Keep compliance work connected.

See assigned work, unassigned items and work you're kept informed about. Checks and actions sit alongside cases, document reviews and upcoming risk assessments, ordered by due date.

Assign actions with deadlines and track them through review to completion. Scheduled checks, check-ins and reminder emails help owners keep up with recurring responsibilities.

Keep compliance conversations together. Assign or snooze incoming messages, link them to relevant work, and turn a conversation into a case when it needs structured follow-up.

Map an organisation control to multiple reference requirements. Reuse the same implementation across standards such as ISO 27001 and SOC 2, and see which requirements have linked controls.

Define the procedure, owner and frequency of a check. Set its completion window, collect the response and record a reviewed conclusion against the control.

Submit files and notes on a check, reply to its email, or send evidence through a dedicated address or API. Submissions stay attached to the check for review.

Use evidence slots as the main way to reuse evidence collected by a person. Give the slot an owner and a collection schedule, then link it to the checks it supports. Submit a report or file once for the relevant period and reuse it across those checks, including checks for different frameworks.

Maintain a risk register and matrix. Score inherent and residual risk, record your reasoning, and choose acceptance or treatment. Treatment actions become an improvement plan with owners and due dates.

Manage incidents, non-conformities and improvement opportunities with defined steps and sign-offs. Cases also support requests and meetings, with linked controls and follow-up actions.

Manage policies, procedures and other documents with named owners and review schedules. Upload files or link to external documents, assign reviewers and keep a history of approved versions.

Prepare reports through guided steps using supported report templates, including ISO 27001 internal audits. Track draft, review and final status, and generate PDFs for sharing.

Choose which compliance information and sub-processors to publish. Share public documents or require approval for restricted access. Revoke approved links and use your own branding and domain.

Record vendor owners, purpose and assessment dates. Identify critical suppliers and track their reported certifications. Choose which vendors appear as sub-processors on your trust portal.

Link information assets to the systems that hold them. Record system owners, vendors and locations, with confidentiality, integrity and availability ratings.

Work through onboarding journeys with your teams. Invite people to published learning materials, send reminders and track their progress.

See open work across the client workspaces you belong to. Prioritise clients by outstanding conversations and overdue work, then open the items that need your attention.

Connect the tools you already use with your own scripts or integrations. For example, have a backup job send its results or a CI pipeline submit a scan report. The API accepts evidence messages and files for a recurring check definition; yrso routes them to the relevant check for review.

If your tool sends scheduled reports by email, direct them to the check definition's dedicated address. Messages and attachments are collected against the relevant check as new checks are scheduled.

For checks that need a person's input, receive requests and send responses through email or a connected Slack workspace. The conversation and evidence stay linked to the check.

Connect an AI assistant through MCP for read-only access to controls, checks and their evidence context. Access is limited to enabled workspaces the user belongs to.