For enterprise
One GRC workspace for groups with many entities
You answer to overlapping regulations in several jurisdictions, manage hundreds of vendors, sit through several audits a year and have rules on where data may be held. In Certifyi the group works from one control set, with compliance, risk, vendors, incidents and privacy together in a workspace of your own that has its own database.
In short
At enterprise scale, controls, risks, vendors and incidents often sit in separate tools, and someone has to reconcile them before every audit and board meeting. With all of them in one workspace there is far less to reconcile. Each customer’s workspace has its own database, so your group’s records are not kept in a database shared with other customers.
What changes at enterprise scale
Adopting a framework is the easy part. The hard part is running overlapping regulations across entities, jurisdictions and hundreds of third parties.
- Regulatory overlap
- GDPR in Europe, HIPAA in the US, DORA for financial services and NIS 2 for critical infrastructure. Each one adds controls, and some of them conflict.
- Several entities
- A holding company needs shared controls with exceptions for each entity. Subsidiaries may have their own frameworks and audit cycles.
- Vendors at scale
- Hundreds of vendors, each with its own risk profile, contract terms and certification status. Reassessments alone can fill someone’s week.
- Audit fatigue
- Several frameworks mean several audits a year, and each auditor needs scoped access to a different set of evidence.
What you get
Three parts of the platform that matter most when you run GRC across a group.
- Database per customer
- Every customer gets their own dedicated database, rather than row-level filtering on a shared one.
- Legal entity hierarchy
- Shared and entity-specific controls, so a holding company and its subsidiaries are managed from one workspace.
- DORA ICT register
- The ICT third-party register financial entities must keep, exported as xBRL-CSV for regulatory reporting.
Platform architecture
Separate databases and a set data region
In a shared multi-tenant database, every customer’s records sit in the same place and are kept apart by row-level filters. A misconfigured query, a permissions bug or a SQL injection can then expose one customer’s data to another.
Certifyi gives every customer a dedicated database, so there is no shared filter to get wrong. Your data region is set for your workspace.
- Dedicated database. One per customer, with no row-level filtering on shared tables.
- Own workspace. Each customer runs in a workspace of its own.
- Reviewed code. Each change to our code goes through a multi-stage review, and security is one of the stages.
Integrations
Connect the tools you already run
Certifyi connects to your cloud providers, identity systems, code repositories, endpoint and security tools and ticketing, and attaches the evidence to the controls it proves.
Role-based access control and TOTP multi-factor authentication are built in. Ask us about single sign-on and provisioning for your identity provider during your evaluation.
- Cloud. AWS and Azure configuration and security findings.
- Identity and access. Auth0 and Duo users and access evidence.
- Code. Bitbucket branch protections and change evidence.
- Endpoint and security. CrowdStrike, Jamf and Microsoft Defender coverage and findings.
- Ticketing. Create Jira tickets from failing controls.
Recommended modules
Every module is available, including compliance, risk, vendors, incidents, privacy, AI governance and business continuity.
How an enterprise rollout runs
A structured rollout for organisations with complex compliance requirements.
-
01
Architecture review
Agree your data region, how your people will sign in and your entity structure. We then set up your workspace and its database.
-
02
Framework adoption
Adopt frameworks for each entity. Common controls map across jurisdictions, and the gap analysis shows what each regime still needs.
-
03
Integration and evidence
Connect your tools and attach their evidence to the controls it proves.
-
04
Scale and govern
Roll out vendor risk, incident management, privacy and AI governance.
Questions
Enterprise questions
How is data kept separate between customers?
Each customer has a dedicated database and runs in its own workspace. Separation does not depend on a row-level filter in a shared database.
Where is our data held?
Your data region is set for your workspace. We will confirm the hosting location during your evaluation.
How does multi-entity governance work?
Certifyi supports legal entity hierarchies. A holding company can keep shared controls and policies while subsidiaries run their own frameworks and audit cycles, and reporting can be combined across entities.
Does Certifyi support DORA and NIS 2?
Yes. Both frameworks are in the catalogue, and the DORA ICT third-party register exports as xBRL-CSV.
What SSO and provisioning do you support?
Multi-factor authentication with TOTP, which can be required by role. Ask us about SAML single sign-on, SCIM provisioning and hardware keys for your identity provider during your evaluation.
See how Certifyi would fit your group structure.
Book a demo and tell us how the group is put together: the holding company, the subsidiaries and the regulators each one answers to. You will see shared controls set once at group level, entity frameworks beside them, and a workspace with its own database.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them