Platform
One workspace for the whole assurance loop
From the first failed check to the auditor's evidence pack — every step shares the same data, so the story is always consistent.
Continuous compliance
Controls are tested on a schedule against live configuration, not attested once a year.
- Deterministic rule engine — PASS, PARTIAL or FAIL is computed, never inferred by a model
- Weighted scoring by control risk level, with not-applicable controls excluded and justified
- Freshness built in: expired evidence stops counting toward your score
- One universal control mapped to many frameworks — test once, satisfy several
- Every result labelled LIVE (real integration) or MOCK (demo data), never ambiguous
Risk & remediation
A failed control becomes a tracked, owned, time-boxed piece of work — and it only closes when it re-tests clean.
- Findings are de-duplicated: re-running a check updates the same finding instead of creating a new one
- Configurable likelihood × impact matrix, heatmap and inherent vs residual risk
- Remediation tasks with owners, SLA by severity and automatic overdue alerts
- Risk acceptance requires justification, an approver and an expiry — accepted risk reopens when it lapses
- Re-validation: a finding resolves only when the underlying check passes again
Evidence & audit workspace
Auditors get a clean trail; you stop chasing screenshots.
- Evidence created automatically from every check run, SHA-256 hashed and time-stamped
- Manual evidence upload for controls that can't be tested by API
- Audit engagements with per-control review status and an evidence binder
- Audit readiness score and an audit evidence pack (control matrix, evidence index, findings, risk register)
- Auditor request tracker with owners, due dates and responses
Privacy & DPDP
India's DPDP Act modelled as first-class obligations rather than a generic privacy checklist.
- Personal data inventory and record of processing activities (RoPA) with legal basis and retention
- Data-principal request (DSAR) tracker with a configurable SLA, automatic due dates and overdue alerts
- Grievance Officer record and Data Fiduciary / Processor / Both role per workspace
- Significant Data Fiduciary handling as a suggestion you confirm — never auto-applied
- Statutory penalty exposure reference tied to your open findings (reference only, not legal advice)
Vendor risk
Know which third parties touch your data and whether they've been reviewed.
- Vendor register with criticality, data access, certifications and owner
- Assessment history with risk score and status
- Review cadence tracking with overdue and never-reviewed reporting
Reporting engine
One data model behind every report, so numbers never disagree between screens.
- 34 reports across executive, compliance, control, evidence, findings, risk, remediation, audit, privacy, policy, vendor, security and portfolio
- PDF, XLSX, CSV and JSON exports from the same generic engine
- Every report states its assessment period, framework version, data freshness and scoring methodology
- Daily compliance snapshots power trend and change-since-last-time reports
- White-label branding (name, colour, footer) for consultancies reporting on behalf of clients
Multi-client portfolio
Built so a consultancy or MSP can run many clients without their data ever mixing.
- Each client is an isolated workspace, enforced by database row-level security — not just application code
- Integrations are scoped per workspace, so one client's credentials never serve another
- Portfolio view: score, critical findings, overdue remediation and overdue DSARs across every client
- Role-based access with per-workspace roles, SSO (OIDC) and SCIM provisioning
On the roadmap
Roadmap AI-assisted evidence gap analysis · security questionnaire automation · public trust centre · endpoint-agent posture checks · GitHub and Google Workspace connectors. Not yet available — listed so you can see where we're heading, not to imply they ship today.
See your real compliance posture, not a spreadsheet of it.
Book a walkthrough and we'll run the checks against a sample environment so you can see every verdict traced back to its evidence.