Probo

Probo is a self-hostable governance, risk, and compliance platform for engineering and security teams. It brings risk registers, controls, vendor risk, privacy work, access reviews, audit programs, evidence, and document approvals into one operating system.

Teams can work through its web console, CLI, GraphQL API, and MCP API, then deploy it on their own infrastructure with Docker or Kubernetes. That makes Probo useful when compliance work needs to fit the engineering workflow instead of being isolated in a managed GRC product.

What You Get

• Risk and control management - Track risks, inherent and residual scores, treatment strategies, control maturity, frameworks, and statements of applicability.
• Evidence and audit workflows - Collect file or URL evidence, assign implementation work, map controls, manage findings, and generate audit reports.
• Privacy operations - Manage data inventories, processing records, DPIAs, transfer impact assessments, and data-subject requests.
• Vendor risk management - Maintain a vendor inventory, assess third-party risk, track agreements, and review subprocessors.
• Access reviews - Run campaigns and record access decisions across connected SaaS, cloud, and source-code systems.
• Document governance - Version documents, collect approvals, support electronic signatures, and export PDFs.
• Compliance portal - Publish selected security material through a public portal with NDA handling and custom-domain support.
• Automation interfaces - Use the web console, prb CLI, GraphQL, MCP, and an n8n node to integrate compliance work into operational workflows.

Common Use Cases

• Prepare for a compliance audit - Map controls to evidence, track implementation progress, manage findings, and assemble audit-ready material.
• Run an engineering-led GRC program - Let security and engineering teams manage compliance alongside their existing cloud, source-control, and SaaS systems.
• Review vendor and privacy risk - Record third parties, assess risk, maintain privacy documentation, and follow up on contractual or data-handling obligations.
• Automate compliance operations - Use the CLI, GraphQL, MCP, or n8n to build evidence, risk, and control workflows into scripts or agent-assisted processes.
• Manage access-review campaigns - Coordinate review decisions across connected systems and retain an auditable record.
• Publish a trust surface - Share approved compliance documents and certifications through a controlled external portal.

Under The Hood

Architecture

Probo is organized around a Go application service that owns configuration validation, migrations, lifecycle management, persistent services, HTTP delivery, and background work. The composition layer wires domain-specific modules for risk, controls, access review, privacy, documents, integrations, notifications, and portals into shared infrastructure such as authentication, storage, and observability. This keeps the product broad without reducing it to one undifferentiated API surface: domain services retain their own responsibilities while the runtime coordinates their dependencies and worker lifecycles.

Tech Stack

The backend is Go with PostgreSQL access through pgx-compatible infrastructure, while object and evidence storage use an S3-compatible API. The product exposes GraphQL and MCP interfaces alongside HTTP services and a Cobra-based CLI. The web applications use React, TypeScript, Relay, Tailwind CSS, Vite, and a workspace-based JavaScript build. Docker supports deployment, with cloud-provider integrations, OpenTelemetry, Prometheus, Grafana, Loki, and Tempo present in the surrounding operational stack.

Code Quality

The codebase uses typed Go services and TypeScript applications, explicit configuration validation, contextual error propagation, structured logging, tracing, and cancellation-aware service lifecycles. Automated checks cover formatting, static analysis, generated-code consistency, JavaScript linting, unit tests with race detection, and end-to-end tests against a containerized stack. The repository also provides contribution and security guidance, examples, and deployment documentation, making the project demanding but well-supported for technical adopters.

What Makes It Unique

Probo’s distinguishing choice is to expose the same compliance domain through human and automation-first interfaces rather than treating API access as an afterthought. A web console, command-line client, GraphQL API, MCP API, and automation node operate around the same GRC entities, which lets engineering teams integrate compliance workflows into scripts, CI-adjacent processes, and agent-assisted operations while keeping an auditable system of record.

Self-Hosting

Probo is MIT licensed. That permits commercial use, modification, and redistribution with the license notice preserved; it does not impose copyleft obligations on a team self-hosting the software. The repository review found no license-key checks and no feature-flagged self-hosting restrictions, so the available source indicates that the core platform is not license-gated.

Running Probo yourself still means operating a production service: its deployment configuration expects application secrets, PostgreSQL, S3-compatible object storage, and the surrounding infrastructure for backups, updates, monitoring, and scaling. Docker Compose and Kubernetes are documented deployment paths, but they do not eliminate those operational responsibilities.

The public repository and documentation reviewed do not establish a separate managed-cloud feature set or support/SLA difference. This record therefore does not claim cloud-only features, managed backups, or enterprise support that the source does not verify.