openlane: Open Source Miscellaneous

What is openlane?

Openlane is an open-source compliance automation platform that gives security, compliance, and governance teams a system of record for their compliance program — the people, systems, and vendors in scope; the policies and controls that govern them; and the evidence that proves it.

What it is

Openlane is a Go-based, Apache-2.0 licensed compliance automation platform. It lives in the compliance-as-code and GRC automation ecosystem, and this repository contains the core server and orchestration services behind the Openlane cloud service. The platform provides a system of record for a compliance program, covering the people, systems, and vendors in scope; the policies and controls that govern them; and the evidence that proves it, with automation to keep that record current.

The concrete problem Openlane solves is the difficulty of keeping a compliance program accurate and auditable as an organization changes. It brings compliance management, importable framework control sets, a registry for personnel, vendors, and assets, exposure scanning, automation workflows, and a Trust Center into one platform. It replaces a manually maintained compliance system of record assembled across separate documents, spreadsheets, and point tools, and it supports frameworks including SOC 2, GDPR, ISO 27001, and NIST 800-53.

Key capabilities

Compliance management for policies, controls, evidence, and programs, with editors, approvals, comments, and full history on every object.
Frameworks and standards with importable control sets for SOC 2, ISO 27001, NIST 800-53, and more, where one control can satisfy requirements across multiple frameworks.
Registry that automatically imports personnel and contractor lists from a directory, entities and vendors from a CRM, and assets from a CMDB or spreadsheets, and lets teams define platforms and vendor or third-party contacts.
Exposure with automated domain scanning and vulnerability integrations for GitHub, AWS Security Hub, and GCP Security Command Center, plus remediation tracking to document fixes and update risks.
Automation that integrates with tools such as Google Drive, GitHub, Entra ID, AWS, and GCP, with configurable workflows and approvals, email campaigns, questionnaires and assessments, and task assignment with reminders and escalation.
Trust Center as a customizable, branded portal on an organization's own domain that publishes certifications, security documents, and subprocessors.
Organization settings and security covering the tenant, team, data, granular RBAC, billing, and custom classification data, with multiple authentication methods, organization-wide SSO, 2FA enforcement, and auditor roles and views available with any module.

Who uses it and how

Security and compliance teams at organizations pursuing SOC 2, ISO 27001, NIST 800-53, and GDPR readiness use it as the system of record for their compliance program.
Auditors receive dedicated roles and views, so evidence and controls can be reviewed without exposing unrelated tenant data.
IT and security operations teams import personnel from a directory, vendors from a CRM, and assets from a CMDB or spreadsheets to keep the registry current.
Organizations publish a Trust Center on their own domain to give prospects and vendors one place to review certifications, security documents, and subprocessors.
Compliance program managers run vendor and employee questionnaires and assessments, send bulk outreach through email campaigns, and assign tasks with reminders and escalation.

Getting started

The README says the fastest way to use Openlane is signing up for the cloud service at https://console.theopenlane.io/signup, which is free for the first 30 days with no credit card required and allows teams to buy only the modules they need. This repository contains the core server and orchestration services behind that cloud service.

How it compares

The provided facts do not name comparable tools, so Openlane stands alone in this registry. It is described as one of the few truly open-source compliance automation platforms, and it is licensed under Apache-2.0.

When to use it — and when not to

Use Openlane when a team wants an open-source system of record for compliance and is prepared to either use the cloud service or operate the core server itself. The README does not document self-hosting prerequisites such as a database, storage, or SMTP, so a self-hoster must determine those operational dependencies from the repository and documentation. Teams that need a fully managed hosted product beyond the first 30 days without buying modules, or that require documented turnkey self-hosting from the README alone, should not pick it based on the provided facts; the repository had 20 open issues and its last push was 2026-09-16.

project readme (upstream, from github) — read inline

Openlane is one of the few, truly open-source compliance automation platforms - giving you a system of record for your compliance program including the people, systems, and vendors in scope; the policies and controls that govern them; and the evidence that proves it, and all with the automation to keep it current. This repository contains the core server and orchestration services behind the Openlane cloud service.

Features

The platform is organized into a handful of areas that build on each other:

Compliance management: policies, controls, evidence, and programs, with editors, approvals, comments, and full history on every object
Frameworks and standards: importable control sets for SOC 2, ISO 27001, NIST 800-53, and more; one control can satisfy requirements across multiple frameworks
Registry: automatically import your personnel and contractor lists from your directory, entities / vendors from your CRM, assets from your CMDB or spreadsheets, define platforms, vendor / 3d party contacts, and more
Exposure: automated domain scanning, vulnerability integrations with GitHub, AWS Security Hub, and GCP Security Command Center (and more to come!) with remediation tracking to document fixes and update your risks
Automation: integrate with the tools you already use like Google Drive, Github, Entra ID, AWS, GCP (and more!) with configurable workflows and approvals, email campaigns for bulk outreach, questionnaires and assessments for your vendors or employees, and task assignment with reminders and escalation
Trust Center: a customizable, branded portal on your own domain publishing certifications, security documents, and subprocessors - reduce friction pre-sales and give your prospects and vendors one-stop shopping (check out ours)
Organization settings: your tenant, your team, your data, with granular RBAC, billing, and the custom data that shapes how objects are classified
Integrations and security: multiple authentication methods, organization-wide SSO, 2FA enforcement, auditor roles and views, all available with any of our modules so you're never paywalled for basic security measures

On the roadmap:

Automated evidence collection and checks + tests libraries
Internal training programs / campaigns
Additional integrations with ticketing systems, documentation repositories, directories, security scanners
Vendor Risk Scoring + TPRM modules
Additional OSCAL support

Getting Started

The fastest way to use Openlane is signing up for the cloud service; free for the first 30 days, no credit card required. We built our product on the idea you should only pay for what you use, so no "tier" pricing - you can buy just the modules your team needs, and we have multiple partner, referral, and startup programs. Reach out if you aren't sure: [email protected]

Run It Yourself

With Go, brew, Task, and Docker installed:

task install:all
task run-dev

The Getting Started guide covers the full path: tooling and IDE setup, configuration, running the stack, creating a test user, CLI authentication, and querying the API. We're working to have published helm charts and other supported methods of deployment (and adoption + contribution from the community help drive that), but until then, you can find all required container images published to the GitHub container registry (see Operations) and published artifacts on the releases page of this repo.

Development

The Openlane founders have taken care to build our stack using other open-source tools and technologies so you don't need a dozen SaaS subscriptions to be able to run it; we used technologies like PostgreSQL, Redis, S3-compatible object storage (so you can leverage projects like Rook, Minio), ent, gqlgen, and OpenFGA, among many others.

The developer documentation covers the day-to-day workflows:

Schema and codegen: creating schemas, code generation, and database migrations
Architecture: request lifecycle, the workflows engine, and the multi-module repo structure
Security: authentication, API tokens, and the authorization model
Operations: configuration, secrets, and deployment; the full parameter list lives in the configuration reference

Security

Please do not file GitHub issues or post on our public forum for security vulnerabilities, as they are public!

Openlane takes security issues very seriously. If you have any concerns about Openlane or believe you have uncovered a vulnerability, please get in touch via the e-mail address [email protected]. In the message, try to provide a description of the issue and ideally a way of reproducing it. See security policy for more details.

Licensing

This repository contains open source software that comprises the Openlane stack which is open source software under Apache 2.0. Openlane's SaaS / Cloud Services are products produced from this open source software exclusively by theopenlane, Inc. This product is produced under our published commercial terms (which are subject to change). Any logos or trademarks in our repositories in theopenlane organization are not covered under the Apache License and are trademarks of theopenlane, Inc.

Others are allowed to make their own distribution of this software or include this software in other commercial offerings, but cannot use any of the Openlane logos, trademarks, cloud services, etc.

Contributing

See the contributing guide for how to get involved. If our code or projects have helped you, or you want to support the work, we appreciate sponsorship on our GitHub project at any level.

Frequently asked questions

Is openlane free to use?

openlane is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does openlane do?

Open source compliance automation for SOC 2, GDPR, ISO27001, NIST 800-53, and more

What is openlane written in?

openlane is primarily written in Go. Its source is publicly available at https://github.com/theopenlane/core, and it has 306 GitHub stars.