About
Why we built Certifyi
Certifyi is a governance, risk and compliance platform. We built it for teams who run their compliance programme in spreadsheets and shared drives and have outgrown them.
Why we exist
Compliance work reaches every team, product and supplier. Most organisations still track it in spreadsheets, shared drives and email. We built Certifyi so that controls, evidence, risks and vendors sit in one workspace that an auditor can be given access to.
The problem
Where spreadsheets stop working
Spreadsheets are fine for one framework and one entity. They get hard to manage once you have several frameworks, a few legal entities, dozens of vendors and an audit calendar to keep to.
The same control gets copied into a different sheet for each framework. Evidence ends up in folders that nobody can trace back to a control. Before each audit, someone spends weeks putting it all together again.
What we believe
How we think GRC software should work
These ideas shape what we build. Each one is something you can see in the product today.
- Map a control once
- If a control meets ISO 27001 and another framework too, nobody should have to write it up twice. In Certifyi you map a control once and each framework that needs it reuses the mapping.
- Records should show their history
- Screenshots and exported files can be changed without anyone knowing. In Certifyi every action goes to a tamper-evident activity log, where a later edit can be detected.
- Keep customers apart
- Each customer’s workspace has its own database, so your records are not stored in a database shared with another organisation.
- Look after our own security
- We keep a register of every security finding until it is fixed, and no change to our code ships without a multi-stage review that includes security.
- Give auditors their own access
- External auditors should not have to dig through your shared drives. They get scoped, read-only access to the evidence for their engagement.
What the platform covers
Each module has its own page with more detail.
-
Compliance and audit
Framework catalogue, control mapping, evidence, auditor access and management reviews.
-
Risk management
Risk register with likelihood, impact, treatment and owner, plus heatmaps.
-
Vendor risk
Vendor register, risk assessments, a portal for your vendors, and DORA ICT register export as xBRL-CSV.
-
Incident management
Incident lifecycle, triage and tracking through to closure.
-
AI governance
AI system register with EU AI Act risk class, and AI impact assessments.
-
Privacy management
Cookie consent, and how privacy work fits with the rest of your programme.
-
Business continuity
Business impact analysis with recovery time and recovery point objectives.
-
Security operations
Your assets, and known vulnerabilities matched to them from the NVD.
-
Trust centre
How a public trust page can show your customers how your security programme runs.
Organisations our team has helped secure
Vulnerabilities found and reported by members of the Certifyi team under responsible-disclosure and bug bounty programmes.
Names and logos indicate prior security research engagements by members of our team under each organisation’s disclosure programme, not customer relationships.
Credentials held by the Certifyi team
The certifications we help customers earn are ones our own team holds.
-
Certified Ethical Hacker (CEH)EC-Council
-
ISO/IEC 42001:2023 Lead AuditorAI management systems
-
ISO/IEC 27001 Information Security AssociateInformation security
-
Certified in Cybersecurity (CC)ISC2
-
AWS Certified Cloud PractitionerAmazon Web Services
-
Vulnerability Management Detection and ResponseQualys
-
Network Security AssociateFortinet
-
Splunk User Behavior AnalyticsSplunk
-
Browser Security WorkshopWeb security
Questions
About Certifyi
Where is my data stored?
Each customer’s workspace has its own database, and your data region is set for your workspace. Ask us about hosting location during your evaluation and we will tell you exactly where your workspace would run.
How does Certifyi run its own security?
Every security finding stays on a register until it is fixed, and code changes go through several review stages, one of them security. Our security page sets out where our own programme stands.
How is Certifyi different from other GRC platforms?
Three things you can check in a demo: each customer has its own database, every record sits on a tamper-evident activity log, and auditors get scoped, read-only access to their engagement. See the platform overview for the full feature set.
What is the product roadmap?
We release changes regularly, each one reviewed in stages with security among them. Tell us what you need during your evaluation or through your account contact, and we will tell you where it sits on the roadmap.
See how it would work for your team
Book a demo with your current spreadsheet or tool open. We go through the same work in Certifyi, control by control, so you can judge the difference for yourself.