📜 Open-source policy, procedure and compliance management, built as a set of small services.
Steward-GRC is an open-source, Apache-2.0 licensed policy and compliance management system. It keeps an organisation's policies and procedures in one place, takes them through multi-stage approval workflows, tracks who has read and acknowledged them, and backs every change with a hash-chained, independently verifiable audit trail. It's built as a set of small services rather than one monolith, with per-category access rules, single sign-on and second factors, and runs on any Kubernetes cluster.
🏠 Home: steward-grc.com
- website: the public product site.
- docs: the source of the Steward documentation site.
- steward-release: the Helm charts for a self-hosted install on any Kubernetes cluster, with the pinned release manifest and the migration tool.
- steward-appliance: the single-node k0s appliance OS image, with its build kit and upgrades.
- steward-core: categories, templates, policies, versions and sensitivity.
- steward-workflow: approval stages, quorum, group approvals, reassignment, bulk decisions and due dates.
- steward-obligations: obligations, acknowledgements, completion reports and notifications.
- steward-delivery: server-side rendering, version diffs, shared read-only links and PDF export requests.
- steward-pdf-renderer: the PDF render operator, with a PdfRender resource and a headless Chromium job per render.
- steward-collab: live co-editing of drafts, co-editing tokens and snapshot flush.
- steward-reporting: anonymous and named compliance reports, officer case work, breach assessment and notification deadlines.
- steward-ai: cited answers, drafting, review and summaries behind one provider interface.
- steward-gateway: the GraphQL edge for the browser, with sessions, sign-in, first-run setup, the co-editing proxy and document extract.
- steward-web: the staff and admin web apps, the docs guide and the UI kit.
- steward-mock-server: an in-memory mock of the whole gateway API, so the web and mobile apps run locally on invented data.
- steward-identity: users, groups, roles, sign-in factors and SSO connections.
- steward-authz: the access-rule engine and permission catalog shared by the Steward services.
- steward-audit: the tamper-evident, hash-chained audit service.
- steward-android: the native Android app.
- steward-ios: the native iOS app.
- Contributing guide, with the DCO sign-off
- Code of Conduct
- Security policy
- Support
- Governance and maintainers
Steward was originally written by @Bugs5382.
Steward-GRC™ and the Steward-GRC logo are trademarks of the Steward-GRC project. The code is licensed under Apache-2.0; the licence does not grant rights to the names or logos. See TRADEMARKS.md for the usage policy. Applications to register these trademarks are being prepared; full registered (®) protection is pending until they are granted.