Operations and compliance,
on one platform.
Your GRC program, audits, vendor and contract records, privacy work and vulnerability scanning, in one database. One login, one data model, one place to ask the question.
Demo tenant with sample data. Compliance posture across 11 frameworks, rendered from the same tables every other screen reads. Each tenant carries its own brand.
frameworks in the catalog, SOC 2 to the EU AI Act
requirement IDs across those frameworks
scan engines on one dispatch path
detectors indexed at boot (nuclei + prowler)
Six tools, six bills, no shared truth.
A typical operations team runs a GRC tool, an audit platform, a vendor manager, a vulnerability scanner or two, and a contract system. Six logins. Six data models. Six invoices.
When the auditor asks why a vendor with an open critical CVE is still in your contracts pipeline, nobody can answer. Because nothing connects.
opsnite starts with one graph. Controls, findings, vendors, assets, contracts and audits live in the same database, so the question is a join, not a spreadsheet.
What’s actually different.
One schema, not six products
Next.js and PostgreSQL, 207 data models in one schema. Controls, findings, vendors and contracts are rows with foreign keys between them, which is why a vendor’s open CVE can show up on its contract record. Most stacks bolt those together as separate products and sync them overnight.
Scanning is in the box
Thirteen scan engines dispatch through one path. A plan resolves the exact detectors, each engine runs in its own container task, and every finding gets an EPSS score and its CISA KEV status before it lands next to the controls it affects.
Your stack, your keys
Each customer gets its own container service and its own Postgres database. SSO is per tenant over OIDC (Entra ID, Google, or any OIDC provider), and you pick the model: Anthropic by default, Ollama, or any OpenAI-compatible endpoint.
Pick what you need today.
Add the rest when you’re ready.
Connected to what you already run.
Exercised against real systems: AWS, Microsoft 365 and Entra ID, Jira, Confluence, Slack, Salesforce, DocuSign import, and the 13 scan engines. Splunk, Sentinel, Okta, ServiceNow, Tenable, Qualys and Rapid7 connectors are built and switch on when you supply credentials. The registry lists what each one reads and writes.
Controls library. Each row links to its frameworks, owner, evidence, and the test that last checked it.
Risk register on the same tenant. The controls above link into these risk records through foreign keys, not a sync job.
Vendor register with agreement types, status, primary contact and contract end dates.
Numbers you can trace.
Every figure on this page comes from the product code or a recorded test run. Here is where to look.
See it on your data.
Bring your control library, a vendor list, or a half-finished SOC 2 evidence folder. We’ll show you the platform on your own context in a 30-minute call.