Download Rosco Community

The full ISO 31000 register, free and open source under AGPL-3.0. It runs on your own servers, and an Enterprise licence can switch on more later with no reinstall.

The first public release is being prepared. Release files, checksums and signatures will be listed here. To get early access now, or to hear when it's out, email hello@roscoriskmanagement.com.

Three ways to install

Rosco is one application with three processes (the API, a background worker and the web app) and one PostgreSQL database. No Redis, message broker or object store.

Docker Compose

A Linux host with Docker Engine 24 or later, a DNS name and ports 80 and 443. Caddy handles TLS: its own certificate authority for offline use, Let's Encrypt, or your own certificate.

sudo mkdir -p /opt/rosco && cd /opt/rosco
sudo cp .env.example .env && sudo chmod 600 .env
sudo nano .env
sudo docker compose up -d

The containers run as an unprivileged user with a read-only root filesystem and no Linux capabilities.

Without internet access

An air-gapped bundle for each release with the Rosco, PostgreSQL and Caddy images, the compose files, an installer and checksums. Nothing is fetched.

sha256sum -c rosco-<version>-airgap-amd64.tar.sha256
tar -xf rosco-<version>-airgap-amd64.tar
sudo ./install.sh /opt/rosco
sudo docker compose up -d --pull never

Upgrades run the new bundle's installer, which keeps your settings.

deb and rpm packages

For Ubuntu 22.04 and 24.04, Debian 12, and RHEL, Rocky and Alma Linux 9, on amd64 and arm64. The packages bring their own Node.js runtime and run as systemd services, with logs in journald.

sudo apt install ./rosco_<version>_amd64.deb
sudo nano /etc/rosco/rosco.env
sudo systemctl enable --now rosco.target

Samples for nginx, Apache and Caddy are included.

What it needs

Part	Minimum	300 active people, 10,000 risks
App host	2 vCPU, 4 GB RAM	4 vCPU, 8 GB RAM
Database	PostgreSQL 15, 1 vCPU, 2 GB	PostgreSQL 17, 2 vCPU, 4 GB, SSD
Disk	10 GB	50 GB, with the file store and local backups

Check what you install

Release images are signed with cosign from the release workflow and carry a signed SPDX SBOM. Release files are listed in a signed SHA256SUMS. The administrator guide in each release shows the exact commands.

Then switch on Enterprise

Single sign-on, SCIM, access by business unit, board packs, the report builder and Ask Rosco come with an Enterprise licence file: upload it under Admin › Licence.

Start a free 30-day trial See pricing