engine validates, filters, and connects.

Markdown holds policies, procedures, plans, minutes, and narratives.

Git supplies authors, timestamps, revisions, diffs, and commit messages.

MARKDOWNAccess Control Policypolicy-access-control.md
JSONQuarterly access reviewcontrol-access-review.json
{
  "status": "implemented",
  "ownerId": "person-security",
  "evidenceSourceIds": [...]
}
GITOne reviewable change47ebdcc · main
+ approvedOn: 2026-07-25
+ evidenceId: evidence-q3
- status: draft
One path

Prepare, operate, then audit.

Start with how the company actually works. Build reliable evidence before you create the normal audit engagement.

1

Define scope

Name the service, criteria, dependencies, systems, and risks.

2

Approve policies

Review the starter proposals and record real owners, approvers, and dates.

3

Implement controls

Replace prompts with the procedure, scope, cadence, and evidence source.

4

Prepare evidence

Connect authoritative systems and prove that collection works.

5

Operate the program

Complete recurring work and event checklists with dated evidence.

6

Prepare the audit

Record the engagement and period, reconcile populations, and build the packet.

Program Overview Data valid
FileGRC program overview showing the six-step SOC 2 path
For engineers and agents

The browser is helpful. It is not required.

An agent with no FileGRC context can discover the model, inspect valid relationships, create records, complete scheduled work, and check the result without opening the renderer.

The browser and CLI call the same domain functions, so headless work gets the same validation and readiness calculations.

$ npx filegrc guide risk-assessment --json

Learn the fields, timing, policy context, and valid relationships.

$ npx filegrc scaffold risk-assessment

Create the same validated JSON and Markdown shape used by the browser.

$ npx filegrc obligations --json

See upcoming, due, and overdue policy work.

$ npx filegrc program-readiness --json

Check whether management can begin a reliable evidence period.

$ npx filegrc evidence-packet --audit audit-id

Build the scoped delivery from a clean Git revision.

FileGRC manages GRC records and audit evidence.

Your source systems still operate controls. The independent CPA firm still tests them, judges the evidence, and issues the report.