One platform
for every audit
GRCWorks runs your whole compliance programme (controls, evidence, risks, vendors and audits) for SOC 2, ISO 27001 and privacy laws like GDPR, DPDP, PDPA and PDPL. Free to self-host. Built by GRC practitioners.
CC6.1Quarterly access reviewCC6.3Joiner / leaver checksCC7.2Vulnerability scanningCC8.1Change management logCC9.2Vendor risk reviewSpreadsheets don't
pass audits.
Shared drives, reminder emails and a year-end scramble. GRCWorks replaces all of it with one system your whole team can use, and your auditors will thank you for.
Map once.
Count everywhere.
Build one set of controls and map it to SOC 2, ISO 27001 and any privacy law: GDPR, DPDP, PDPA, PDPL and more. GRCWorks shows which frameworks every control counts towards, so one piece of evidence does the work of three.
- Import controls from Excel in minutes
- Coverage per framework, live
- Owners, frequency and status per control
Evidence
on autopilot.
Plan the audit year once. Owners get reminders when each month or quarter opens, reviewers approve as they go, and at year end you download a complete, indexed evidence package.
- Monthly, quarterly or annual evidence slots
- Weekly reminders, daily in the final week
- One-click evidence package for auditors
Vendor risk,
without the chase.
Send security questionnaires through a secure vendor portal. Vendors answer and upload files without an account, and you score, review and keep everything on record.
- Questionnaires from Excel templates
- Email-verified vendor portal
- Scores and evidence in one place
Turn security into
a sales asset.
Publish your certifications, policies and sub-processors on your own Trust Center. Customers request access, accept your NDA and view watermarked documents, with access that expires on its own.
- NDA before anything sensitive
- Per-customer, time-limited access
- Requests flow into your task list
Watch it.
Then do it.
GRCWorks Academy pairs every video lesson with your own practice company on the real platform. Learn how an auditor reviews evidence, then go and review it yourself.
- Your own practice organisation
- Map controls to frameworks
- Collect and review evidence
- Run a vendor assessment
- Run an audit year
- Publish a Trust Center
Six hands-on labs per course, automatic progress checks, and a certificate when you finish. Getting ready for a GRC job? Interview preparation is part of the Academy too.
Start free.
Stay free if you like.
Every plan includes every feature. Choose who runs the servers and whether you want an expert alongside.
Cloud
Free
during early access
Hosted GRCWorks in India-based data centres. We run it; you use it.
Get early accessCloud + Expert
Custom
platform + consulting
Hosted GRCWorks with a consultant who sets it up and runs it with you.
Talk to usPrefer an expert
alongside?
GRC practitioners set GRCWorks up for your company and take you through SOC 2, ISO 27001 or privacy-law readiness to a clean audit. You keep the platform and the know-how.
Questions
Is GRCWorks really free?
Yes. The Community edition is open source and free to self-host with every feature included. Cloud hosting is free during early access; paid plans will cover hosting, backups and support, never basic features.
Which frameworks and privacy laws does it support?
SOC 2, ISO 27001, ISO 27701, ISO 42001 (AI management), NIST CSF, PCI DSS, GDPR and India's DPDP Act come built in. Any other framework or privacy law, such as Singapore's PDPA, Saudi Arabia's PDPL or your own internal standard, can be added by importing its requirements. One set of controls can count towards all of them at once.
Where is our data stored?
GRCWorks Cloud runs in India-based data centres. With the Community edition, data stays wherever you host it.
Can I learn GRC on the platform?
Yes. GRCWorks Academy courses come with your own practice organisation, so you learn by mapping controls, collecting evidence and running audits on a real platform.
Do you also help implement it?
Yes. Our consultants can set GRCWorks up for you and take you through SOC 2, ISO 27001 or privacy-law readiness and audit. Certification audits themselves are done by independent auditors.
Run your next audit
on GRCWorks
Get early access to GRCWorks Cloud, free while in early access, or book a demo and we'll show you around with your own framework.