Open-Source Continuous Compliance (GRC)
trustlynce
Continuous Compliance Your Engineers Can Run
Auditors increasingly expect evidence that controls work all year, not screenshots taken the week before fieldwork. trustlynce covers the GRC lifecycle (risk registers, controls, vendor risk, privacy assessments such as DPIA and TIA, access reviews, and audit programs) and connects to AWS, GCP, Azure, GitHub, and Okta to collect evidence on a schedule. Its 270+ Model Context Protocol (MCP) tools let LLM agents and CI/CD jobs query posture, gather evidence, and draft policies for a person to approve.
Key metrics
Design targets and benchmarks, validated with each customer during a pilot.
Capabilities
Full GRC Lifecycle
Risk registers, control matrices, vendor assessments, privacy assessments, and access review campaigns in one system.
270+ Model Context Protocol (MCP) Tools
Any MCP-compatible agent can query policies, collect evidence, draft risk reports, and route approvals.
Web, CLI, GraphQL & n8n
Manage compliance from the web console, the `tly` CLI, the GraphQL API, or n8n workflow nodes.
Verifiable Audit Trail
Cryptographically verifiable evidence records, policy-based RBAC, and electronic signatures, exportable as auditor-ready packages.
Vendor & Third-Party Risk
Automated website security checks, DPA and BAA contract tracking, and subprocessor risk profiles.
Public Trust Portal
Share your compliance status and security documents with prospective customers, with NDA-gated access.
Architecture
- Self-hostable, MIT-licensed core
- GraphQL and REST APIs
- Model Context Protocol (MCP) server
- Cloud and SaaS posture connectors (AWS, GCP, Azure, GitHub, Okta)
Business Outcomes
- Keeps audit evidence current all year instead of once per audit
- Lets AI agents prepare evidence and drafts while people approve
- Self-host with Docker to keep compliance data in your environment
Who It's For
Head of Compliance / Audit Director
Replaces the annual evidence scramble with evidence collected all year.
Security & GRC Engineer
Automates evidence collection from the `tly` CLI and CI/CD pipelines.
CTO / Engineering Founder
Prepares for SOC 2 and ISO 27001 audits with continuously collected evidence instead of manual screenshots.
Integrations
- Model Context Protocol (MCP)
- AWS
- Google Cloud
- Microsoft Azure
- GitHub
- GitLab
- Okta
- Jira
- Slack
- n8n
Works With
Application Security & Non-Human Identity (NHI)
TrustIvan
Container and SBOM scanning, machine-identity inventory, and runtime authorization for AI agents
Enterprise AI & Agent Orchestration
MITHUNAI
Private AI assistants and multi-agent workflows that cite their sources
Observability & AI-Ops
aiAxonIQ
OpenTelemetry logs, metrics, and traces on ClickHouse, with anomaly forecasting and plain-English queries