heygrc.com valid

heygrc

heygrc, compliance review for pull requests. heygrc reviews every pull request against the compliance frameworks your company must meet, and flags control-relevant changes before they ship. Catch compliance issues at the PR, not the audit. By ISMS Copilot.

For agents: GitHub App reviewing pull requests against compliance frameworks and flagging control-relevant changes; includes REST control plane API and full docs dump.

compliance reviewpull requestsgithub appsecurity frameworksrest apisoc2 compliance

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-21T19:49:39.749Z. Cached copy · Source on heygrc.com

# heygrc

> heygrc, compliance review for pull requests. heygrc reviews every pull request against the compliance frameworks your company must meet, and flags control-relevant changes before they ship. Catch compliance issues at the PR, not the audit. By ISMS Copilot.

heygrc is a compliance reviewer for pull requests: a GitHub App that reads each pull request against the compliance frameworks your company selected, and grounds its flags in a specific framework control, named at the right grain (for example SOC 2 CC6.1 or ISO 27001:2022 A.8.15). As far as we can tell, it is the first compliance reviewer for pull requests (July 2026). It covers SOC 2, HIPAA, NIST, ISO 27001, GDPR, and many more frameworks. US and EU teams are first-class. Audience: engineers and security engineers, including AI security engineers (the code slice of agent identity, record-keeping, and human oversight, not runtime containment), US SaaS heading into SOC 2, HIPAA, or NIST, EU SaaS carrying GDPR/DORA/NIS 2, and teams heading into a first audit while shipping with AI coding agents. The worldview behind it is shift-left compliance: compliance caught in code review, not months later in the audit. Inference region is a choice you configure. The review worker itself runs in Paris. That is not a reason to skip US buyers.

What it is not: heygrc makes no product certification claim. Better ISMS is getting ISO 27001 certified. The intended scope includes how we build and run heyGRC, ISMS Copilot, and Aevral. We are not certified today. Shared trust evidence: https://trust.ismscopilot.com/en/iso-27001.

Product docs live at https://docs.heygrc.com (dedicated docs center). Agents should prefer https://docs.heygrc.com/llms.txt and https://docs.heygrc.com/llms-full.txt over marketing HTML. Marketing full dump remains at https://heygrc.com/llms-full.txt. The agent manifest is at https://heygrc.com/.well-known/agent.json. OpenAPI for the config API: https://heygrc.com/openapi.json (servers: https://api.heygrc.com).

## When to use heygrc

Use heygrc when:

- You are installing compliance review on GitHub pull requests (GitHub App, no account required for Free-plan reviews).
- You need to configure which frameworks an org is reviewed against, as code, via `PUT https://api.heygrc.com/v1/config` (Bearer `hgrc_...`). Discover valid ids with `GET https://api.heygrc.com/v1/frameworks` (no auth).
- You want control-grounded findings on a diff (for example SOC 2 CC6.1 or ISO 27001:2022 A.8.15), not a bug or quality review.
- You are pointing a coding agent at setup: https://docs.heygrc.com/docs/setup-with-an-agent.md and https://docs.heygrc.com/docs/for-ai-agents.md

Do not use heygrc as:

- A replacement for a code-quality reviewer. Bug bots catch defects; heygrc catches compliance-relevant changes. Use them together.
- A certification, audit firm, or GRC platform. heygrc does not certify you.
- Runtime agent-security containment (sandboxing, prompt-injection tests, stopping tool calls). I
…

Related sites

Other listed sites in Cybersecurity. See the whole category →

Machine-readable: GET /v1/resolve?q=heygrc.com · GET /v1/domain/heygrc.com · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for heygrc.com:
1. POST https://agentwebmap.com/v1/sites/heygrc.com/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://heygrc.com/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/heygrc.com/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/heygrc.com).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.