Openlane Review

Openlane centralizes the objects of a compliance program: policies, controls, evidence, and programs mapped to frameworks such as SOC 2, ISO 27001, and NIST 800-53. It includes a registry of personnel, vendors, assets, and platforms, exposure scanning and vulnerability integrations (GitHub, AWS Security Hub, GCP Security Command Center), automation integrations such as Google Drive, GitHub, Entra ID, AWS, and GCP, a Trust Center on a custom domain, and organization settings with RBAC, billing, and SSO. Security controls include 2FA enforcement and auditor roles, and a workflows engine handles approvals, attestation and questionnaire campaigns, and tracked tasks. The documentation shows progress dashboards such as SOC 2 at 61 of 66 controls and ISO 27001 at 59 of 93.

The stack is Go with ent for the data layer, gqlgen for GraphQL, OpenFGA for authorization, PostgreSQL, Redis, and S3-compatible object storage (the docs mention Rook or MinIO as backing options). The quick start needs Go, Homebrew, Task, and Docker, then task install:all and task run-dev, and the Getting Started guide covers tooling, configuration, running the stack, and CLI authentication. Container images are published to the GitHub Container Registry, but Helm charts are not yet published and the README says other deployment methods are in progress. The README states no maturity level, and its Releases and Packages sections appeared empty when we read it, so confirm release practices before relying on it in production.

The main interface is a web console organized around controls, policies, and tasks with dashboards of framework progress, plus a GraphQL API with schema, auth, and examples, and a CLI. A public Trust Center lets you publish your compliance posture to customers. This section reflects the repository and docs; we did not run Openlane.

• Policies, controls, evidence, and programs mapped to SOC 2, ISO 27001, and NIST 800-53
• Registry of personnel, vendors, assets, and platforms
• Exposure scanning integrations with GitHub, AWS Security Hub, and GCP Security Command Center
• Automation with Google Drive, GitHub, Entra ID, AWS, and GCP
• Trust Center on a custom domain
• RBAC, SSO, 2FA enforcement, and auditor roles
• Workflows engine, GraphQL API, and CLI

• Permissive Apache-2.0 code with a modern, API-first architecture
• Fine-grained authorization through OpenFGA, which suits auditors and multi-team access
• Honest roadmap in the README instead of overselling automation
• Active development: v2.8.0 shipped the day before this review

• Very small community (about 320 stars) and no stated maturity level
• Automated evidence collection, training campaigns, vendor risk scoring, and more OSCAL support are listed as roadmap items
• Helm charts are not published, and the stack needs Postgres, Redis, object storage, and OpenFGA
• The total number of frameworks is not stated in the docs we read, and OpenAlternative's 12+ figure is a claim you should verify
• Hosted pricing is per module and not published

Self-hosting is free under Apache-2.0. The hosted console is free for 30 days with no credit card and then priced per module, operated by theopenlane, Inc. under its commercial terms. Logos and trademarks are not covered by the Apache license.

Vanta, Drata, Scrut, and Sprinto are established products with deep integration catalogs, automated evidence collection, and audit-firm networks. Openlane gives you similar objects and a scriptable GraphQL API in open source, but several automations that incumbents sell are still on its roadmap. Probo is the closest open-source peer: it is MIT-licensed, offers a managed compliance-officer service, and has broader published framework coverage, while Openlane has a more explicit authorization model and a Trust Center.

• Engineering teams that want to model compliance as data and script it through GraphQL
• Organizations that need to keep compliance records in their own environment
• Teams that want an Apache-2.0 base they can extend

• Companies facing an audit soon that need automated evidence collection and mature integrations
• Teams without engineers to operate Postgres, Redis, object storage, and OpenFGA
• Buyers who need an established vendor relationship and support