Repolode
Submit
theopenlane

theopenlane/core

Open-source compliance automation server for tracking policies, controls, evidence, and vendors across SOC 2, ISO 27001, NIST 800-53 and more.

Open-source alternative to:VantaDrata

View on GitHubWebsite
Stars
334
Forks
55
Open issues
27
Last commit
2 hours ago

What is it?

Openlane is a compliance automation platform that serves as a system of record for a compliance program. It tracks the people, systems, and vendors in scope, the policies and controls that govern them, and the evidence that proves controls are working. This repository holds the core server and orchestration services behind the Openlane cloud product.

The platform covers compliance management with editors, approvals and full object history; importable control sets for frameworks such as SOC 2, ISO 27001 and NIST 800-53, where one control can satisfy several frameworks; and a registry of personnel, vendors, and assets. It also includes domain scanning and vulnerability integrations with GitHub, AWS Security Hub and GCP Security Command Center, plus a branded Trust Center for publishing certifications and subprocessors.

The stack is built on PostgreSQL, Redis, S3-compatible object storage, ent, gqlgen and OpenFGA. Local development uses Go, Task and Docker, and the API is exposed through GraphQL.

Key features

  • 01Manage policies, controls, and evidence with approvals and full change history.
  • 02Import control sets for SOC 2, ISO 27001, NIST 800-53 and other frameworks.
  • 03Map one control to requirements across multiple frameworks.
  • 04Pull vulnerability findings from GitHub, AWS Security Hub and GCP Security Command Center.
  • 05Publish certifications and subprocessors through a branded Trust Center.
  • 06Provides GraphQL API and configurable workflows with approvals and task reminders.

Use cases

  • Preparing for a SOC 2 or ISO 27001 audit and tracking evidence for each control.
  • Maintaining a vendor and personnel register for third-party risk reviews.
  • Publishing a public security and compliance page for prospective customers.
  • Running domain scanning and tracking remediation of cloud and code vulnerabilities.

Quick start

  1. 1

    Install Go, brew, Task, and Docker

  2. 2

    Install all dependencies

    task install:all
  3. 3

    Start the development stack

    task run-dev

Things to know

  • Self-hosting has no published Helm charts yet, so deployment takes manual setup.
  • The hosted cloud service is free only for the first 30 days, after which you pay for the modules you use.

In collections

Self-hosted appsGraphQL APIs & API clients

Topics

#compliance#grc#security-audit#graphql#golang#soc2#iso27001#self-hosted#compliance-as-code#compliance-automation

FAQ

What is core?
Open-source compliance automation server for tracking policies, controls, evidence, and vendors across SOC 2, ISO 27001, NIST 800-53 and more. Openlane is a compliance automation platform that serves as a system of record for a compliance program. It tracks the people, systems, and vendors in scope, the policies and controls that govern them, and the evidence that proves controls are working. This repository holds the core server and orchestration services behind the Openlane cloud product.
Is core free to use? What license does it have?
core is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is core still maintained?
Actively maintained. The last commit to core was on Oct 24, 2026.
What can I use core for?
Preparing for a SOC 2 or ISO 27001 audit and tracking evidence for each control. Maintaining a vendor and personnel register for third-party risk reviews. Publishing a public security and compliance page for prospective customers. Running domain scanning and tracking remediation of cloud and code vulnerabilities.
How do I install core?
Install Go, brew, Task, and Docker Install all dependencies: task install:all Start the development stack: task run-dev
Where can I get core?
The source code and installation instructions are on GitHub: https://github.com/theopenlane/core

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects