For teams that need ISO 27001, NIS2, and GDPR evidence without handing compliance data to a SaaS vendor, ISMS Builder is a self-hosted information security management system for policies, risks, assets, audits, and incidents. Compliance managers move policies from draft through review to approved and archived, and recipients confirm each one through a token link that needs no login. Security officers close gaps in a Statement of Applicability that cross-maps BSI IT-Grundschutz, NIS2, EUCS, the EU AI Act, and the Cyber Resilience Act, with ISO 27001 controls imported from their own licensed copy. Risk owners keep treatment plans, turn Greenbone and OpenVAS reports into risk drafts, and score assets for confidentiality, integrity, availability, and authenticity. Data protection officers run records of processing, processor agreements, impact assessments, data subject requests, a 72-hour timer, and a deletion log with email alerts. The CISO inbox collects incidents, including reports from a public form that needs no login, beside a 30-item NIS2 Article 21 checklist and Article 23 deadline alerts. Auditors work from a findings register, a compliance matrix, and an exportable audit log of every create, update, delete, and login. Administrators enforce TOTP two-factor sign-in, choose among German, English, French, and Dutch, run semantic search locally through Ollama, and publish approved policies to Nextcloud or ownCloud as PDFs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Comp AI turns the months-long slog of SOC 2, ISO 27001, HIPAA, and GDPR certification into a largely automated process by connecting to your existing infrastructure and continuously collecting the evidence auditors actually ask for. Point it at your AWS account, Google Cloud project, GitHub organization, or any of 580+ supported integrations, and autonomous agents pull configuration snapshots, access logs, encryption status, and policy compliance data on a recurring schedule so your compliance posture reflects reality rather than last quarter's manual export. The AI policy engine analyzes your tech stack, team structure, and risk tolerance to generate organization-specific policies for information security, access control, incident response, data retention, and vendor management; no two companies get the same boilerplate. An open-source device agent runs on employee machines checking disk encryption, firewall status, screen lock settings, password length, and antivirus presence around the clock, flagging failures the moment they occur instead of surfacing them during an audit. Built-in penetration testing agents scan your codebase and API endpoints for vulnerabilities like SQL injection and output audit-ready reports. The vendor risk management module scores third-party services and surfaces compliance gaps before they become findings. A public trust center lets prospects verify your compliance status directly, eliminating security questionnaire bottlenecks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

A secure drop box for tips and misconduct reports, GlobaLeaks lets organizations, newsrooms, and public institutions receive anonymous submissions and reply to the people behind them. Whistleblowers answer a questionnaire, attach files, and leave with a unique 16-digit receipt that reopens their report later for replies, comments, and the choice of whether and when to reveal their identity. Administrators build the intake form with a questionnaire builder, route reports through channels by topic or department, and host several branded whistleblowing sites from one installation in more than 90 languages. Recipients triage in a searchable inbox with labels, reminders, and customizable case statuses. Analysts, custodians, and administrators get separate roles, and the custodian role can gate access to a reporter's identity. Reports and messages are encrypted, an automatic Tor onion service gives whistleblowers an anonymous way in, two-factor authentication protects staff logins, and PGP secures email notifications. Audit logs track staff actions, and retention rules expire old reports to support GDPR duties and EU Directive 2019/1937 workflows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Protecting over 10,000 organizations worldwide with 16,000+ GitHub stars, Wazuh delivers enterprise-grade security operations through a fully open-source platform with zero feature gating. The unified XDR and SIEM solution deploys lightweight agents across Linux, Windows, macOS, Solaris, AIX, and HP-UX endpoints that stream security telemetry to a centralized cluster built on OpenSearch for indexing and the Wazuh Dashboard for visualization and management. Core capabilities include real-time file integrity monitoring with inotify-based detection and who-data attribution, automated vulnerability assessment that correlates software inventories against continuously updated CVE databases, Security Configuration Assessment against CIS benchmarks, rootkit detection, and log data analysis with a rules engine supporting over 3,000 built-in detection rules mapped to MITRE ATT&CK tactics and techniques. Wazuh monitors cloud infrastructure at the API level with native modules for AWS, Azure, and Google Cloud, detects container anomalies through Docker engine integration, and ingests third-party telemetry via syslog and REST APIs from sources like VirusTotal, TheHive, YARA, Suricata, and PagerDuty. Pre-built compliance dashboards and reports cover PCI DSS, HIPAA, NIST 800-53, GDPR, and TSC frameworks. Active response capabilities automatically trigger countermeasures including firewall rule updates, account lockouts, and endpoint isolation when threats are detected. The platform scales horizontally with multi-node clustering for high availability. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0 licensed.

Security scanners each report in their own format, and DefectDojo is the self-hosted platform that imports those reports and keeps a single, triaged list of findings. Reports in mixed formats? More than 350 built-in parsers read output from Burp Suite, ZAP, Trivy, Tenable Nessus, SonarQube, Snyk, and Checkmarx, and Generic Findings Import covers tools without a parser through CSV or JSON files. The same scan every night? Reimport adds new findings, can close the ones that vanished, and reopens the ones that return, while deduplication ties repeat detections inside an asset to their original. Decisions already made? False positive, out of scope, and risk accepted statuses survive reimport, so nobody triages the same noise twice. A deadline on every fix? Severity-based SLA countdowns flag breaches and can notify the users assigned to each asset, and full risk acceptances carry notes, files, and an expiry date that returns findings to active by default. Many teams, many applications? Organizations, assets, engagements, and tests mirror how security work is organized, with permissions that cascade downward. Pipelines that should report themselves? The REST API and CI/CD engagements import results automatically, and findings push to Jira as tickets. Someone outside security wants a summary? Dashboards track metrics, and a widget-based report builder produces HTML reports that print to PDF. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

Unpatched Linux servers expose production environments to critical vulnerabilities, and PatchMon eliminates that blind spot by centralizing package telemetry, security advisory tracking, and automated update orchestration across your entire fleet. Administrators can inspect pending updates across APT, DNF, YUM, APK, Pacman, Zypper, FreeBSD pkg, Windows Update, and winget from one unified queue without opening inbound firewall ports on monitored hosts. Before touching production workloads, operators run dry-run validations to preview exact package transactions, enforce multi-user approval workflows, and schedule rollouts during fixed maintenance windows. During execution, live agent output streams directly to the browser over WebSocket so engineers can watch progress in real time or halt a problematic upgrade mid-flight. Beyond package updates, the platform runs OpenSCAP CIS benchmark and Docker Bench security assessments, inventories running containers and outdated base images, and routes host-down or threshold alerts to Slack, Discord, Microsoft Teams, ntfy, or email. Built-in browser SSH and Apache Guacamole RDP terminals let teams troubleshoot machines directly through the outbound agent tunnel with role-based access control and OIDC single sign-on. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Fleet lets IT and security teams query every device in their organization like a SQL database, using osquery to surface installed software, running processes, configurations, and vulnerabilities within seconds across macOS, Windows, Linux, iOS, Android, and ChromeOS. The Go-based server exposes a web console and REST API for centralized device management, with MDM capabilities built on nanoMDM for Apple device enrollment, configuration profiles, and remote lock or wipe. Vulnerability management cross-references installed software inventories against NVD and OVAL CVE databases, automatically flagging known vulnerabilities with severity scores and remediation guidance. Software deployment handles OS updates using Apple Declarative Device Management, Windows Update, and custom installer packages distributed through S3-compatible storage. A GitOps workflow enables infrastructure-as-code management where device policies, osquery queries, and configuration profiles live as YAML files in Git repositories, with CI/CD pipelines pushing changes through the fleetctl CLI. The fleetd agent bundle includes osquery for telemetry, Orbit for version management, and Fleet Desktop providing end users a menu bar status indicator. Integrations connect to Snowflake, Splunk, Elastic, Jira, Zendesk, Vanta, and GitHub Actions for automated compliance reporting. CIS benchmark policies verify security baselines across operating systems. Deployment requires MySQL for persistence and Redis for caching, running as Docker containers or on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

When a regulatory audit, legal discovery request, or employee offboarding requires years of verifiable email records, Open Archiver provides a tamper-evident, self-hosted vault for every message across your organization. Connect Google Workspace domains, Microsoft 365 tenants, personal Outlook OAuth accounts, or standard IMAP servers for continuous background synchronization, or upload historical PST, MBOX, and zipped EML archives in bulk. Every ingested message is deduplicated, compressed, and stored in standard EML format on local disks or S3-compatible object storage while SHA-256 cryptographic hashes verify file authenticity on demand through built-in Integrity Reports. Instant full-text search scans both message bodies and attached PDF or DOCX documents, letting compliance teams reconstruct complete conversation threads and enforce automated retention policies. Granular access control backed by an AWS IAM style policy engine, TOTP two-factor authentication, and an immutable audit trail keeps sensitive correspondence locked down. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Across personal mailboxes and business domains alike, Mail-Archiver captures, indexes, and preserves every incoming and outgoing email from multiple IMAP and Microsoft 365 accounts in a tamper-resistant archive. Connect standard IMAP servers, Microsoft 365 business tenants via Microsoft Graph, or personal Outlook and Hotmail accounts using OAuth2 device code flow without creating custom cloud app registrations. Scheduled background synchronization mirrors complete folder hierarchies automatically, while bulk tenant onboarding lets administrators import every active mailbox from a Microsoft 365 organization through a single configuration screen. When an important contract, invoice, or correspondence thread goes missing, the advanced search interface filters archived messages by sender, recipient, subject, date range, folder, and body text with instant HTML preview and direct attachment downloads. Users can import legacy MBox files or zipped EML archives, export selected messages or entire accounts, and run direct mailbox-to-mailbox migrations that copy folder trees between providers. Granular retention rules optionally purge aged messages from upstream mail servers to free quota while keeping local archive copies locked against manual deletion for compliance auditing. Multi-user access controls, OpenID Connect single sign-on, detailed activity audit logs, a scoped read-only REST API, and a Model Context Protocol endpoint allow both teams and AI assistants to query historical mail safely. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Mayan EDMS stores, classifies, and retrieves millions of documents with automatic OCR, workflow automation, and audit-ready access controls that organizations have relied on for over a decade. Tesseract integration extracts searchable text from scanned PDFs and images in over 100 languages, transforming paper archives into instantly queryable digital collections without manual data entry. The workflow engine routes documents through approval chains using configurable state machines that trigger notifications, enforce retention policies, and maintain complete audit trails for regulatory compliance. Version tracking preserves every revision with full diff capabilities, while GnuPG digital signatures provide cryptographic proof of authenticity and tamper detection for sensitive records. Role-based permissions combined with object-level ACLs and LDAP integration ensure documents remain visible only to authorized users, down to individual file granularity. Full-text search powered by Whoosh or ElasticSearch handles advanced queries across massive document stores with faceted filtering and relevance ranking. The Django REST Framework API enables programmatic upload, metadata extraction, and workflow triggering from external systems. Beyond simple folder hierarchies, metadata schemas, document types, tags, and cabinet structures provide multi-dimensional classification tailored to how your organization actually works. Background processing through Celery handles OCR, conversion, and preview generation asynchronously, keeping the web interface responsive under heavy ingest loads.

Every scan and PDF you drop into Teedy becomes searchable text in a self-hosted document archive, filed by nested tags instead of folders. OCR reads images in more than twenty languages, and the search box offers suggestions and highlights matches, even inside ODT, DOCX, and PPTX files. Video files are supported as well. Each record carries Dublin Core fields plus custom metadata of your own design, with comments and earlier file versions attached. When a document needs a second pair of eyes, workflow steps with assigned reviewers move it along in order until someone signs off. Pull in EML emails, let the server poll an inbox, or point the bulk importer at a whole folder, and incoming paperwork needs no manual filing. Share a single document through a public link, or keep it behind user and group permissions with a storage quota for each person. LDAP and two-factor authentication guard sign-in, 256-bit AES encryption protects stored files, and an audit log records who changed what. Webhooks alert other services, a documented REST API lets scripts take part, and an Android client carries the archive on a phone. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0 licensed.

ManageIQ gives operators one console for every cloud and hypervisor the organization runs, connecting to VMware, OpenStack, AWS, Azure, Google Cloud, Kubernetes, OpenShift, and Nutanix to continuously discover inventory, map relationships, and listen for changes without installing agents. Discovered estates become manageable: operators publish bundles of resources into a self-service catalog that end users order like apps, then govern the full life cycle through policy, compliance, delegated operations, and retirement. SmartState analysis scans the contents of VMs, hosts, and containers agentlessly, even foreign or uncooperative ones, feeding security and compliance policies that flag drift automatically. Utilization metrics reveal idle systems and right-sizing opportunities, with capacity planning and what-if scenarios before hardware purchases. Chargeback and showback assign rates to tenants, group VMs by tag or container images by label, and generate reports in multiple currencies. Embedded Ansible automation executes playbooks for provisioning and remediation, and the Spassky release adds Nutanix and Terraform Enterprise providers on a Rails 7.2 core. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Cerbos decouples authorization logic from application code entirely, evaluating human-readable YAML policies in under one millisecond through a stateless Policy Decision Point that requires no application state synchronization or cross-network fan-out. Its custom decision engine benchmarks up to 17x faster than OPA-based alternatives. Access control policies use conditions expressed in Google's Common Expression Language, supporting role-based, attribute-based, and policy-based access control patterns including derived roles, scoped policies, and permissions-aware data filtering that pushes authorization predicates directly into database queries. The PDP exposes both gRPC and HTTP APIs with SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby, making integration a single function call regardless of tech stack. GitOps-native workflows treat policies as code with Git versioning, CI validation through GitHub Actions, coverage reports, breaking-change detection, and audit logs of every authorization decision for ISO27001, SOC2, and HIPAA compliance. Deployment flexibility spans Kubernetes sidecars, standalone services, systemd daemons, AWS Lambda functions, and WebAssembly-embedded PDPs that run authorization logic directly in browsers, serverless architectures, and edge devices. The Admin API manages policy lifecycle operations programmatically, while the built-in Playground and REPL provide interactive testing environments for policy authoring and debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

MISP is an open source threat intelligence platform where analysts log indicators and incidents, see how they connect, and share them with trusted organizations. Each case is an event holding attributes and structured objects such as files, network connections, and email messages, with Markdown reports beside the machine-readable data. A correlation engine links events that share values, including fuzzy-hash and CIDR matches, and warning lists flag benign values before they cause false positives. Taxonomies and galaxies tag events with TLP levels, threat actors, malware families, and MITRE ATT&CK techniques. Analysts explore relationships in an event graph and a correlation graph with a timeline, and build drag-and-drop dashboards with maps and ATT&CK heatmaps. Sharing groups control who sees which event, and instances synchronize with partner organizations with distribution settings down to a single attribute. Free-text, URL, bulk, and STIX imports fill the database, and exports reach Suricata, Snort, Zeek, OpenIOC, CSV, STIX 1 and 2, and RPZ zones. A REST API, the PyMISP library, expansion modules, and workflows enrich data and automate publishing. ZeroMQ and Kafka streams announce every change to connected tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

AiSOC delivers an open-source AI Security Operations Center that unifies event ingestion, graph correlation, autonomous triage, and purple-team adversary emulation into a single self-hosted console. Security analysts triage alerts across an interactive Investigation Rail that visualizes six-event attack timelines, pivot-path entity graphs, and recommended containment steps. The underlying LangGraph agentic engine reasons over ingested telemetry, querying MITRE ATT&CK frameworks, CISA Known Exploited Vulnerabilities catalogs, and Shodan intelligence while recording every prompt, tool execution, and evidentiary citation in an immutable Investigation Ledger. Incident responders execute automated containment playbooks, including host network isolation, credential revocation in identity providers, and firewall blocklist updates with human-in-the-loop sign-offs. Threat hunters input plain-English hypotheses into the natural-language hunt workbench to generate and execute ES|QL, SPL, and KQL queries against historical telemetry stores. Platform operators connect over seventy vendor connectors spanning CrowdStrike, SentinelOne, Microsoft Defender, AWS Security Hub, Okta, and Cloudflare to normalize streaming events into Open Cybersecurity Schema Framework standards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.