Privacy, risk, and compliance your team and your AI agents can run
Core GRC connects third-party risk, privacy operations, consent, and accessibility so your team can find owners, evidence, and deadlines in one place.
ClaudeCompliance work is still spread across too many tools
Risk and privacy teams lose time stitching spreadsheets, inboxes, and folders. When someone asks for proof, the chase starts again.
- vendors_final_v7.xlsxVendor assessments in spreadsheets
- Re: Access request — status?Privacy requests in email threads
- Privacy notice (old).docxPolicy versions in shared drives
- Cookie banner · another toolConsent and accessibility elsewhere
With Core GRC
- One vendor and assessment workspace with Core IQ
- Privacy rights intake, verification, and reporting
- Policy and notice lifecycle with translations
- Consent banners and accessibility scans beside privacy work
Five modules. One workspace.
Subscribe to the modules you need. Each one shares the same organization, permissions, and documents.
01
Privacy, Risk & Compliance Suite
Vendors, assessments, data mapping, AI governance, and Core IQ.
02
Cookie Consent Management
Banners, cookie scans, Consent Mode, and consent records.
03
Privacy Policy & Notice Management
Policies, notices, approvals, translations, and geo publishing.
04
Privacy Rights Automation
Request intake, verification, automations, and deadlines.
05
Website Accessibility
Scans, AutoFix, the accessibility widget, and statements.
Work with agents. Keep the controls.
Claude, Claude Code, Cursor, and the CLI connect to Core GRC over MCP. They work inside the same rules as the rest of your team.
How agents work in Core GRCRuns as you
An agent works in the one organization you chose, with your role's permissions. It only sees the modules your organization has active.
Asks before it changes anything
Tools that update, publish, or archive are marked so the agent asks you first. Deletes and other high-impact actions also need an explicit confirm.
Agent changes are labeled
Changes made through the connector are saved with source mcp, and changes from the CLI with source cli, so you can tell them apart from work done in the app.
Signed in, not shared keys
Agents connect with OAuth, not a pasted secret. Access ends when your membership does, or if your organization requires two-factor sign-in and you have not set it up.
How Core GRC works
Acme Ltd · Organization
Members
Modules
Security built for shared GRC work
Controls you can point to: single sign-on, two-factor sign-in, role-based access, and organization isolation.
Read security detailsSingle sign-on
Google and Microsoft Entra ID sign-in, set up with our team for your domains or Entra tenant.
Two-factor sign-in
Organizations can require two-factor authentication before anyone opens the workspace.
Role-based access
Owner, admin, member, viewer, and custom roles, with view and manage permissions per module.
Tenant isolation
Every request checks organization membership and module access, and data is scoped to the organization.
Google Cloud hosting
Runs on Google Cloud through Firebase, with sensitive configuration in Secret Manager.
Program support for privacy laws
Workflows for GDPR, UK GDPR, POPIA, and CCPA privacy work, plus WCAG, Section 508, and EN 301 549 scans.
Questions teams ask
More answers in the FAQClaude on the web, desktop, and mobile, Claude Code, and Cursor connect through the Core GRC MCP connector. The coregrc CLI works from any terminal or script. Other MCP clients, including ChatGPT, can't connect yet. From your own code, use the API. Connect an AI tool
No. Every tool runs as you, in the organization you chose when you connected, with the same permissions as the app. Tools that change data are marked so the agent asks first, and deletes and other high-impact actions also need an explicit confirm. Connector permissions
Changes made through the connector are saved with source mcp, and changes made with the CLI with source cli, so they can be told apart from changes made in the app.
No. Subscribe to the modules you need and add the rest later. They share one organization, one set of permissions, and one document store, so nothing moves when you add a module. See pricing
Core GRC runs on Google Cloud through Firebase, with sensitive configuration in Secret Manager. Every request checks organization membership and module access, and data is scoped to your organization. Security details
Workflows for GDPR, UK GDPR, POPIA, and CCPA privacy work, plus WCAG, Section 508, and EN 301 549 accessibility scans.
Ready to run risk and privacy in one place?
See the modules that match your program in a short demo. Start with one, add more when you need them.