Works with · Greptile
Does a Greptile review count for SOC 2?
No. Greptile’s review comments come from a bot account and are not an approval by a qualified person other than the author. They are good evidence that the change was examined against the whole codebase. PSCO reads them and adds the named Officer who signs.
How Greptile reviews
Greptile indexes the repository into a codebase graph and reviews each pull request against it, posting comments that reference how the change interacts with code elsewhere in the repository.
What it cannot do
Greptile cannot be the independent human approver an auditor is looking for. SOC 2 CC8.1, ISO 27001 A.5.3, PCI DSS 6.2.3.1 and SOX program-change controls all assume a qualified person other than the author approved the change and understood it. A bot account posting "Approve" is a review record, not an accountable person, and as of mid-2026 no auditor reports accepting it as standard practice.
How PSCO reads its output
Greptile’s comments become findings on the Officer’s packet. Cross-file observations are especially useful on Deep Review, where the Officer reads the sensitive hunks in full.
Two-step setup
Keep Greptile.
Keep Greptile installed.
Add PSCO.
Install the PSCO GitHub App, select the repos in scope, and require psco/approved and one approval from @psco-officers on the protected branch.
The shared-model tip
Point it at the same model the Officer uses.
Point Greptile at the same rulebook the Officer uses. Add the model’s rules to Greptile’s custom rules, or reference psco.model.yaml from them. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · Codex · GitHub Copilot · Cursor Bugbot · CodeRabbit · Graphite Diamond · Qodo · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All
Keep Greptile. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.