Governance, Risk & Compliance.
Frameworks, controls, risk, evidence. One schema, no spreadsheet rooms.
Every framework requirement links to the controls that satisfy it, the risks those controls reduce, and the evidence that proves it. They are rows in one Postgres schema with foreign keys between them, so the links don’t drift the way nine separate spreadsheets do.
GRC controls view, demo tenant (sample data).
What it does today.
Many frameworks, one control set
48 frameworks in the catalog, including SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF, CMMC 2.0, 21 CFR Part 11, GAMP 5 and GDPR. The catalog holds requirement IDs and titles (2,212 rows across the 48), not written control text. Map a control once and the cross-framework mapper shows where else it counts. Your own framework loads from a CSV.
Controls with tests and owners
Controls carry owners, implementations, tests and mappings. The compliance matrix and Statement of Applicability render straight from those rows. A demo tenant shows 41 controls across 11 frameworks.
A risk register with numbers
Risks link to the controls, vendors and assets involved. Treatment plans, a heat map, and Monte Carlo quantification for when someone asks what a risk actually costs.
Evidence from systems we’ve run against
Evidence reads from AWS (Config, Security Hub, GuardDuty, IAM), Microsoft (Graph, Entra ID, Intune, Defender, Secure Score), Jira and Confluence. The Okta, ServiceNow and GCP posture connectors are built and switch on with credentials. They haven’t run against a live customer system yet.
What you get out of it.
- Map a control once, see every framework it counts toward
- One PDF evidence pack per framework, generated in seconds
- Risks tied to the controls that actually reduce them
- Policies with versions, acknowledgments and quizzes in the same database
Every name here is in the product. “(built)” means the connector switches on with your credentials but hasn’t run against a live customer system yet.
Stronger together.
Modules share one schema, so each one reads the others’ records. Three that pair naturally with this one.
See GRC with your own questions.
Send us what you need it to answer and we’ll walk you through the module on our demo tenant.