NousResearch
Featured
hermes-agent
Hermes Agent is an open-source, self-improving AI agent with a built-in learning loop that creates skills from experience, runs across platforms, and supports any LLM provider.
Conformiti
Conformiti is a self-hosted, open-source compliance management application that ships with full control libraries for SOC 2, ISO 27001, and PCI DSS v4.0.1, offering document lifecycle management, review reminders, role-based access, and an analytics dashboard.
Stars
114
7-day growth
No data
Forks
18
Open issues
0
License
MIT
Last updated
2026-07-23
Why it is worth attention
It provides a complete, Vanta-style compliance platform that users can deploy on their own infrastructure, with preloaded frameworks, an evidence folder tree, and detailed workflows for audit preparation—all without per‑seat SaaS costs.
Who it is for
- Compliance officers and managers
- Security and IT teams
- Internal auditors
- Organizations pursuing SOC 2, ISO 27001, or PCI DSS certification
Use cases
- Managing evidence and control mappings across multiple frameworks
- Scheduling and tracking document review cycles with email reminders
- Preparing for audits with role‑based access and access review grids
- Cross‑referencing controls between SOC 2, ISO 27001, and PCI DSS
Strengths
- Comes with complete control libraries for three major standards out of the box
- Supports multiple deployment options: Docker, manual, and Celery for async tasks
- Offers a comprehensive REST API for integration and automation
- Implements granular role‑based access with folder‑level permissions
Considerations
- Requires self‑hosting and technical expertise to set up (Django, React, Redis, database)
- Email reminders are limited to standard IMAP/POP3+SMTP or Amazon SES; no Slack/Teams yet
- Roadmap features like automated evidence collection and SSO are not yet implemented
README quick start
Conformiti
📸 Click to expand Screenshots Gallery (15 screens)
| View | View |
|---|---|
A Vanta-style compliance management application for SOC 2, ISO/IEC 27001:2022 and PCI DSS v4.0.1. It ships with the full control libraries for all three frameworks, an evidence folder tree segregated by control, role-based access to folders, document lifecycle management with review scheduling, automated review reminders over a standard IMAP/POP3 + SMTP mailbox or Amazon SES, an analytics dashboard, an account settings area, and a dashboard calendar.
For preloaded compliance data you must unzip compliance-data.zip in the root directory before building.
Want a look before installing? Open app-preview.html in a browser — a clickable static preview of all 12 screens with the live theme switcher (no install needed).
For the full manual — installation paths, configuration reference, and every workflow in depth — see USER_GUIDE.md.
New to the project? Start with GETTING_STARTED.md —
one walkthrough that installs, verifies, and tests every function (including
the document-review email reminders). INSTALL.md has the
one-command installer details.
Security posture, the audit findings, and the production checklist are in
SECURITY.md. Setup requirements live in
PREREQUISITES.md, and the automated readiness report is
VALIDATION.md — re-run it any time with
python3 tools/validate.py. A design spec for the planned SharePoint
integration (OAuth email login, session retention, email-scoped viewer
links) is in docs/SHAREPOINT_INTEGRATION.md.
What's inside
| Requirement | Where it lives |
|---|---|
| SOC 2 / ISO 27001 / PCI DSS v4.0.1 control libraries | backend/compliance/data/*.json (217 controls) generated by tools/build_seed_data.py |
| Neat folder tree segregated by control | backend/compliance/folder_tree.py + manage.py generate_folder_tree → compliance-data/ |
| SMTP alerts for documents coming up for review | backend/notifications/tasks.py (+ send_review_reminders command / Celery beat) |
| Mail owners from a standard mailbox (IMAP/POP3 + SMTP) |
Description
A GRC Compliance tool for SaaS products to manage the entire lifecycle of security audits.
Related repositories
Similar projects matched by category, topics, and programming language.
lopopolo
Featured
harness-engineering
Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.
littledivy
Featured
mimic
mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.