GRC platform for European SMEs and mid-sized companies
All your compliance, one platform
ISO 27001, GDPR, NIS2, ISO 9001, DORA, AI Act… OK-GRC links every requirement to shared controls: implement once, progress everywhere. And the AI assistant drafts while you decide.
- All 13 frameworks included in every plan
- Hosted in the EU
- No commitment
- frameworks included
- 13
- shared controls
- 353
- mappings between requirements and controls
- 3,099
- bilingual document templates
- 52
Why OK-GRC
Compliance that moves forward instead of piling up
Traditional tools handle each standard separately. OK-GRC starts from what you actually do, once, and links it to all your obligations.
One control, thirteen frameworks
353 shared controls linked to 13 frameworks. One tested backup moves ISO 27001, NIS2, DORA, HDS and SOC 2 forward at the same time.
An assistant that drafts, you decide
Policies, risk analyses, Statement of Applicability, answers to GDPR requests: the AI prepares drafts, nothing is saved without your approval.
Built for SMEs
A guided path, ready-to-use templates and clear tasks. No need to be an expert to get started, or to hire a full-time consultant.
European, sovereign, reversible
Hosting in the European Union, the AI of your choice (Claude or a local model), strict isolation between customers and a full export of your data at any time.
The leverage effect
Already ISO 27001? You have already come a long way.
Your existing controls already count for the other frameworks. Here is the starting score OK-GRC computes from the ISO 27001 controls alone:
NIS2: 52 to 72% from day one
Your ISO 27001 controls cover at least partly 27 to 28 of the 29 NIS2 requirements tracked. What remains is mostly registration with the authority and the incident reporting timeline.
GDPR: 19 to 41%
Security is in place; what remains are the personal data topics (lawful bases, information, rights, records), which OK-GRC supports.
- ANSSI hygiene guide55–97%
- NIS252–72%
- ISO 2230161–71%
- SOC 247–71%
- DORA48–68%
- ISO 2770149–65%
- HDS38–54%
- ISO 900148–53%
- ISO 4200137–42%
- GDPR19–41%
- ISO/IEC 1702526–29%
- AI Act14–17%
Method: score projected with OK-GRC’s scoring rule from the catalogue mappings, between a strict hypothesis (controls linked to ISO 27001 with full coverage) and a broad one (every linked control). This is neither a compliance rate nor legal advice.
Your whole management system
Every module talks to the others
A risk triggers a control, the control expects evidence, the evidence feeds the audit, the audit feeds the management review. Everything is linked, everything is traced.
- Frameworks and Statement of Applicability13 frameworks linked to 353 shared controls, scores per standard and an exportable SoA.
- Programme managementYour certification or accreditation project: phases, milestones, checked deliverables and steering committees.
- Risks and assetsInventory, 5 × 5 matrix, treatment plans and signed acceptance.
- Documents and policies52 bilingual templates, versions, approval and read acknowledgements.
- EvidenceFiles, links and texts linked to controls, with expiry reminders.
- Action plan and tasksAssigned tasks, due dates, kanban and calendar, automatic reminders.
- GDPRArt. 30 records, DPIA, data subject requests and personal data breaches.
- IncidentsTimeline, computed NIS2 and GDPR deadlines, lessons learned.
- Vendors and third partiesCriticality, questionnaires, DPA, transfers and DORA register.
- Audits and management reviewAudit programme, findings, corrective actions and management review.
- Training and awarenessCampaigns, ready-made modules, quizzes and certificates.
- AI assistantDrafts of policies, risks, SoA and answers: you approve.
- Dashboards and reportsScores, trends, PDF reports and XLSX exports for management.
- Multi-company and consultantsPortfolio view, subsidiaries and revocable partner access.
AI assistant
An AI that knows your management system
The assistant relies on your frameworks, controls and documents to suggest useful drafts, in French or English.
- Drafts your policies and procedures from our templates and your context
- Suggests risks, controls and a prioritised action plan
- Pre-fills the Statement of Applicability and its justifications
- Analyses a document or a piece of evidence against the requirements
- Prepares answers to GDPR requests and the management review minutes
Your AI, your choice
Claude (Anthropic) in the cloud, or a sovereign model hosted by OK-GRC: no text then leaves for a third-party AI provider. On the Enterprise plan, plug in your own endpoint.
Always a draft
Every AI suggestion is a draft you review, edit and approve. Nothing is saved automatically.
AI credits included in every plan, with no surprise on the invoice.
How it works
Up and running in a day
- 1
Describe your company
Sector, size, activities: the assistant suggests the frameworks that apply to you and your first priorities.
- 2
Roll out controls and documents
Assigned tasks, ready-to-use templates, linked evidence: your score rises on every framework at once.
- 3
Steer and pass the audit
Implementation programme with phases and milestones, dashboards, management review, evidence pack and read-only access for your auditor.
- Hosting in the European Union (IONOS)
- Strict isolation between customers at database level
- Encryption in transit and at rest
- Two-factor authentication, passkeys, SAML/OIDC SSO
- Tamper-proof activity log
- Full export and reversibility at any time
Consultants, outsourced DPOs, integrators
Steer all your clients from a portfolio view, with access granted by each client, limited and revocable. 25 to 35% discounts and a free demo workspace.
Testimonials
What our first customers say
Fictitious examples pending real testimonials — to be replaced before going live.
We had to get ISO 27001 and prepare NIS2 at the same time. With shared controls, we only did the work once.
First LastCISO, SaaS vendor (example)Fictitious example The GDPR records and data subject requests are finally in the same place as security. Our outsourced DPO logs in directly.
First LastHead of administration, manufacturing SME (example)Fictitious example I follow about fifteen clients from the portfolio view. The assistant saves me hours on policies.
First LastIndependent GRC consultant (example)Fictitious example
Frequently asked questions
Does OK-GRC make us compliant or certified?
OK-GRC is a tool: it helps you implement, document and prove your controls. Compliance depends on what your organisation actually does, and only a certificate issued by an accredited body is a certification.
Which frameworks are included?
The 13 frameworks of the catalogue — ISO 27001, GDPR, NIS2, ISO 9001, ISO/IEC 17025, ISO 27701, ISO 22301, SOC 2, DORA, HDS, the ANSSI hygiene guide, ISO 42001 and the AI Act — are included in every plan at no extra cost.
How long does it take to get started?
A few minutes to create your workspace and choose your frameworks. Most teams have their first tasks, policies and risks in place within a day.
Where is our data hosted?
In the European Union, with IONOS. Each customer’s data is isolated at database level and you can export it at any time.
Is our data used to train the AI?
No. You choose the provider (Anthropic’s Claude or a model hosted by OK-GRC) and can turn the AI off. Exchanges are only used to produce the drafts you request.
Can we work with our consultant?
Yes. You grant your firm limited, time-boxed and revocable access. Its consultants are not billed as users and every action they take is traced.
How does the free trial work?
14 days with the Pro features. A card is required, but nothing is charged before the trial ends, and you can cancel at any time from the application.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment