Platform modules
Every Certifyi module, in one compliance workspace
Each module runs on the same codebase, under the same permissions and in the same interface. That is what lets a control map to its frameworks, carry its evidence and link to the risks and assets it relates to.
One platform
Every module was built on one codebase rather than bought in. Within your workspace they share one permission model and one interface, so a control, a risk and an asset can be linked to each other.
Compliance and governance
The core of the platform: frameworks, controls, evidence, risk and audit.
- Compliance and audit
- Frameworks from the catalogue on one control set, each control mapped once across all of them, evidence on the control, and a scoped portal for your auditor.
- Risk management
- Each risk recorded with likelihood, impact, treatment and owner, and shown on heatmaps.
- Policy management
- Draft, approve and publish policies, and track who has acknowledged them. Every version is kept, with a full audit trail.
- Continuous monitoring
- Which controls have evidence behind them, and which are still missing it.
- Reporting and audit trail
- Every action is logged with the user, the time and the context.
- Security awareness training
- Assign training, track completion and link training records to personnel security requirements.
Operations
IT operations and security
Assets, vulnerabilities, incidents and business continuity, each linked to the compliance controls they affect.
- Asset management. An asset register with lifecycle and classification, linked to controls.
- Vulnerability management. CVE tracking against the NVD, with CVSS scoring and CPE matching.
- Incident management. Incidents logged and triaged, each with an owner and a status until it is closed.
- Business continuity. Business impact analysis and continuity planning, beside your risks and assets.
- Change management. Submit, review, approve and track changes, each with an impact assessment.
- Patch management. Patch evidence kept on the control it supports, under the tamper-evident activity log.
Governance
AI governance, privacy and personnel
Modules for AI systems, personal data and personnel security, each built around the standards that apply to it.
- AI governance. Register AI systems and classify their risk against ISO 42001 and the EU AI Act.
- Privacy management. Records of processing, data subject requests, consent records and cookie consent.
- Personnel security. Onboarding, access reviews, professional certifications and structured offboarding.
- Vendor risk. The full vendor lifecycle, with a dedicated vendor portal, questionnaires and the DORA ICT register.
Ecosystem
Trust, integrations and external access
Share your compliance posture publicly, connect the tools you already run, and give auditors and vendors their own workspace.
- Trust centre. A public page with the status of the controls you choose to publish, your policies and your sub-processors.
- Integration hub. Connectors for cloud providers, identity, code and endpoints.
- Security questionnaires. AI drafts answers to customer questionnaires from your control library, for you to review.
- Attack surface management. Assets in your inventory matched against the NVD, with each finding tracked as a risk.
Questions
Platform questions
Are all modules included?
On the Growth and Enterprise plans, yes. The Startup plan covers the core compliance and audit modules. See pricing for what each plan includes.
Can I start with just one module?
Yes. Most teams start with compliance and audit, then add risk, vendor management and other modules as the programme matures. Because everything is in one workspace, adding a module does not mean buying or integrating another tool.
How do modules connect?
Because they share one workspace, a record in one module can be linked to records in another. Take a control: it maps to its frameworks and carries its evidence, and you can link it to the risks it treats and the assets it covers.
See the modules your programme would use
Book a demo and tell us which parts of your programme live in other tools today. We start from those modules and trace each one back to your controls.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them