SCFBuilt on the Secure Controls Framework™
Compliance tooling for people who take the work seriously.
Operationalise the Secure Controls Framework™ with open-source tooling that shows you where you are, what's missing, and what good looks like — without pretending evidence can be faked into existence. Free, and yours to self-host.
The actual platform — not a mockup.
SCP-01How it works
Three steps. No theatre.
Map
Pick your frameworks. The SCF's 354+ mappings mean one control set serves all of them — no re-mapping per standard.
Evidence
Score every control's evidence L0–L5. Honest maturity, not a checkbox — you'll know exactly what an auditor will see.
Prove
Link controls to risks, run audit workspaces, and show a posture you can stand behind.
SCP-02Who it's for
Serious compliance work, three ways in.
GRC consultants
Run every client's programme from one console — per-client workspaces on a shared control library.
For consultantsIn-house GRC leads
Your whole programme — controls, evidence, risk — in one place instead of forty spreadsheets.
Founders
Chasing your first ISO 27001 or SOC 2? Work from the real control set, not a simplified veneer.
SCP-03Built by a practitioner
SCF Controls Platform is built by a practising GRC consultant who runs real client engagements on it. It exists because compliance theatre wastes everyone's time.
Why this existsOSSOpen source
Free, open source, and yours to run.
No subscriptions, no seat licences, no lock-in — just SCF-native GRC tooling you can read, host, and improve.
AGPL-3.0-licensed software
The platform software is released under the GNU AGPL-3.0 licence. Read it, fork it, and self-host it — the copyleft terms keep it open for everyone.
Self-hostable
Run the platform on your own infrastructure. Your controls, evidence, and risk data stay where you put them.
Community-driven
Built in the open. Issues, pull requests, and framework mappings are welcome from the whole GRC community.
The AGPL-3.0 licence above covers this platform's software — not the Secure Controls Framework content. The platform is built and designed to operate the free version of the SCF content out of the box. The SCF itself is published by ComplianceForge under its own licensing, and it is not ours to relicense or adapt. If you need to adapt the SCF controls, we'd encourage you to engage ComplianceForge directly to obtain the appropriate licence.
Review SCF licensing →