Drift alerts
Owners hear about it the moment a check that passed starts failing, with the diff that caused it.
GDPR · ePrivacy · CRA · AI Act
Stay compliant on
every push.
Gorilli Compliance scans your websites, repositories and policies against GDPR, ePrivacy and the Cyber Resilience Act, gets you ready for the AI Act, and opens the fix as a pull request.
- 30-minute live scan
- Nothing to install
- Built for EU rules
web.https-redirectPASSweb.security-headersPASScookie.consent-before-trackingREVIEWrepo.branch-protectionFIXEDrepo.security-policyPASSrepo.secret-scanningPASSdoc.privacy-policyAPPROVEDcra.vulnerability-disclosurePASSweb.tls-versionPASSweb.third-party-transfersFAIL
compliance / assets / acme-weblive
SCAN LOG
▸scan acme/web · push 4f2a1c
✓web.https-redirectpass
✓web.security-headerspass
!cookie.consent-before-trackingreview
✗repo.branch-protectionfail
✓repo.security-policypass
→fix PR #42 opened
%
Overall posture
Up 28 points since Monday
GDPR
Repo hygiene
CRA
Fix pull request #42 openedRequire reviews and block force pushes on main
How it works
From first scan
to fixed.
- 01
Connect
Paste a URL, pick a GitHub repository or upload a policy. Nothing runs on your servers.
acme.comacme/webprivacy-policy.pdf - 02
Scan
Every check maps to the controls it proves, so one result counts for every framework that needs it.
- web.https-redirectpass
- web.security-headerspass
- repo.branch-protectionfail
- cookie.consentreview
- 03
Fix
Merge the pull request we open, follow the fix steps, or generate the missing policy in one click.
Add SECURITY.mdopen+ ## Reporting a vulnerability
+ Email security@acme.com
+ We reply within 72 hours.
Features
Everything an audit asks for,
already running.
Checks, fixes, policies and evidence in one place, so the next security questionnaire takes an afternoon, not a month.
Fix pull requests
Branch protection, security policies and code owners land as reviewed pull requests, not tickets.
Generated policies
Privacy, cookie, security and incident policies drafted from your profile and live scan evidence.
Tamper-evident evidence
Every scan result is stored append-only and SHA-256 hashed, ready for an auditor to verify.
Scheduled and push scans
Daily or weekly schedules plus a GitHub webhook, so every change to the default branch is checked.
Team workspaces
Invite owners, admins and viewers, with each workspace's assets and evidence kept apart.
Frameworks
Mapped to the rules
you answer to.
Answer a few questions about your company and only the frameworks that apply to you are switched on. The AI Act is next.
EU 2016/679
GDPR
Privacy notices, processors, records of processing and transfers outside the EU.
2002/58/EC
ePrivacy
Cookies and trackers only after consent, with a clear banner.
EU 2024/2847
Cyber Resilience Act
Vulnerability handling, disclosure policy and a software bill of materials.
BASELINE
Web security
HTTPS, TLS, security headers and third-party exposure.
BASELINE
Repository hygiene
Branch protection, secret scanning, security policy and code owners.
EU 2024/1689
Coming nextAI Act
Inventory your AI features, their risk class and transparency duties, with evidence kept next to GDPR.
IT
Italian web obligations
Company details, VAT number and legal notices on the site.
GDPR, ePrivacy cookie rules and the Cyber Resilience Act today, plus web security and repository hygiene baselines and Italian website legal notices, with AI Act readiness coming next. Your company profile decides which ones apply.
A website URL, a GitHub repository or a policy document. Public sites and repositories need nothing else; private repositories and fix pull requests use a fine-grained GitHub token, stored encrypted. Scans then run on a schedule and on every push.
If you build or use AI features, your profile records it and AI Act readiness is the next framework we are adding: an inventory of AI features, their risk class and transparency duties, with the evidence kept next to your GDPR records. Book a demo to see where it stands.
For repository findings it can open a pull request with the change, such as a SECURITY.md or CODEOWNERS file, for you to review and merge. Every other finding comes with plain instructions on how to fix it.
It drafts your privacy policy, cookie policy, record of processing activities, DPA, security policy, vulnerability disclosure policy and incident response plan from your profile and the latest scan evidence. You review, approve and keep every version.
No. It keeps your technical controls and documents in shape and gives you hashed, timestamped evidence to show. Legal advice and formal certification still come from your counsel and your auditor.
Ready when the auditor is
Don't tell them you're compliant.
Show them.
Book 30 minutes. We scan your own site live and show you what an auditor would flag.