How it works
Connect what you ship. Gorilli Compliance checks it against the rules that apply to you, shows what changed, and helps you fix it, then keeps checking.
Paste a URL, pick a GitHub repository or upload a policy. Nothing runs on your servers.
Every check maps to the controls it proves, so one result counts for every framework that needs it.
Merge the pull request we open, follow the fix steps, or generate the missing policy in one click.
+ ## Reporting a vulnerability
+ Email security@acme.com
+ We reply within 72 hours.
SCAN LOG
Overall posture
Up 28 points since Monday
GDPR
Repo hygiene
CRA
What gets checked
These are the checks that run today. Each one maps to the controls it proves.
15 checks
Fetched over HTTPS like a visitor would, with no script or agent on your site.
10 checks
Read through the GitHub API. Public repositories need no token; private ones use a fine-grained token stored encrypted.
3 checks
Uploaded documents are read for the clauses each regulation requires.
After every scan
Each result rolls up from check to control to requirement, so you see one score per framework.
Findings that passed last time and fail now are marked new, and owners get an email.
Every result is stored append-only with a SHA-256 hash and a timestamp, with secrets fingerprinted, never stored.
Daily or weekly schedules, plus a scan on every push to the default branch through a GitHub webhook.
Ready when the auditor is
Book 30 minutes. We scan your own site live and show you what an auditor would flag.