What it is

Probo is an open-source MIT-licensed governance, risk, and compliance platform written in Go. It targets engineering and security teams managing SOC2, GDPR, ISO27001, HIPAA, ISO27701, and ISO42001 work in one self-hostable system. The project lives in the open-source compliance and GRC ecosystem, and it exposes data through a web console, a prb CLI, a Model Context Protocol API, a GraphQL API, and an n8n community node.

Probo solves the need to manage the full GRC lifecycle in one self-hostable system. It covers risk identification, control tracking, vendor risk, data privacy, access reviews, audit programs, and document approval workflows. Every entity is accessible through those interfaces, so teams can automate compliance work from code, scripts, or LLM agents.

Key capabilities

• Risk management includes a risk register, inherent and residual scoring, treatment strategies such as mitigate, accept, avoid, and transfer, and threat-based risk assessments.
• Controls and frameworks support a control library with maturity levels, custom framework import and export, and Statement of Applicability records.
• Vendor risk features include vendor inventory, automated website risk assessment, DPA and BAA tracking, and subprocessor discovery.
• Data privacy features cover DPIA, Transfer Impact Assessments, processing activity records, data inventory, and rights requests.
• Access reviews support campaign management, per-entry decisions, and integration with SaaS, cloud infrastructure, and source code sources.
• Audit, evidence, and document work includes policy-based RBAC, immutable audit logs, audit scoping, control mapping, finding tracking, report generation, evidence collection from files and URLs, task assignment, versioned documents, approval quorums, electronic signatures, and PDF export.
• Public compliance and consent features include a public compliance portal, NDA management, certification publishing, custom domain support, cookie banner management, tracker detection, and consent records.

Who uses it and how

• Security and compliance engineers use the web console for day-to-day review of risks, controls, vendors, privacy records, access reviews, audit programs, and documents.
• Automation teams use the prb CLI in scripts or CI/CD pipelines, and n8n users place Probo actions inside workflows through the @probo/n8n-nodes-probo community node and GraphQL API.
• AI-assisted teams connect MCP-compatible clients such as Claude, Cursor, or Continue to Probo so agents can read and write GRC data, draft policies, run risk assessments, and generate evidence packs through 270+ MCP tools.

Getting started

The README presents Docker-based self-hosting as the deployment method, with the prb CLI and web console as local interfaces. In development, the web console runs at http://localhost:8080.

When to use it — and when not to

Probo fits teams that want an MIT-licensed, self-hostable GRC system with CLI, GraphQL, MCP, and n8n interfaces. It is less suitable when an organization needs a mature product with a long public history, because the repository is reported as zero years old, has zero contributors, and has 93 open issues. Self-hosting also means the operator must run the Docker-based service and any supporting infrastructure.

# Authenticate
prb auth login

# List open risks
prb risk list

# Create a measure and link evidence
prb measure create --name "MFA enforced on all production systems"
prb evidence create --measure <id> --file screenshot.png

# Manage vendor compliance
prb thirdpartymgmt vendor list
prb thirdpartymgmt risk-assessment create --vendor <id>

# 1. Clone with submodules
git clone --recurse-submodules https://github.com/getprobo/probo.git
cd probo

# 2. Install dependencies
go mod download
npm ci

# 3. Start infrastructure services (PostgreSQL, object storage, etc.)
make stack-up

# 4. Build
make build

# 5. Generate the local dev config
make dev-config

# 6. Run the server
bin/probod -cfg-file cfg/dev.yaml