Open Source Compliance
Compliance work lives or dies on evidence - not whether a control exists, but whether you can produce proof it operated, on demand, when an auditor asks. The open source tools here track controls, risks, and the evidence behind them inside systems you host and can export from cleanly, so your audit-ready record stays under your control and never gets stranded in a platform you have to keep paying to read.
Trivy
All-in-one security scanner for containers, code, and Kubernetes
ZITADEL
Open-source identity infrastructure for SSO, MFA, passkeys, OIDC, SAML, and SCIM
Prowler
Open-source cloud security platform for automated checks, compliance frameworks, and multi-cloud assessments
Checkov
Static analysis that catches misconfigurations in infrastructure as code
CloudQuery
Cloud asset inventory and data pipeline tool for syncing cloud config, security, and FinOps data
CISO Assistant
Open source GRC platform for risk, compliance, audit, privacy, and reporting
ComplianceAsCode
Security policy content in SCAP, Ansible, Bash, and CEL for compliance automation
konstruktoid Hardening
Ubuntu Server hardening scripts for systemd systems with UFW, auditd, and kernel module controls
Comp AI
Open-source compliance platform for SOC 2, ISO 27001, HIPAA, and GDPR with AI agents and 580+ integrations