Shipped, in progress, and planned
Where the platform stands today, what's partially wired, and what we intend to build next.
What's shippedand what's ahead
"Shipped" means it's live in the product today. "In progress" means it's partially wired and visible in the schema or UI. "Planned" means it's a direction we intend to build, with no committed date until we've actually shipped it.
Live in the product today.
Marketing site & public scanner
Homepage, product/solution pages, framework hubs, integrations directory, pricing estimator, and an ungated one-off website scanner at /scan.
Compliance & auditor workspace
Frameworks, controls, tests, and evidence, with a dedicated auditor workspace and audit-packet export.
Risk register
A 5×5 heat grid with treatment plans and residual scoring.
Access reviews
Campaign-based user access certifications with evidence export.
Vendor risk (TPRM)
Vendor tracking with SOC 2 report upload and parsing.
Security questionnaire automation
Upload a questionnaire, get RAG-drafted answers, then review and export.
Billing
Plan/entitlement management with Stripe checkout, customer portal, and webhook reconciliation.
Native integrations
120 native connectors in the dashboard's integrations surface (source control, cloud, identity, HR, security tooling, and more) plus a broader catalog of read-only connector templates for additional providers.
Trust center
A public per-tenant trust page with NDA-gated document sharing, managed from an admin trust-center workspace.
MCP server
An MCP endpoint (plus an API-tokens settings page) so AI clients can query a tenant's compliance data directly.
ChatGRC assistant
A RAG assistant over controls, evidence, policies, and risks.
Policy Guardian
Detects gaps between written policy and the evidence that backs it.
Findings inbox
A centralized inbox for findings across scans, controls, and integrations.
Exceptions register
Time-boxed waivers on controls, requirements, policies, and risks, with a mandatory expiry that forces re-review.
Reviews-due engine
A unified, overdue-first queue of every recurring review cycle across risks, policies, controls, vendors, access reviews, exceptions, and assets.
Privacy Operations module
RoPA register, data-flow register, DSR tracking with an SLA clock, and a DPIA workflow.
Bulk CSV import
Column-mapped CSV import with a dry-run preview for the risk register and vendor list, matched and re-imported by name/title.
Outgoing webhooks and CLI
HMAC-signed outgoing webhooks, plus a thin scriptable CLI over the same token-authed MCP server the dashboard uses.
Cross-framework mapping projection
Typed mappings between framework controls, seeded between SOC 2 and ISO 27001, with a read-only projection that suggests likely-satisfied controls in a target framework.
Obligations tracker and Meetings register
Jurisdictional legal/regulatory obligations tracked separately from framework controls, plus a governance meetings register for attendees, decisions, and action items.
Underway: surfacing before it's fully wired end-to-end.
Evidence integrity writer
Evidence records already carry provenance fields (collectedAt, sourceSystem, itemCount, contentHash), but computing contentHash/itemCount automatically from scanner and integration output is surfacing-only in the current release; the full writer wiring is the next step.
SAML and LDAP/AD sign-in
OIDC single sign-on and SCIM provisioning are shipped (see solutions pages). SAML's SP-initiated redirect works, but the signed-response callback and LDAP/Active Directory bind are still pending integration of a vetted crypto/LDAP library — not yet a complete setup flow.
A real direction we intend to build. No committed date.
Database-level tenant isolation (Postgres RLS)
Tenant isolation is enforced today at the query layer via session helpers. Adding Postgres row-level security policies keyed on orgId is a planned hardening step, not yet present.
Immutable, hash-chained audit log
An append-only audit log for signature, evidence, and config changes (with no-UPDATE/DELETE database grants) is a planned addition as the product app matures.
Continued connector coverage
The connector catalog keeps growing as we verify each provider's real, documented API surface. We add connectors deliberately, one verified integration at a time, rather than promising specific providers by name in advance.