- Home
- Digital Governance Software
- OpenGRC
OpenGRC
What it is
OpenGRC is a web application for cyber governance, risk, and compliance designed for small and midsized businesses and teams. It brings together risk management, controls and implementations, audits, vendor management, incident response, and project management. Audit management covers evidence requests, progress tracking, and report generation. Vendor assessments can use a dedicated portal, customizable questionnaires, and weighted scoring. Listed frameworks include NIST 800-171, ISO 27001, SOC 2, CMMC, and PCI DSS. The platform does not currently include third-party integrations, but it provides a REST API limited to 60 requests per minute per user, or per IP for unauthenticated requests. Enterprise adds AI risk assessments, automated vendor survey responses, and AI gap assessments; its MCP server supports compatible clients including Claude, ChatGPT, and Cursor with OAuth 2.1 authentication. The free Community edition is self-hosted and requires a web server and database server, with some technical knowledge needed for installation and maintenance. Enterprise Basic costs $4,500 a year; Enhanced costs $7,500 a year. Hosted plans state a 99.5% monthly uptime commitment, encryption in transit and at rest, instance-specific data keys, and an annual independent SOC 2 Type II examination. OpenGRC says hosted customer data is not used to train AI models.
For and against
For
- Covers risk, controls, audits, vendors, and incidents.
- Vendor tools include questionnaires and weighted scoring.
- Lists NIST 800-171, ISO 27001, SOC 2, CMMC, and PCI DSS.
- Hosted plans state a 99.5% monthly uptime commitment.
Against
- Community requires self-hosting a web server and database server.
- Community setup and maintenance require technical knowledge.
- No third-party integrations are built into the platform.
- REST API is limited to 60 requests per minute.
The verdict
OpenGRC brings several GRC functions together, with a self-hosted free edition and paid hosted plans. Review the Community hosting requirements and API limit when deciding whether it fits your team.
Who it suits
OpenGRC suits small and midsized businesses or teams managing compliance, audits, risks, and vendors. The Community edition is for users able to handle a self-hosted web and database server.
Plans and prices
Community Package
Self-hosted · full source access · unlimited users and data · community support
Read 15 Oct 2026 · opengrc.com
MSSP 21-30
21-30 client deployments · isolated instances per client
Read 15 Oct 2026 · opengrc.com
MSSP 11-20
11-20 client deployments · isolated instances per client
Read 15 Oct 2026 · opengrc.com
MSSP 1-10
1-10 client deployments · isolated instances per client
Read 15 Oct 2026 · opengrc.com
Enterprise Basic
Unlimited internal users · unlimited frameworks · unlimited vendors and applications · AI assessments
Read 15 Oct 2026 · opengrc.com
Enterprise Enhanced
Everything in Basic · onboarding training · SMB risk assessment · initial consulting
Read 15 Oct 2026 · opengrc.com
Community
Self-hosted · full source code access · community support
Read 30 Sep 2026 · opengrc.com
On the record
- AI data policy
- The company says customer data and subprocessors’ processing are not used to train or improve AI models.opengrc.com · read 15 Oct 2026
- AI data use
- OpenGRC states that it does not use hosted-plan customer data to train AI models.opengrc.com · read 30 Sep 2026
- AI gap assessment
- Enterprise AI gap assessment evaluates control effectiveness and prioritizes improvements.opengrc.com · read 15 Oct 2026
- AI integrations
- The Enterprise MCP server supports compatible clients including Claude, ChatGPT, and Cursor, with OAuth 2.1 authentication.docs.opengrc.com · read 30 Sep 2026
- AI risk assessment
- Enterprise Assessor analyzes an organization’s environment, technology stack and implementations against industry risk profiles.opengrc.com · read 15 Oct 2026
- AI tools
- Enterprise includes AI risk assessments, automated vendor survey responses, and AI gap assessments.opengrc.com · read 30 Sep 2026
- API limits
- The REST API is limited to 60 requests per minute per user, or per IP address for unauthenticated requests.docs.opengrc.com · read 30 Sep 2026
- API permissions
- API operations enforce role permissions and return authorization errors when a token lacks the required permission.docs.opengrc.com · read 15 Oct 2026
- Audit management
- The platform creates audits around standards, implementations and programs, assigns evidence and produces reports.opengrc.com · read 15 Oct 2026
- Authentication integrations
- Documentation describes SSO through Microsoft Entra ID, Okta, Google Workspace and Auth0 with automatic user provisioning.docs.opengrc.com · read 15 Oct 2026
- Automated surveys
- Surveyor reads uploaded vendor questionnaires and drafts answers from controls, policies and implementations already in the portal.opengrc.com · read 15 Oct 2026
- Automation engine
- The platform can trigger scheduled or record-change automations performing record changes, tasks, notifications, webhooks, reports, AI steps or waits.opengrc.com · read 15 Oct 2026
- Availability commitment
- Hosted plans commit to 99.5% monthly uptime excluding scheduled maintenance.opengrc.com · read 15 Oct 2026
- Community hosting
- The Community edition is web-based and requires the user to run a web server and database server.docs.opengrc.com · read 30 Sep 2026
- Community limitation
- The maker says Community installation and maintenance require some technical knowledge.docs.opengrc.com · read 30 Sep 2026
- Company
- The maker identifies itself as OpenGRC, LLC and says OpenGRC started as a side project in December 2024.opengrc.com · read 30 Sep 2026
- Company founding
- OpenGRC says it began as a side project in December 2024.opengrc.com · read 15 Oct 2026
- Company profile
- LinkedIn lists OpenGRC in computer and network security, headquartered in Casselberry, Florida, with one employee.linkedin.com · read 15 Oct 2026
