wtf is open-secgrc?

Open-SecGRC is an open-source platform for handling the ongoing checklist work companies go through to pass security and compliance audits, such as SOC 2, ISO 27001, HIPAA, and GDPR. Instead of tracking evidence and controls in spreadsheets, the platform automates the process by connecting to cloud accounts and SaaS tools such as AWS, Azure, GCP, GitHub, and Slack, and pulling evidence about how those systems are configured. The system is built around seven specialized agents, each handling one part of the compliance workflow. One agent collects evidence from connected providers on a schedule. Another continuously checks for configuration drift, things like multi-factor authentication being disabled or encryption settings changing, and raises alerts when it finds a problem. A policy mapping agent keeps track of how the same requirement shows up differently across frameworks, so a single piece of evidence can satisfy multiple standards at once. A remediation agent can automatically fix some common issues, like turning on logging or enforcing a password policy, and hands off anything it cannot fix on its own to a manual review queue. The remaining agents prepare audit packages, generate compliance reports and scorecards, and recommend which framework a company should pursue based on its size and industry. Technically, the project combines a Python FastAPI backend, a React and TypeScript frontend, PostgreSQL for storage, and Redis for caching and queuing. The agent logic runs on LangGraph, a framework for coordinating multiple AI agents working together. Everything is packaged to run with a single Docker Compose command, which starts the backend, frontend, database, and cache together. Getting started involves creating an admin account through the API and logging in to get an authentication token before using the rest of the system. The project supports role based access, so admins, auditors, and viewers see different levels of detail. It is released under the MIT license and currently has no reported stars, so it appears to be a new or early stage project rather than an established one.