Your ISO management systems, end-to-end.
A purpose-built SaaS platform to implement, operate and continually improve management systems based on international standards: information security, privacy, business continuity, quality, environment, occupational health and safety, energy, and the frameworks your organisation adopts. Governance, risk, operations and access, integrated under one roof.
Four pillars, one integrated management system.
From governance to operations, every aspect of your management systems is connected, coherent and secure, whatever the standards you work with.
Governance & Compliance
Build and maintain your management systems on the structure common to ISO standards, with the full governance framework.
- Several standards side by side: ISO 27001, ISO 27701, ISO 22301, ISO 9001, ISO 14001, ISO 45001 and ISO 50001, with shared context, documents, risks, audits and improvement actions
- Regulations & frameworks: NIS2, DORA, the Cyber Resilience Act, PCI DSS and SWIFT CSCF on the same core as the standards, with room for the others your organisation adopts
- Requirements & Controls: The clauses and controls of each standard and framework, applicability decided and justified, automatic Statement of Applicability where the standard calls for one
- Policies & Procedures: Full version history, review and approval, reading confirmations
- Compliance Requirements: Register of the legal, regulatory and contractual requirements identified by the organisation
- Context of the Organisation: Internal / external issues, interested parties, scope
- Management system documents: Scope and system descriptions, internal audit programme, roles and responsibilities, written and approved in the platform
- Objectives & KPIs: Clauses 6.2 and 9.1, measurement tracking and thresholds
Risk & Assurance
Understand and treat risks and opportunities, respond to incidents, audit and verify controls, and keep exceptions under control.
- Risks & Opportunities: Register, assessments against criteria set by the organisation, treatment plans linked to the controls of each standard, management approval
- Incident Management: Occurrences of any kind reported by anyone, response playbooks, preparation of the notifications required by the regulations and frameworks that apply, post-incident reviews
- Audit Management: Audit programme across every standard, findings followed to closure, corrective actions
- Security Reviews: One questionnaire for acquired applications, software development and projects
- Exceptions: Approval workflow for any documented exception, whether to a security, quality, environmental or any other requirement, with accountability and scheduled review
Operations
Run your management systems day-to-day: change, third parties, continuity, processes, projects, assets and personal data.
- Change Management: Normal, standard and emergency changes, advisory board, post-implementation review
- Third-Party Management: Criteria-based segmentation, assessments, self-assessment
- Business Continuity (BCM & BIA): Business impact analysis, recovery planning and continuity strategies
- Process Management: Capture, organise and govern the processes that run your organisation
- Projects: Milestones, Gantt, reviews against the requirements that apply to each project, security by design included
- Asset Management: Register, categorisation, classification and lifecycle
- Privacy & GDPR: Records of processing, impact assessments, personal data breaches and data subject requests
People & Access
Control who can do what, from onboarding to access certification.
- Users & Roles: Organise your team by department, position and management system role
- Joiners, Movers & Leavers: Keep access and responsibilities aligned as people enter, change or leave
- Access Management: Access requests and approvals, a register of who has access to what, certification campaigns
- Segregation of Duties: Incompatible combinations defined once and checked at every step
- Training & Awareness: Courses, videos, tests and certificates
- Permission Model: Precise control over what each user can see and do
Serious about your security. Serious about ours.
Managing your security is serious business. So is protecting the platform you use to do it. We treat both the same way.
Your data, protected
- Strong encryption while data travels and while it is stored
- Your data never mixes with another customer's
- No third-party trackers, no data shared outside the platform
Built by security practitioners
- Designed and maintained by people who do risk, audit and compliance every day
- Security decisions made with your auditor in mind
- Practices reviewed and updated as the landscape evolves
- Regular backups and platform monitoring in place
Ready for audit, any time
- Every action recorded with who, what and when
- Records designed to meet the expectations of certification audits
- Evidence export in a few clicks
- Complete history preserved and never altered
Built for the standards, not adapted to them.
Native to ISO standards
Built on clauses 4 to 10, the structure common to ISO management system standards. No translation layers, no retrofitting: every standard or framework you add runs on the same core.
Dedicated for each customer
Each organisation runs in its own fully isolated environment. Your data never shares space with anyone else's.
Complete audit trail
Every action logged with actor, timestamp and context, as automated evidence for every audit.
Multi-language
Available today in English and Portuguese. Additional languages can be configured for specific deployments.
Works on any device
Dashboards, forms and reports adapt to the device you're using: desktop, tablet or phone.
Access, strictly controlled
Permissions aren't just visual: they're strictly enforced behind the scenes. Users can only do what their role allows.
Configurable to your organisation
Adjust dashboards, menus, workflows and permissions to match how your team actually works.
Alerts when it matters
Automatic reminders for reviews, approvals, deadlines and threshold breaches, straight to your inbox.