POPIA, vendor risk, and compliance your team and your AI agents can run
Core GRC helps South African organisations run POPIA compliance, third-party risk, cookie consent, privacy notices, and data subject requests from one workspace.
Monthly plans from R899 per module, excl. VAT.
ClaudeCompliance work is still spread across too many tools
Risk and privacy teams lose time stitching spreadsheets, inboxes, and folders. When someone asks for proof, the chase starts again.
- vendors_final_v7.xlsxVendor assessments in spreadsheets
- Re: Access request — status?Privacy requests in email threads
- Privacy notice (old).docxPolicy versions in shared drives
- Cookie banner · another toolConsent and accessibility elsewhere
With Core GRC
- One vendor and assessment workspace with Core IQ
- Privacy rights intake, verification, and reporting
- Policy and notice lifecycle with translations
- Consent banners and accessibility scans beside privacy work
Built for the work POPIA asks of you
Each module covers a part of the Protection of Personal Information Act, and they share one organisation, one set of permissions, and one document store.
Operators and vendors
Keep a register of operators and vendors, assess their security measures, and track the risks and issues they raise (sections 19 to 21).
Learn moreRecords of processing
Record purposes, data subjects, special personal information, retention, and cross-border transfers under section 72.
Learn moreData subject requests
Take in access, correction, and deletion requests (sections 23 and 24), verify the requester, and keep every deadline in view.
Learn morePrivacy notices
Publish privacy notices that tell data subjects what you collect and why (sections 17 and 18), with approvals and version history.
Learn moreCookie consent
Block tracking until visitors agree, honour their choices in Google Consent Mode, and keep a consent record for each one.
Learn moreWebsite accessibility
Scan your sites against WCAG, fix common issues with AutoFix, and publish an accessibility statement.
Learn more
Five modules. One workspace.
Subscribe to the modules you need. Each one shares the same organisation, permissions, and documents.
01
Privacy, Risk & Compliance Suite
Operators and vendors, assessments, records of processing, and Core IQ.
02
Cookie Consent Management
Cookie banners, scans, Consent Mode, and consent records for South African sites.
03
Privacy Policy & Notice Management
POPIA privacy notices and policies, approvals, versions, and the policy widget.
04
Privacy Rights Automation
Access, correction, and deletion requests with deadlines and workflows.
05
Website Accessibility
WCAG scans, AutoFix, the accessibility widget, and statements.
Work with agents. Keep the controls.
Claude, Claude Code, Cursor, and the CLI connect to Core GRC over MCP. They work inside the same rules as the rest of your team.
How agents work in Core GRCRuns as you
An agent works in the one organisation you chose, with your role's permissions. It only sees the modules your organisation has active.
Asks before it changes anything
Tools that update, publish, or archive are marked so the agent asks you first. Deletes and other high-impact actions also need an explicit confirm.
Agent changes are labeled
Changes made through the connector are saved with source mcp, and changes from the CLI with source cli, so you can tell them apart from work done in the app.
Signed in, not shared keys
Agents connect with OAuth, not a pasted secret. Access ends when your membership does, or if your organisation requires two-factor sign-in and you have not set it up.
How Core GRC works
Acme Ltd · Organization
Members
Modules
Security built for shared GRC work
Controls you can point to: single sign-on, two-factor sign-in, role-based access, and organisation isolation.
Read security detailsSingle sign-on
Google and Microsoft Entra ID sign-in, set up with our team for your domains or Entra tenant.
Two-factor sign-in
Organisations can require two-factor authentication before anyone opens the workspace.
Role-based access
Owner, admin, member, viewer, and custom roles, with view and manage permissions per module.
Tenant isolation
Every request checks organisation membership and module access, and data is scoped to the organisation.
Google Cloud hosting
Runs on Google Cloud through Firebase, with sensitive configuration in Secret Manager.
Program support for privacy laws
Workflows for GDPR, UK GDPR, POPIA, and CCPA privacy work, plus WCAG, Section 508, and EN 301 549 scans.
Questions teams ask
More answers in the FAQYes. Core IQ reviews apply POPIA when your organisation is based in South Africa, and the modules cover operator and vendor risk, records of processing, privacy notices, data subject requests, and cookie consent. POPIA compliance with Core GRC
South African rand, billed monthly. Prices on this site exclude VAT. See rand pricing
Claude on the web, desktop, and mobile, Claude Code, and Cursor connect through the Core GRC MCP connector. The coregrc CLI works from any terminal or script. Other MCP clients, including ChatGPT, can't connect yet. From your own code, use the API. Connect an AI tool
No. Every tool runs as you, in the organisation you chose when you connected, with the same permissions as the app. Tools that change data are marked so the agent asks first, and deletes and other high-impact actions also need an explicit confirm. Connector permissions
Changes made through the connector are saved with source mcp, and changes made with the CLI with source cli, so they can be told apart from changes made in the app.
No. Subscribe to the modules you need and add the rest later. They share one organisation, one set of permissions, and one document store, so nothing moves when you add a module. See pricing
Core GRC runs on Google Cloud through Firebase, with sensitive configuration in Secret Manager. Every request checks organisation membership and module access, and data is scoped to your organisation. It runs in the United States: talk to us if you need details for your cross-border transfer assessment under section 72 of POPIA. Security details
Ready to run POPIA and vendor risk in one place?
See the modules that match your programme in a short demo. Plans are billed monthly in rand, excluding VAT.