Graphletter
Open-source GRC product that compares organizational evidence with control objectives across 81 supported frameworks.
Overview
Graphletter is where my compliance work and software work meet. It reads policies, procedures, screenshots, and audit reports, then compares their evidence with Secure Controls Framework controls. The model handles the messy reading. Deterministic code handles the framework mappings and the scored output trail. The current catalog supports 81 frameworks, including SOC 2, ISO 27001, NIST CSF, HIPAA, GDPR, PCI DSS, and FedRAMP. I released the project under MIT on 2026-05-12.
Key Features
- Evidence ingestion across policies, procedures, screenshots, and audit reports
- Mapping to 81 frameworks through the Secure Controls Framework
- Per-control findings with the underlying evidence cited inline
- Posture score and gap analysis at the framework level
- Public MIT release under p-boaz/graphletter on 2026-05-12
Challenges & Solutions
A polished answer is dangerous when the framework mapping underneath it is wrong. During the July 2026 Secure Controls Framework upgrade, I found that 79 legacy column pointers were misaligned. I replaced the index assumptions with generated mappings and added an exact-header guard that stops the import when the source structure changes. The repair mattered more than the new frameworks because it made the failure loud instead of plausible.