Indeed, we are not GDPR compliant. This explains why we don't have a cookie banner. I understand the confusion as this is something we offer to our customers.
In any case, we have cookie & privacy policies with an updated subprocessors list (and a security page) that you can check in our footer.
I understand your worries about privacy - we are fully OSS, you can inspect everything and check what we are tracking (our landing page is here: https://github.com/getprobo/getprobo.com)
If you are not at all familiar with the space, you can view SOC2 as a safety checklist for company storing important data online. The idea behind it is to push companies to implement security measures or processes to protect said data.
However, it does not make you secure. You can look at it like a restaurant health inspection—just because a restaurant passes doesn’t mean you’ll never get food poisoning. It just means they’re following the right procedures at the time of inspection.
One of the reason I'm open-sourcing it (and making it free) is the hope that, if I am able to properly tailor the experience to start-up, they implement security measures adapted to their needs early on, they actually follow them, those security measures grow with them, and when they get the SOC2 audit (later), it actually means something.
Approval is not mandatory for all PRs. You can change your policy about it and easily justify it with your auditor.
=> It makes way more sense to have important stuff reviewed vs automated approval from a bot.
I think most people blindly try to get controls in Vanta/Drata to pass like us. I'd much rather build a dumb bot than having to talk to my auditor. But still
We are helping several companies achieve compliance using our MVP and are building the open-source software in parallel. You can check our avancement here: https://github.com/getprobo/probo
As it is under construction, no testimonial yet regarding the self-hosted part.
But happy to help you if we can, feel free to reach out.
If I’m understanding correctly, the MVP and OSS are separate. If correct then I have to ask if the OSS version is in a usable state? Regardless, I’ll keep an eye on this project. Kudos.
It does not -> if a compliance framework requires an auditor, you will need to work with one.
However, we can recommend auditors fit for your company or, if you don't want to handle the relationship, we can do that for you (that is what we do for our customers).
Indeed, we are not GDPR compliant. This explains why we don't have a cookie banner. I understand the confusion as this is something we offer to our customers.
In any case, we have cookie & privacy policies with an updated subprocessors list (and a security page) that you can check in our footer.
I understand your worries about privacy - we are fully OSS, you can inspect everything and check what we are tracking (our landing page is here: https://github.com/getprobo/getprobo.com)