Blaizzy
精选
nativ
Nativ is a native macOS app that lets you run AI models locally on Apple silicon, offering chat, model management, performance analytics, and an OpenAI/Anthropic-compatible API server.
为什么值得关注
它提供了一个完整的、类似 Vanta 的合规平台，用户可部署在自己的基础设施上，预加载框架、证据文件夹树和详细的审计准备工作流，无需按席位支付 SaaS 费用。
适合谁使用
- 合规官与合规经理
- 安全与 IT 团队
- 内部审计人员
- 正在寻求 SOC 2、ISO 27001 或 PCI DSS 认证的组织
典型使用场景
- 跨多个框架管理证据和控制映射
- 安排和跟踪文档审阅周期，并通过电子邮件发送提醒
- 使用基于角色的访问和访问审查网格准备审计
- 在 SOC 2、ISO 27001 和 PCI DSS 之间交叉引用控制项
项目优势
- 开箱即用，包含三个主要标准的完整控制库
- 支持多种部署方式：Docker、手动部署以及用于异步任务的 Celery
- 提供全面的 REST API，便于集成和自动化
- 实现细粒度的基于角色的访问控制，支持文件夹级权限
使用前须知
- 需要自托管和一定的技术能力进行设置（Django、React、Redis、数据库）
- 电子邮件提醒仅支持标准 IMAP/POP3+SMTP 或 Amazon SES，尚不支持 Slack/Teams
- 路线图中的自动证据收集和 SSO 等功能尚未实现
README 快速开始
Conformiti
📸 Click to expand Screenshots Gallery (15 screens)
| View | View |
|---|---|
A Vanta-style compliance management application for SOC 2, ISO/IEC 27001:2022 and PCI DSS v4.0.1. It ships with the full control libraries for all three frameworks, an evidence folder tree segregated by control, role-based access to folders, document lifecycle management with review scheduling, automated review reminders over a standard IMAP/POP3 + SMTP mailbox or Amazon SES, an analytics dashboard, an account settings area, and a dashboard calendar.
For preloaded compliance data you must unzip compliance-data.zip in the root directory before building.
Want a look before installing? Open app-preview.html in a browser — a clickable static preview of all 12 screens with the live theme switcher (no install needed).
For the full manual — installation paths, configuration reference, and every workflow in depth — see USER_GUIDE.md.
New to the project? Start with GETTING_STARTED.md —
one walkthrough that installs, verifies, and tests every function (including
the document-review email reminders). INSTALL.md has the
one-command installer details.
Security posture, the audit findings, and the production checklist are in
SECURITY.md. Setup requirements live in
PREREQUISITES.md, and the automated readiness report is
VALIDATION.md — re-run it any time with
python3 tools/validate.py. A design spec for the planned SharePoint
integration (OAuth email login, session retention, email-scoped viewer
links) is in docs/SHAREPOINT_INTEGRATION.md.
What's inside
| Requirement | Where it lives |
|---|---|
| SOC 2 / ISO 27001 / PCI DSS v4.0.1 control libraries | backend/compliance/data/*.json (217 controls) generated by tools/build_seed_data.py |
| Neat folder tree segregated by control | backend/compliance/folder_tree.py + manage.py generate_folder_tree → compliance-data/ |
| SMTP alerts for documents coming up for review | backend/notifications/tasks.py (+ send_review_reminders command / Celery beat) |
| Mail owners from a standard mailbox (IMAP/POP3 + SMTP) |
项目描述
A GRC Compliance tool for SaaS products to manage the entire lifecycle of security audits.
相关仓库与替代方案
根据分类、Topic 和编程语言匹配的相似项目。
lopopolo
精选
harness-engineering
Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.
littledivy
精选
mimic
mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.