Skip to content
Book a demoGet early accessEarly access

One home for
your compliance

Controls, evidence, risks, vendors, audits and your public Trust Center, built by GRC practitioners for the way audits really work.

Get early accessBook a demo
Built forSOC 2ISO 27001GDPRDPDPPDPAPDPLISO 42001+ any framework you add

Map once.
Count everywhere.

Build one set of controls and map it to SOC 2, ISO 27001 and any privacy law: GDPR, DPDP, PDPA, PDPL and more. GRCWorks shows which frameworks every control counts towards, so one piece of evidence does the work of three.

  • Import controls from Excel in minutes
  • Coverage per framework, live
  • Owners, frequency and status per control
Learn more

Evidence
on autopilot.

Plan the audit year once. Owners get reminders when each month or quarter opens, reviewers approve as they go, and at year end you download a complete, indexed evidence package.

  • Monthly, quarterly or annual evidence slots
  • Weekly reminders, daily in the final week
  • One-click evidence package for auditors
Learn more

Vendor risk,
without the chase.

Send security questionnaires through a secure vendor portal. Vendors answer and upload files without an account, and you score, review and keep everything on record.

  • Questionnaires from Excel templates
  • Email-verified vendor portal
  • Scores and evidence in one place
Learn more

Turn security into
a sales asset.

Publish your certifications, policies and sub-processors on your own Trust Center. Customers request access, accept your NDA and view watermarked documents, with access that expires on its own.

  • NDA before anything sensitive
  • Per-customer, time-limited access
  • Requests flow into your task list
Learn more
Also includedRisk register with treatment plansFindings and exceptionsPolicies with approval and expiryTasks and approvalsSpreadsheet import and exportAudit log of every change

Built to the standard
we help you meet

MFATOTP and passkeys, granular live-updating roles
Everychange recorded in the audit log: who, what and when
Checkeduploads: real file types, size limits, no zip bombs
YoursIndia-hosted workspaces, or self-host on your own cloud

Yours to run,
inspect and extend

The Community edition is the full platform, free to self-host with Docker on your own server or cloud. No feature gates, no user limits, no telemetry. Your auditors can even read the code.

Public source release is coming soon. Get notified.

Every feature
on every plan

Community

Free

self-hosted, forever

  • Every feature and framework
  • Unlimited users and controls
  • Docker setup in minutes
  • Community support
Self-host GRCWorks
Early access

Cloud

Free

during early access

  • Everything in Community
  • Backups, updates and HTTPS handled
  • Your own Trust Center page
  • Email support
Get early access

Cloud + Expert

Custom

platform + consulting

  • Everything in Cloud
  • Controls and policies loaded for you
  • Audit preparation and support
  • Dedicated GRC expert
Talk to us

See GRCWorks with your own controls

Get early access to GRCWorks Cloud, or book a demo and we'll walk you through it using your framework.

Get early accessBook a demo