ISO 27001 · HIPAA · PCI DSS · GDPR and more
Run your compliance program in one place, with the evidence ready when the auditor asks.
Who has access to what, onboarding and offboarding, device audits, policy training, incidents and security scans: kept up to date from the tools your team already uses.
One plan · cancel anytime · in English, French and Spanish
Controls, policies and risks for the standards you are audited against
- ISO/IEC 27001 Information security management
- ISO 13485 Medical devices quality management
- CIS Controls Critical security controls
- HIPAA US health information privacy
- PCI DSS Payment card data security
- GDPR EU personal data protection
- CCPA California consumer privacy
- PIPEDA Canadian personal information protection
Everything an audit asks for, kept current instead of rebuilt every year
Each area below is a screen your team works in day to day, and an export your auditor can read.
Services and access reviews
Every SaaS and cloud service with its owner, risk and evaluation. Who has access, who is an admin and who stopped using it comes straight from the service, so a review is a check, not a spreadsheet.
Onboarding and offboarding
A checklist per person with a task for each service owner, from the first day to the last. Access that should have been removed shows up before the auditor finds it.
Device audits and document training
Staff check their own laptops and phones and read your policies from a link, without an account, in their language. You get a signed record for each person.
Documents and policies
Start from templates for each standard, edit together, and approve with a signature. Every version and change notice is kept, and exports as a PDF with your branding.
Incidents and corrective actions
Log an incident, follow it through containment and communication, and turn what you learned into a CPAR with an owner and a check that it worked.
Security scans
Scheduled scans of your web applications, with findings ranked by severity and false positives you mark once and stop seeing.
Connected to the tools you already use
Users, admins and access logs are read from your services automatically, every day.
1Password · Amazon Web Services · Anthropic · Atlassian Confluence · Atlassian Jira · Atlassian Jira Service Management · GitHub · Google Cloud · Google Play Console · Google Workspace · Iru · Microsoft Intune · Monday · New Relic · NINJIO · OpenAI · SendGrid · Slack · Vercel · Zendesk
See every integration and what it readsTry it free for 14 days
One plan with everything included. Your workspace is ready on its own address as soon as you sign up.