Infrastructure compliance,designed for humans.
A free and open-source compliance-as-code CLI. Write readable HCL profiles, run them anywhere — locally or over the network — and get structured reports that plug into your compliance management.
$ refpoint run profiles/linux-baseline
Profile: Linux Security Baseline (v0.1.0)
Date: 2026-04-02 19:33:43 UTC
✓ [ssh-01] sshd_config permissions impact: 1.0
✓ sshd-config-perms[file: /etc/ssh/sshd_config]
✓ [usr-04] Password hashing is SHA-512 impact: 0.9
✓ pam-sha512[command: hash-algorithm]
✗ [fs-01] /tmp mounted noexec,nosuid,nodev impact: 0.8
✗ tmp-noexec[mount: /tmp]
✗ option[noexec]: got "rw,nosuid,nodev", want "noexec"
Summary: 3 controls 2 passed 1 failed 0 errors
Pass rate: 66.7%
Why Refpoint
Human-friendly
Readable HCL profiles that your whole team can understand, review, and maintain — written for people, not machines.
Open source
Fully open source, no vendor lock-in, runs on your infra, your rules. Own your compliance story end to end.
Compliance-ready reports
Structured output in terminal, JSON, or JUnit XML — ready to feed into your compliance management and auditing workflows.
Signed and attested
Every report is signed and attested, and each run keeps a full audit log of the exact commands it executed — so a reviewer can verify the result and see how it was reached.