Skip to content
Certifyi

Platform

The GRC platform for compliance, risk, vendors and AI governance

Compliance is the core: frameworks, controls and the evidence behind them. Risk, vendors, incidents and AI governance sit in the same workspace, under the same roles and the same activity log.

Book a demo See all modules

What Certifyi replaces

Most programmes run on a controls spreadsheet, a shared folder the auditor has to dig through, vendor questionnaires sent by email, and separate tools for risk, privacy, incidents and business continuity that do not share data. Certifyi brings these into one workspace, where a control, a risk and an asset can be linked to each other.

Why teams switch to Certifyi

Compliance programmes built on disconnected tools create more work than they save.

Duplicate effort
The same control gets entered once for each framework, and the same evidence is uploaded to more than one folder. Risks are written up in a spreadsheet and again in a ticket.
Audit scramble
When the auditor asks about a control, the team searches email, Confluence, Google Drive and Jira. The evidence is scattered because the tools are.
Vendor tracking
Questionnaires go back and forth by email. SOC reports sit in a spreadsheet, and someone has to remember to check when each one expires.
No single view
Asked where the programme stands on ISO 27001, the CISO has to ask three people and wait two days for an answer.

What the platform covers

Every module is built on one codebase. The main ones are below, and the modules page lists the rest.

Compliance and audit
Adopt frameworks, map each control once across all of them, attach evidence to controls, and give your auditor a scoped portal.
Risk management
A risk register with likelihood, impact, treatment and owner, plus heatmaps.
AI governance
Register AI systems, classify their risk against EU AI Act categories, and run AI impact assessments.
Vendor risk
The full vendor lifecycle, with a dedicated vendor portal, questionnaires and the DORA ICT register.
Incident management
Log an incident, triage it and track it until it is closed.
Business continuity
Business impact analysis and continuity planning, in the same workspace as your risks and assets.
Privacy management
Records of processing, data subject requests, consent records and cookie consent.
Asset management
An asset register linked to vulnerabilities and change control.
Trust centre
A public page showing the status of the controls you choose to publish, with your policies and sub-processors.

Evidence

Evidence kept with the control it supports

A screenshot or an exported CSV shows how a control looked on the day it was captured, and nothing about what happened to it afterwards. In Certifyi the evidence stays attached to the control it supports, and every change to it goes into a tamper-evident activity log.

Each log entry is tied to the one before it by a hash, so an edit made after the fact breaks the chain and can be detected. That shows a record has not been changed. It does not show that the evidence was accurate in the first place.

  • Evidence on the control. Each item sits with the control it supports, not in a shared folder.
  • Tamper-evident activity log. Every change to a record is logged and chained to the entry before it.
  • Auditor view. Auditors review the evidence beside its control, with the history from the activity log.

Controls

Map a control once and reuse it across frameworks

The common control set is what keeps several frameworks manageable. One access control can map to ISO 27001, SOC 2 CC6.1 and NIST 800-53 AC-2 at the same time, and the mapping is reused in each of them.

  • Common control set. One set of controls shared by all your frameworks.
  • Statement of Applicability. Applicability is set per control.
  • Jira tickets. Create Jira tickets from failing controls.

Explore the platform

These modules share one workspace, so a control, a risk and an asset can be linked to each other.

The compliance workflow

From a framework’s requirements to the evidence your auditor reviews.

  1. 01

    Adopt a framework

    Select it from the catalogue, review the controls and set applicability per control.

  2. 02

    Connect evidence sources

    Connect your cloud, identity and endpoint tools and attach their evidence to controls. We confirm which connectors fit your stack before you plan around them.

  3. 03

    Map controls

    Each control maps to every framework it satisfies, so its evidence is collected once.

  4. 04

    Present to auditors

    External auditors get their own scoped portal. Each piece of evidence opens beside its control, and the tamper-evident activity log shows what has happened to it since it was added.

Questions

Platform questions

Is Certifyi a single product or a suite of tools?

A single product. Every module is built on one codebase, with shared data, shared permissions and one interface. None of the modules came from an acquisition.

How is tenant data isolated?

Every customer gets a dedicated database, rather than rows filtered by customer in a shared one. Each customer also runs in its own workspace, and the data region is set for that workspace.

What frameworks does Certifyi support?

The catalogue includes ISO 27001, ISO 42001, SOC 2, GDPR, HIPAA, PCI DSS, NIST CSF, NIS 2, DORA, CMMC and NIST 800-53, along with regional standards. We publish new frameworks centrally to every workspace. The frameworks page has the detail.

How does evidence collection work?

Connectors bring evidence from cloud, identity and endpoint tools into the record beside the controls it supports. Ask us which connectors are available for your stack. Once evidence is in, any change to it is recorded in the tamper-evident activity log.

Can auditors access Certifyi directly?

Yes. External auditors get a scoped, time-limited, read-only portal. They see the evidence and controls for their engagement and can propose findings from there.

See Certifyi with your own frameworks

Book a demo and tell us the frameworks you report against and the tools your team uses today. The walkthrough is built around them, from the first control mapping to the evidence an auditor would review.

Book a demo Take the free self-assessment
  • Each customer workspace has its own database
  • Every change written to a tamper-evident activity log
  • Auditors get scoped, read-only access
  • AI suggestions wait for a person to accept them
Scroll to Top