Caisson vs Probo
Probo runs the compliance program — as open-source software you host, or as a service its officers run. Caisson is the code inside your product that the program tracks. Here is the honest line.
Which should you use?
Pick Probo to run a compliance program: an MIT-licensed, self-hostable GRC platform (risk register, control library with a Statement of Applicability, vendor risk, access reviews, audit programs, 270+ MCP tools) or its 'Compliance, Done For You' service, where dedicated compliance officers run the program and manage your auditor. Pick Caisson for the other half: the technical controls inside your application, owned one-time — fail-closed Postgres RLS with isolation tests, a WORM + hash-chained audit trail, per-tenant field encryption, and OSCAL evidence packs. Probo tracks that a control exists; Caisson is the control.
What Probo is
Open-source GRC platform (MIT) + managed compliance service. Facts below were read from www.probo.com on 2026-08-09.
- An MIT-licensed, self-hostable GRC platform: Go + PostgreSQL backend, React/TypeScript console, deployed with Docker (github.com/getprobo/probo, 1.3k stars and 188 forks, read 2026-08-09).
- Full GRC lifecycle: risk register with inherent/residual scoring, a control library with a Statement of Applicability, vendor/third-party risk (automated website assessment, DPA/BAA tracking), DPIA and transfer impact assessments, access-review campaigns, audit programs, and versioned documents with approval quorums and e-signatures (github.com/getprobo/probo, read 2026-08-09).
- Automation surfaces: 270+ Model Context Protocol tools, a prb CLI over 44+ resource types, a GraphQL API, an n8n community node, and webhooks (github.com/getprobo/probo, read 2026-08-09).
- Its headline offer is 'Compliance, Done For You' — dedicated compliance officers who run the program end to end and handle auditor communication. Managed frameworks listed: SOC 2 (Type 1 and Type 2), SOC 3, ISO 27001, ISO 27701, ISO 42001, HIPAA, GDPR, CCPA, and FERPA, and the page says the list is not exhaustive.
- Y Combinator-backed; the managed service is quote-based ('Talk to an expert') and probo.com publishes no pricing page (checked 2026-08-09).
An honest comparison
Where Probo has a capability, it is marked. Caisson is the compliance and tenant-isolation substrate; Probo wins the rows it wins.
| Detail | Caisson | Probo |
|---|---|---|
| Form factor | Library composed into your app | Platform you deploy, plus a managed service |
| Continuous stack/cloud monitoring + automated evidence collection | from your own app code | |
| Runs the audit workflow (evidence-for-auditor, questionnaires) | — | |
| Hosted Trust Center for prospects | trust-page module you host | |
| Third-party / vendor risk management (TPRM) | — | |
| Compliance officers who run the program | — | |
| Open-source license | Apache-2.0 base (permissive) | MIT (whole platform) |
| Fail-closed Postgres RLS + automated cross-tenant isolation tests | — | |
| WORM evidence store + append-only hash-chained audit trail | — | |
| SOC 2 / HIPAA / EU AI Act evidence packs + OSCAL export | — | |
| Per-tenant field encryption (envelope, per-tenant key) | — |
What Probo is genuinely better at
A comparison that only flatters one side isn't worth reading. Here is what this kit does well.
Probo is the whole program in open source: risk, controls, vendor risk, privacy assessments, access reviews, audit programs, and a public compliance page, self-hostable for free under MIT with no /ee split — plus an unusually strong automation surface (270+ MCP tools, a full CLI, GraphQL). Caisson ships none of that program layer and does not try to.
The Compliance Officer Service covers the organizational half of compliance — policies, risk assessments, evidence chasing, auditor coordination — which no library can do and Caisson explicitly does not sell. For a team without a compliance owner, that is the constraint being solved, and it is a real answer.
Where Caisson draws the line
The compliance and tenant-isolation substrate a launch kit leaves to you.
Probo records that a control exists: an SoA row, an implementation state, an evidence file someone attached. Caisson is the enforcement — a Postgres FORCE RLS policy, an isolation test that attempts a cross-tenant read and asserts it returns nothing, a hash-chained audit row, an evidence pack generated from the live system. One is an assertion about the app; the other is the app.
Caisson sells software, not a compliance-officer role. There is no managed program, no auditor liaison, and no claim to make you certified: the audit and your organizational controls stay yours. If what you need is someone to run the program, that is Probo's offer, not ours.
Which should you pick?
You need a compliance program — risk register, vendor risk, access reviews, policies, auditor coordination — either self-hosted free under MIT or run for you by compliance officers.
You need the technical controls implemented and provable inside your own application, one-time and owned, with the program run by your team or by someone else.
Run Probo as the program of record and Caisson as the controls in the product it tracks: the SoA row asserting tenant isolation points at an isolation test running in your CI, and the evidence attached to it is generated from the live system rather than screenshotted.
One-time, own the source.
Caisson is a one-time perpetual license — the price never recurs, and it includes 12 months of updates from your purchase date, renewable per entitlement afterward at 40% of list per year. The Base substrate is Apache-2.0; the compliance modules are commercial.
Compliance bundle
$1,649, one-time. Fail-closed RLS, WORM, the audit chain, evidence packs, and the framework and signing carves — the whole substrate this comparison is about.
À la carte
Take a single module from $49 — audit-worm, field-crypto, or compliance-core on their own, onto your existing Postgres app.
Everything bundle
$2,259 covers every bundle and every à-la-carte module, plus the open base, in one purchase.
Common questions.
Is Caisson a Probo alternative?
Probo is MIT and free to self-host. Why pay for Caisson?
Does Caisson run my compliance program or talk to my auditor?
Ship the compliant backend.
Explore the Compliance bundle, browse every module in the marketplace, or read another comparison.