Nineteen modules sharing one risk universe, one control library and one evidence base. Every screenshot below is the product itself; select one to see it full size.
The assurance core: one risk universe, one control library and one evidence base that every other module builds on.
The whole internal audit lifecycle, from a risk-scored audit universe to findings follow-up, aligned to the IIA’s Global Internal Audit Standards.
An enterprise risk register with scoring, appetite and treatment, linked to the controls and indicators that manage each risk.
Track obligations, frameworks, policies and attestations in one place, with coverage calculated from your implemented controls.
A versioned control library mapped to standards, and the operational controls your teams actually run and test.
The modules that run day-to-day assurance across processes, technology, suppliers and people.
Document business processes once and see their risks, control coverage and evidence quality together.
A governed register for every managed asset, reviewed on a cycle and verified in the field.
Know what you run. A system library fed by discovery agents and network discovery, with the security posture of every monitored machine.
Capture events and issues from any channel, triage them against SLAs and drive them to verified closure.
One lifecycle for application, configuration and regulatory change, with the approvals and evidence to prove it was controlled.
The vendor lifecycle from intake to offboarding, with due diligence, performance and concentration risk in view.
KRIs, KCIs, KPIs and more in one indicator library, with bands, breaches and trend history across every domain.
Business impact analysis, recovery plans and exercises, with live incident activation when it counts.
Compliance training that can prove competence: programmes, exams, campaigns and certifications with an audit trail.
Enterprise modules for the board’s own agenda.
The conduct layer of your control environment, from the whistleblower line to the board committee.
Contracts, obligations and legal matters with renewal exposure in plain sight.
A register of the AI systems you build and buy, classified by risk and tracked against the standards that apply.
Evidence, reporting and planning run underneath every other module, so every package includes them.
The authoritative home for GRC evidence, from request to retention.
Board-grade reporting from live data, with dashboards you arrange yourself.
Personal and team work management that is natively linked to your GRC records.
The same assistant, the same companion app and the same access rules, wherever you are working.
ExAI drafts, analyses and suggests inside the module you are working in. It proposes; you approve.
Take the fieldwork with you. The companion app shows only the modules your package and your administrator allow.
The Main Dashboard shows each person the modules their organisation has bought and their role lets them open, and nothing else.
Designed and specified — coming to the platform next.
GRI, SASB, ISSB (IFRS S1/S2), CSRD/ESRS, and TCFD reporting with cross-standard mapping — report once, satisfy many.
Ingest findings from Nessus, Qualys, and Burp; AI triage and deduplication; SLA-driven remediation tracking.
CycloneDX and SPDX ingestion, component-to-vulnerability matching, and license compliance for your software supply chain.
Detailed pages for the audit and GRC core, the libraries and the full feature list.
One integrated data model across every module — risks, controls, evidence, and reporting that finally agree with each other.