Privacy, Risk & Compliance Suite FAQ
Vendors, assessments, Core IQ, processing activities, and AI systems.
- Do vendors need a Core GRC account to answer an assessment?
- No. Respondents answer and upload evidence in the respondent portal without an account.
- Can vendors register themselves?
- Yes. Share the Onboard Hub registration link. You review each submission before it becomes a record.
- What is Core IQ?
- The AI inside the suite. It researches vendors, runs full reviews that propose register changes for you to confirm, and answers questions over your documents.
- Does Core IQ change my records on its own?
- No. It proposes changes, and you confirm each one before it is saved.
- Which privacy laws do reviews cover?
- Reviews apply the framework where you're based, including UK GDPR, EU GDPR and member-state laws, POPIA, LGPD, India's DPDPA, and Canadian, US, Australian, and Singapore law.
- Can I keep a record of processing?
- Yes. Processing activities record purposes, lawful bases, data subjects, transfers and safeguards, retention, and recipients, linked to the vendors and systems involved.
- Can I track AI systems?
- Yes. Inventory AI systems with their risk level, lifecycle stage, model, training data, bias assessment, and ethics review, and log AI incidents against them.
- How many users can I add?
- Up to 15 users on Standard and 25 on Professional. Enterprise has custom limits.
Ready to run risk and privacy in one place?
Book a walkthrough of the modules that match your program. Start with one, add more when you need them.