Compliance delivery for frameworks nobody else covers

Build structured compliance evidence packs with control mapping, gap tracking, and automated validation. Export as PDF executive summaries or ZIP archives with SHA-256 integrity manifests.

• ✓260+ mapped controls across 7 regulatory frameworks
• ✓Evidence upload with R2 storage + version control
• ✓Gap Kanban with drag-and-drop triage
• ✓Automated readiness scoring + validation
• ✓PDF + ZIP export with attestation pages
• ✓Cross-framework control mapping (ISO ↔ SOC2 ↔ NIST)

Register AI systems, classify risk under the EU AI Act, and generate compliance artifacts — model cards, risk assessments, transparency statements, and policies. AI-powered content generation fills templates automatically.

• ✓EU AI Act risk classification (4 tiers)
• ✓9 artifact types with structured templates
• ✓Claude-powered content generation
• ✓Conformity assessment workflow (Art 43)
• ✓Review cadence tracking + overdue alerts
• ✓Governance pack export with SHA-256 manifest

5×5 heat map visualization with inherent and residual risk scoring. Key Risk Indicators, treatment plan workflows, and control linking — not just a spreadsheet replacement.

• ✓5×5 risk heat map with appetite line
• ✓Inherent + residual risk scoring
• ✓KRI tracking with breach detection
• ✓4-step treatment workflow (Identify → Plan → Implement → Verify)
• ✓Control linking from ISO 27001 library

10 pre-built policy templates (InfoSec, Privacy, Incident Response, BC/DR, and more). Version control, approval workflows, acknowledgment tracking, and review reminders.

• ✓10 policy templates with section guidance
• ✓Draft → Review → Approved workflow
• ✓Version diff (side-by-side comparison)
• ✓Acknowledgment tracking per team member
• ✓Automated review reminder emails

Incident lifecycle from detection to post-incident review. GDPR Article 33/34 breach notification checklist with 72-hour countdown, communications log, and classification taxonomy.

• ✓72h breach notification countdown
• ✓Authority + data subject notification tracking
• ✓7 incident classifications
• ✓Post-incident review template
• ✓Communications log for regulatory trail

Assessment questionnaires (SIG Lite, CAIQ v4, Custom), automated risk scoring, and a public vendor response portal. Schedule recurring assessments and track remediation.

• ✓3 questionnaire templates (SIG Lite, CAIQ, Custom)
• ✓Weighted risk scoring formula
• ✓Public vendor response portal (token-based)
• ✓Assessment scheduling + overdue tracking

Generate audit plans from the ISO 27001 control matrix. Track findings with corrective actions, severity levels, and responsible parties. Export Markdown audit reports.

• ✓Audit plan from control matrix
• ✓Finding tracking (major/minor/observation)
• ✓Corrective action workflow with due dates
• ✓Markdown report export