MIT-licensed compliance platform in Go for engineering teams
Probo is a GRC (governance, risk and compliance) platform written in Go and released under the MIT license by Probo Inc. Risks, framework controls, vendors, privacy impact assessments, access reviews, audits and documents awaiting approval share one database. The README aims it at engineering and security teams, and every object can be handled from the web console, the prb CLI, the GraphQL API or the MCP server.
What Probo Inc. puts first on its homepage is a service rather than the software: "Compliance, Done For You", run by one of its own compliance officers.
The comparison of open source GRC software sets the frameworks Probo ships against the work it leaves to your team.
MCP tools for LLM agents and a vendor catalog
- Thirteen frameworks to import from the console: ISO 27001:2022, ISO 27701, ISO 42001, SOC 2, NIS 2, DORA, GDPR, HDS, HIPAA, PCI DSS, CCPA, FERPA and 21 CFR Part 11. A custom framework imports from a JSON file, and the Statement of Applicability lives in the tool.
- 270+ MCP tools: an LLM agent can read and write risks, controls, evidence and documents. The
prbCLI covers the same resources for scripts and CI, and an n8n node goes through the GraphQL API. - Access reviews wired to the source systems: one decision per account, with connectors for SaaS apps, cloud infrastructure and code hosts.
- Vendors and risks pre-filled: the repository ships a catalog of 562 common vendors (legal name, DPA, subprocessor list) and 82 risk templates.
- Evidence you can show: immutable audit logs, versioned documents with approval quorums and e-signatures, and a public portal where customers can see your certifications.
The vendor sells a service; the software is 0.x
The vendor sells a service. On probo.com, a Probo compliance officer handles policies, controls, reviews and assessments, and answers in Slack. No prices are published; in one testimonial, the customer Verso mentions "outcome-based pricing, not hours billed". Probo Cloud, hosted in the EU or the US, is provisioned through onboarding, and the docs recommend it for most organizations.
Built for teams heading into a certification. The testimonials Probo publishes come from founders, engineers and security teams at about twenty companies, most of them announcing an ISO 27001 certification or a SOC 2 report.
Probo does not audit you. According to the docs, the tool organizes evidence and prepares the file but does not replace the auditor. EDUCENTRIC, one of those customers, got its ISO 27001 after an audit by Tempo Audits.
The bundled frameworks are lists of controls. The ISO 27001:2022 file has 123 entries (clauses 4 to 10 plus the 93 Annex A controls), each reduced to an ID and a title. SOC 2 has 61, NIS 2 has 17, and only HDS describes its controls. After an import, the docs ask you to create or link the measures that satisfy each control, give them an owner and attach the evidence. CISO Assistant, by contrast, advertises more than 220 bundled frameworks.
MIT for the code, CC BY-SA for two datasets. No part of the repository is under a commercial license, whereas CISO Assistant keeps its enterprise/ directory under an intuitem commercial license and ISMS Builder is AGPL-3.0. The vendor catalog and the risk templates are CC BY-SA 4.0: reusing them means crediting Probo Inc., and a modified version keeps the same license. Contributions need a DCO sign-off, with no CLA.
Four containers behind a reverse proxy. The production docker-compose runs probod, PostgreSQL, SeaweedFS (S3-compatible storage) and a headless Chrome, behind a TLS-terminating reverse proxy; a Helm chart covers Kubernetes. On memory, the docs only say that the bundled PostgreSQL configuration requests 4 GB of shared_buffers by itself. They also advise replacing the compose file's latest image with a tested release before exposing the server. Self-hosters create OAuth client credentials for every connector themselves, a step Probo Cloud spares its newer connectors.
Version 0.x, about thirty releases a month. The probod server is at v0.305.0, released October 7, 2026, after 30 releases in September. A minor version can remove a feature: v0.277.0, from September 3, 2026, dropped personal API key creation in favor of scoped OAuth tokens.