Security built for shared GRC work
Controls you can point to: single sign-on, two-factor sign-in, role-based access, and organization isolation.
- Google and Microsoft
- SSO
- Required by your organization
- MFA
- Workspace per organization
- Isolated
Controls you can point to
We describe the controls in the product today. We do not claim third-party certifications we have not completed.
Single sign-on
Google and Microsoft Entra ID sign-in, set up with our team and limited to your domains or your Entra tenant.
Two-factor sign-in
Organizations can require two-factor authentication. Members who haven't set it up can't open the workspace.
Role-based access
Owner, admin, member, and viewer roles, plus custom roles, with view and manage permissions for each module.
Learn moreTenant isolation
Every request checks organization membership and module access, and data is scoped to the organization.
Change history
Published policy versions, scan history, and consent records are kept. Changes made through MCP or the CLI are labelled with their source.
Scoped API keys
Read-only or read-and-write keys that expire after 30 days, 90 days, or a year, and can be revoked at any time.
Learn moreGoogle Cloud hosting
Runs on Google Cloud through Firebase in the United States, with sensitive configuration in Secret Manager.
Safe AI actions
MCP clients act with your permissions, ask before changing data, and need an explicit confirm for deletes and publishing.
Learn more
Program support
Product workflows support these programs. They are not certifications.
GDPR and UK GDPR
Privacy requests, processing records, and notices.
POPIA
Processing records and data subject requests.
CCPA and CPRA
Consumer requests, consent, and Global Privacy Control.
WCAG, Section 508, EN 301 549
Accessibility scans and statements.
AI governance
AI system inventory and AI incidents in the risk suite.
Ready to run risk and privacy in one place?
See the modules that match your program in a short demo. Start with one, add more when you need them.