Works with · repowise
Does repowise count as code review for SOC 2?
No. repowise posts call-graph and ownership signals from a bot account; they help a reviewer, they are not an approval by a qualified person other than the author. PSCO uses the signals and adds the Officer.
How repowise reviews
repowise analyses the call graph and code ownership around a change and posts comments on blast radius and who should look at it.
What it cannot do
repowise cannot be the independent human approver an auditor is looking for. SOC 2 CC8.1, ISO 27001 A.5.3, PCI DSS 6.2.3.1 and SOX program-change controls all assume a qualified person other than the author approved the change and understood it. A bot account posting "Approve" is a review record, not an accountable person, and as of mid-2026 no auditor reports accepting it as standard practice.
How PSCO reads its output
Call-graph and ownership signals are attached to the Officer’s packet as context for tiering and for reading the sensitive hunks.
Two-step setup
Keep repowise.
Keep repowise on.
Add PSCO.
Install the PSCO GitHub App, pick the repos in scope, and add psco/approved and one approval from @psco-officers to branch protection.
The shared-model tip
Point it at the same model the Officer uses.
Point repowise at the same rulebook the Officer uses. Map repowise ownership signals to the model’s sensitive paths so both flag the same directories. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · Codex · GitHub Copilot · Cursor Bugbot · CodeRabbit · Greptile · Graphite Diamond · Qodo · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All
Keep repowise. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.