One platform
for every audit
GRCWorks runs your whole compliance programme (controls, evidence, risks, vendors and audits) for SOC 2, ISO 27001 and privacy laws like GDPR, DPDP, PDPA and PDPL. Free to self-host. Built by GRC practitioners.
Open source under the MIT licence · View the code on GitHub
CC6.1Quarterly access reviewCC6.3Joiner / leaver checksCC7.2Vulnerability scanningCC8.1Change management logCC9.2Vendor risk reviewSpreadsheets don't
pass audits.
Shared drives, reminder emails and a year-end scramble. GRCWorks replaces all of it with one system your whole team can use, and your auditors will thank you for.
Map once.
Count everywhere.
Build one set of controls and map it to SOC 2, ISO 27001 and any privacy law: GDPR, DPDP, PDPA, PDPL and more. GRCWorks shows which frameworks every control counts towards, so one piece of evidence does the work of three.
- Import controls from Excel in minutes
- Coverage per framework, live
- Owners, frequency and status per control
Evidence
on autopilot.
Plan the audit year once. Owners get reminders when each month or quarter opens, reviewers approve as they go, and at year end you download a complete, indexed evidence package.
- Monthly, quarterly or annual evidence slots
- Weekly reminders, daily in the final week
- One-click evidence package for auditors
Vendor risk,
without the chase.
Send security questionnaires through a secure vendor portal. Vendors answer and upload files without an account, and you score, review and keep everything on record.
- Questionnaires from Excel templates
- Email-verified vendor portal
- Scores and evidence in one place
Turn security into
a sales asset.
Publish your certifications, policies and sub-processors on your own Trust Center. Customers request access, accept your NDA and view watermarked documents, with access that expires on its own.
- NDA before anything sensitive
- Per-customer, time-limited access
- Requests flow into your task list
Do the job
before you get it.
GRCWorks Labs give you a fictional company in your industry and the work GRC teams do every week. Review the access list, check the asset register, test the change sample, then raise what you find on the real platform.
- Quarterly user access review
- Asset inventory check
- Change management sample test
- Vulnerability SLA review
- Firewall rule review
- Third-party register review
- Training and onboarding check
- Backup and restore evidence
Eight labs, 30 industries, four experience levels from beginner to 11+ years. Lab 1 is free. Getting ready for a GRC job? Interview preparation is part of the Academy too.
Self-host it free.
Or let us run it.
Every plan includes every feature. Run it yourself at no cost, or pay us to host and support it, with an expert alongside if you want one.
Community
FreeFree
self-hosted, foreverself-hosted, forever
The full platform on your own server or cloud.
Self-host GRCWorksCloud
₹10,000$100
per monthper month
Hosted GRCWorks in India-based data centres. We run it; you use it.
Contact usCloud + Expert
CustomCustom
platform + consultingplatform + consulting
Hosted GRCWorks with a consultant who sets it up and runs it with you.
Talk to usPrefer an expert
alongside?
GRC practitioners set GRCWorks up for your company and take you through SOC 2, ISO 27001 or privacy-law readiness to a clean audit. You keep the platform and the know-how.
Questions
Is GRCWorks really free?
Yes. The Community edition is open source (MIT licence, on GitHub) and free to self-host with every feature included. GRCWorks Cloud, where we host and run it for you, is ₹10,000 a month in India and $100 a month elsewhere. You pay for hosting, backups and support, never for features.
Which frameworks and privacy laws does it support?
SOC 2, ISO 27001, ISO 27701, ISO 42001 (AI management), NIST CSF, PCI DSS, GDPR and India's DPDP Act come built in. Any other framework or privacy law, such as Singapore's PDPA, Saudi Arabia's PDPL or your own internal standard, can be added by importing its requirements. One set of controls can count towards all of them at once.
Where is our data stored?
GRCWorks Cloud runs in India-based data centres. With the Community edition, data stays wherever you host it.
Can I learn GRC on the platform?
Yes. GRCWorks Labs give you your own fictional company in your industry and real work to do on it: access reviews, asset checks, change testing, vendor reviews and more, graded automatically and pitched at your experience level. Lab 1 is free.
How do I pay for the labs?
By UPI or bank transfer for now. Pay, enter your payment reference in the labs, and your account is unlocked once we've matched it. Teams get one access code and an invoice.
Do you also help implement it?
Yes. Our consultants can set GRCWorks up for you and take you through SOC 2, ISO 27001 or privacy-law readiness and audit. Certification audits themselves are done by independent auditors.
Run your next audit
on GRCWorks
Self-host GRCWorks for free, let us host it for you with GRCWorks Cloud, or book a demo and we'll show you around with your own framework.