Comp AI

Open source alternative to Vanta, Drata, Secureframe, Sprinto, Thoropass, Hyperproof, Anecdotes and Strike Graph

2.1K stars
AGPL-3.0
Active this week
Last commit 3 days ago

Last verified Oct 27, 2026

Automate SOC 2, ISO 27001, HIPAA, and GDPR compliance with AI-powered evidence collection, continuous monitoring, and 580+ integrations.

Visit website GitHub2.1K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Comp AI is for#

Startups closing their first enterprise deal

SOC 2 Type II is often the gating requirement for an enterprise customer's security review. Comp AI automates the evidence collection and policy management needed to run through an audit cycle, which the product website reports takes days rather than months. The self-hosted path keeps compliance data within your own infrastructure, satisfying data residency requirements some enterprise customers impose.

Skip if:

Your enterprise prospects accept lighter trust assessments or you are not subject to formal compliance requirements. Comp AI's infrastructure setup overhead is unnecessary if a security questionnaire and a pentest report are sufficient to close deals.

Security engineers managing ongoing compliance posture

Continuous evidence collection across 580+ integrations lets a security engineer watch compliance drift in real time rather than auditing manually before each certification cycle. The open source device agent, which checks encryption, firewall, and other endpoint settings on every employee machine, removes a class of manual checks from the recurring workflow.

Skip if:

Your team has already invested heavily in a different GRC platform with existing integrations and a built-out evidence history. Migrating compliance data and rebuilding integration configurations from another tool carries real operational cost.

Engineering teams that want an auditable compliance stack

Because the full source is available under AGPL-3.0, engineering teams can inspect every agent and integration, add custom evidence checks for internal infrastructure, and run automated tests against the compliance pipeline. The codebase uses Next.js, Prisma, and Trigger.dev, which are familiar to most TypeScript teams.

Skip if:

Your organization requires a vendor-supported tool with a formal SLA and dedicated support engineers. The Community Edition is supported through Discord and GitHub Issues, not a ticketing system with guaranteed response times.

the problem

The problem it solves#

Getting SOC 2 or ISO 27001 certified is the requirement enterprises impose before a deal closes, and most startups hit it for the first time when a sale is already in the pipeline. The manual path takes weeks. Security teams collect screenshots from vendor dashboards, write policies from templates, track control evidence in spreadsheets, and rebuild the whole evidence package each audit cycle.

Commercial compliance platforms automate this, but their annual contracts typically run five figures, a significant line item for a seed or Series A company. The deeper issue with paid platforms is data portability. Your compliance evidence, your policies, and your vendor risk data all live in their system. Switching auditors, satisfying an enterprise customer's data residency requirement, or independently auditing the evidence collection methods means working against closed-format exports and limited API access.

how Comp AI solves it

How it solves it#

Automated evidence collection from 580+ integrations

Agents connect directly to your infrastructure and vendor tools to pull evidence on a continuous schedule. Configs, screenshots, and system checks are collected and validated automatically, so your audit trail reflects your current state rather than last quarter's manual screenshots. Coverage includes cloud providers, identity platforms, code repositories, and SaaS tools.

AI policy generation from your actual stack

Comp AI learns your stack, your team's processes, and your risk tolerance during onboarding. Each policy document it generates is tailored to those inputs, not a generic template. Controls map to your specific infrastructure so policies match what you actually run when an auditor reviews them.

Open source device agent

A background agent runs on every employee machine and checks disk encryption, firewall status, screen lock, password length, and antivirus settings around the clock. Failures are flagged immediately rather than discovered during the next audit cycle. The device agent is open source and published in the same GitHub repository as the rest of the codebase.

Live trust center

The trust portal reflects your real compliance status in real time. Only published policies appear and only verified controls are shown. When a policy is marked draft or a control check fails, it is removed from the portal automatically. Prospects and customers see your actual posture, not a static marketing page.

Automated penetration testing

AI agents probe your code, APIs, and infrastructure for vulnerabilities and generate audit-ready reports. This covers the penetration testing requirement built into SOC 2 and ISO 27001 without engaging a third-party firm for every audit cycle.

Multi-framework coverage

Covers SOC 2, ISO 27001, HIPAA, GDPR, and FedRAMP from a single codebase. You choose which frameworks apply during onboarding and Comp AI maps controls and evidence to each one. A single piece of evidence can satisfy requirements across multiple frameworks, reducing redundant collection work.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Full source transparency under AGPL-3.0The Community Edition is licensed under AGPL-3.0 and the entire codebase, including every agent, integration, and check, is published on GitHub. Unlike closed-source platforms where you trust the vendor's evidence methodology, you can inspect exactly what each agent collects and how controls are evaluated. This matters when enterprise customers or auditors ask how your compliance data is gathered.
No per-seat fees on self-hosted deploymentsThe self-hosted Community Edition carries no usage-based licensing fees. You run it on your own infrastructure and the cost is your server bill, not a per-seat SaaS contract. Vanta and Drata both price by employee headcount, which makes annual costs scale unpredictably as your team grows.
Actively maintained with growing community adoptionThe repository reached 2,063 GitHub stars within roughly 21 months of its January 2025 launch, with 439 forks and a last push in October 2026. The Community Edition ships from the same team that operates the commercial cloud product, so security fixes travel between both. The repo earned Product Hunt's number one Product of the Day badge on launch.
Continuous evidence versus point-in-time snapshotsEvidence pulls run on a continuous schedule across all integrated sources, so your compliance posture reflects reality at any given moment. Manual screenshot-based or annual approaches leave gaps where a configuration regresses between collections. Auditors see a timestamped, continuously updated evidence trail rather than a batch gathered in the weeks before the audit.

Trade-offs

-Multi-service infrastructure required for self-hostingRunning the Community Edition requires Node.js 20+, Bun, Postgres 15+, Trigger.dev for background jobs, Upstash Redis, and Google OAuth for authentication. This is not a single-container install. The README notes that some environment variables may require hard-coding in specific files during setup. Teams without dedicated infrastructure capacity should factor in real maintenance overhead.
-Community Edition and Cloud run on separate codebasesThe README is explicit that Comp AI Community Edition and Comp AI Cloud are built independently. Features added to the paid cloud product do not automatically ship to the open source edition, and cloud security advisories may not apply to the community version. Self-hosters depend on the open source release cadence for new features and fixes.

versus alternatives

Comp AI vs alternatives#

Comp AI vs Vanta

Vanta and Comp AI both automate compliance evidence and audit preparation for SOC 2, ISO 27001, and HIPAA. The core difference is deployment model and data ownership.

Feature	Comp AI Community	Vanta
License	AGPL-3.0	Proprietary
Self-hosting	Yes	No
Source code	Open source	Closed
Pricing	Free (self-hosted)	Per-seat SaaS
Frameworks	SOC 2, ISO 27001, HIPAA, GDPR, FedRAMP	SOC 2, ISO 27001, HIPAA, GDPR

Comp AI is the better choice when your organization needs full control over where compliance data lives. Regulated industries, companies with enterprise customers requiring data residency guarantees, and teams that want to inspect every evidence collection method benefit from the self-hosted, open source path. The AGPL-3.0 license lets your engineering team extend the codebase, add custom checks, and connect internal tooling that SaaS integrations cannot reach.

Vanta is the stronger option when you need a fully managed experience with no infrastructure to maintain and a dedicated support team. For a small team with no DevOps capacity, Vanta eliminates significant setup and ongoing maintenance overhead while providing an established auditor network.

Comp AI vs Drata

Drata offers a polished managed-first compliance experience covering the same core frameworks. Like Vanta, Drata has no self-hosting option and charges per-seat SaaS pricing.

Feature	Comp AI Community	Drata
License	AGPL-3.0	Proprietary
Self-hosting	Yes	No
Pricing	Free (self-hosted)	Per-seat SaaS
AI policy generation	Yes	Yes
Frameworks	SOC 2, ISO 27001, HIPAA, GDPR, FedRAMP	SOC 2, ISO 27001, HIPAA, GDPR

Comp AI suits teams that treat their compliance stack as infrastructure they own. The open source codebase and self-hosted deployment mean evidence stays on your servers and collection methods are auditable. Drata's advantage is its established market position, a larger support organization, and a workflow that requires no infrastructure management. Teams already invested in the Drata ecosystem will find the managed experience worth its cost when engineering time is the constraint.

install · quick start

Quick start#

bash

Self-hosting requires Node.js 20+, Bun 1.1.36+, and a Postgres 15 database; clone the repository and install dependencies with Bun to begin.
```bash
git clone https://github.com/trycompai/comp.git
cd comp
bun install
```

tech stack · detected from GitHub

What it's built on#

Languages: TypeScript
Frameworks: ExpressNestJSNext.jsReactTailwind CSS
Infrastructure: AWS
Tooling: esbuildTurborepo

frequently asked

FAQ#

Is Comp AI free to use?

The Comp AI Community Edition is free and licensed under AGPL-3.0. You can self-host it on your own infrastructure at no licensing cost. Comp AI Cloud is a separate commercial product with paid plans, managed infrastructure, and dedicated support. The two share foundational ideas but run from separate codebases, so their feature sets differ.

What compliance frameworks does Comp AI support?

The Community Edition supports SOC 2, ISO 27001, HIPAA, GDPR, and FedRAMP. Comp AI maps controls and evidence across frameworks, so evidence collected for one certification can satisfy requirements in another. You choose which frameworks apply during onboarding.

How does Comp AI compare to Vanta?

Both automate evidence collection, policy management, and audit preparation for SOC 2 and ISO 27001. Vanta is a managed SaaS product with per-seat pricing and no self-hosting option. Comp AI Community Edition is open source under AGPL-3.0, self-hostable, and free to run on your own infrastructure. Vanta's advantage is a fully managed experience with a dedicated support team. Comp AI's advantage is data ownership, source transparency, and no per-seat licensing fees.

Can I use my own auditor with Comp AI?

Yes. Comp AI generates the evidence, policies, and reports your auditor needs, but it does not require you to use a specific audit firm. You can work with any accredited auditor for SOC 2 or ISO 27001 certification.

What does the AGPL-3.0 license allow for a company running it internally?

AGPL-3.0 lets you run Comp AI on your own infrastructure for any purpose, including internal team use and commercial operations. The key restriction: if you modify the codebase and offer the modified version to others as a network service (running it as a hosted compliance tool for paying customers), you must make your source changes publicly available. Running it internally for your own company's compliance does not trigger that requirement.

also worth a look

Similar open-source tools#

Helium

Alternative toGoogle Chrome

Privacy-first Chromium browser, all Google dependencies removed

22,029 GitHub stars
Licence GPL-3.0

Cleaner

Alternative toCleanMyMac

Mac disk cleaner that shows every item before it removes anything.

3 GitHub stars
Licence MIT

Oxynote

Alternative toNotion

Technical wiki with live metrics, draft reviews, and real-time editing

392 GitHub stars
Licence Apache-2.0

Markdown Preview Editor

Alternative toTypora

Browser-only Markdown editor with live preview and strict privacy.

32 GitHub stars
Licence MIT

securo

Alternative toMonarch Money

Self-hosted money manager with bank sync and AI agents.

4,119 GitHub stars
Licence AGPL-3.0

Anytype

Alternative toNotion

Local-first knowledge OS with E2E encryption and P2P sync

9,004 GitHub stars

by category

Open source tools in these categories#

137

Security & Monitoring

REA (Reverse Engineer Anything), RustDesk, Uptime Kuma 203

Business & Productivity

OpenClaw, Excalidraw, RustDesk

Hostinger

Run Comp AI on your own server

Self-host Comp AI on a Hostinger VPS.

Deploy on Hostinger

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,826 GitHub stars
Licence AGPL-3.0
#Email

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

3,235 GitHub stars
Licence Apache-2.0
#AI Agents

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

5,914 GitHub stars
Licence Apache-2.0
#AI Agents

Advertise your product

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Comp AI vs Vanta

Vanta and Comp AI both automate compliance evidence and audit preparation for SOC 2, ISO 27001, and HIPAA. The core difference is deployment model and data ownership.

Feature	Comp AI Community	Vanta
License	AGPL-3.0	Proprietary
Self-hosting	Yes	No
Source code	Open source	Closed
Pricing	Free (self-hosted)	Per-seat SaaS
Frameworks	SOC 2, ISO 27001, HIPAA, GDPR, FedRAMP	SOC 2, ISO 27001, HIPAA, GDPR

Comp AI vs Drata

Drata offers a polished managed-first compliance experience covering the same core frameworks. Like Vanta, Drata has no self-hosting option and charges per-seat SaaS pricing.

Feature	Comp AI Community	Drata
License	AGPL-3.0	Proprietary
Self-hosting	Yes	No
Pricing	Free (self-hosted)	Per-seat SaaS
AI policy generation	Yes	Yes
Frameworks	SOC 2, ISO 27001, HIPAA, GDPR, FedRAMP	SOC 2, ISO 27001, HIPAA, GDPR