Skip to content
Certifyi
NewAI agent security assessments

GRC platform for security, privacy and AI governance

One control set for every framework you answer to.

Map each control once to SOC 2, ISO 27001, ISO 42001 and regional rules such as SAMA CSF, MAS TRM and APRA CPS 234. Its evidence, risks and sign-off stay on one record your auditor can follow.

Book a demo Take the free self-assessment
  1. 1.MapMap each control once, across every framework you run.
  2. 2.EvidenceAttach evidence and sign-off to the control it proves.
  3. 3.ProveGive auditors read-only access to the record they sample.

Certifyi is software for running your programme. Certificates and attestation reports come from independent auditors, not from Certifyi.

Integrations

Connect the tools you already run

View all integrations
  • Azure AD
  • Okta
  • Google Workspace
  • Auth0
  • OneLogin
  • JumpCloud
  • Duo Security
  • Ping Identity
  • SailPoint
  • CyberArk
  • BambooHR
  • Workday

The problem

Controls live in one tool, evidence in shared folders and sign-off in email, so every audit starts by rebuilding the record. Certifyi keeps the control, its evidence and the decision behind it in one place, so the record already exists when the auditor asks.

  1. Evidence is gathered for the audit, not as the work happens

    Screenshots and exports are collected in the weeks before fieldwork, so they describe a past state.

  2. The same control is answered once per framework

    An access review satisfies SOC 2, ISO 27001 and HIPAA, but it is documented three times in three places.

  3. Nobody can say who approved what, and when

    Sign-off lives in email threads and chat, which an auditor cannot sample.

An open-plan office with people at their desks
Most compliance work already happens. The gap is the record of it.

How it works

What the workspace does day to day

01 / 03

Map once. Reuse everywhere.

One control set covers every framework you adopt. Evidence and sign-off stay with the control, so one access review answers SOC 2, ISO 27001 and HIPAA.

  • Set applicability per control and keep your Statement of Applicability current
  • Each evidence item keeps its source, upload time and who attached it
  • Every action is written to a tamper-evident activity log
Explore frameworks and controls

Control library

Live control mapping

Show references for

Shared controls and the SOC 2 reference each one meets
ControlReference
User access reviewCC6.3
Security awareness trainingCC1.4
Risk assessmentCC3.2
Supplier assessmentCC9.2
Incident responseCC7.4
Change managementCC8.1
Encryption of stored dataCC6.1

SOC 2: 7 of 7 controls apply.

Common public references mapped to platform controls. HIPAA references are to 45 CFR Part 164. Your auditor confirms the final mapping for your scope.

02 / 03

Let AI draft the questionnaire.

When a customer sends a security questionnaire, AI drafts each answer from your controls and evidence. Drafts are suggestions until a person accepts them.

  • Drafts come from the controls and evidence you already keep
  • Drafted answers and mappings apply only when someone accepts them
Explore AskAI
Security questionnaire

Do you review user access at least quarterly?

Yes. System owners review every account and role each quarter, and leavers are removed. The Q3 review is signed off.

Draft. Nothing is applied until someone accepts it.

03 / 03

See what changed, and what it puts at risk.

Assets are checked against published vulnerabilities, and risks and incidents are tracked to an owner and a decision.

  • A risk register with likelihood, impact, treatment and owner, plus heatmaps
  • Assets matched against the NVD vulnerability database on a schedule
  • Incidents logged, triaged and tracked through to closure
Explore risk management
Risk and monitoring
  1. Critical
    Known vulnerability matched on payments-apiNVD match. Owner: Platform team
    2 min
  2. High
    Vendor risk re-scored after a breach noticeRisk register. Likelihood raised to 4
    1 h
  3. Medium
    Incident INC-214 triagedOwner assigned. Treatment due Friday
    3 h
  4. Low
    Asset added to the inventorylaptop-ops-07. No matches found
    5 h

How a control is evidenced

Every step leaves a record an auditor can follow

Take the user access review from the library above. Each stage records what happened, who did it and when, in the order it happened.

  1. Requirement

    SOC 2 CC6.3

    Access is granted, changed and removed by role, with least privilege.

    RecordedAlso mapped to ISO 27001 A.5.18 and HIPAA 164.308(a)(4)

  2. Control

    Quarterly user access review

    System owners confirm each account and role. Leavers are removed.

    RecordedOwner, frequency and the policy it implements

  3. Evidence

    Q3 review export

    142 accounts reviewed, 3 removed, each removal linked to its ticket.

    RecordedSource, upload time and who attached it

  4. Review

    Control owner sign-off

    Removals checked against the leavers list. Review accepted.

    RecordedReviewer’s name and the date: 14 Oct

  5. Audit

    Auditor samples the record

    Read-only access to this engagement. Findings are raised against the control.

    RecordedEvery action, in the tamper-evident activity log

Representative workflow based on the platform's evidence trail.

Who it helps

Built for the people who run the programme, and the people who check it

Each person works in the same record, with access scoped to their part of the job.

  • Security leaders

    One register for risks, vendors and controls across every framework you run.

    For CISOs

  • IT and engineering

    Evidence stays attached to the control it proves, and you can create Jira tickets from failing controls.

    For IT teams

  • Auditors

    Scoped, read-only access to one engagement’s evidence, with findings raised against the control.

    Auditor workspace

  • Suppliers

    Questionnaires answered in a vendor portal instead of over email.

    Supplier workspace

By company stage: Startups Mid-market Enterprise

Platform

One workspace for the whole programme

Compliance is the core. Risk, vendors, incidents and AI governance sit in the same workspace, under the same roles and the same activity log.

Run the programme

Manage risk

Prove and share

AI governance

Govern AI systems with the same rigour as information security

AI systems carry risks that security frameworks were not written for. Certifyi keeps them in the same workspace as your ISO 27001 and SOC 2 programme, built around ISO/IEC 42001.

  • AI system register

    Record each system, its purpose and owner, and classify its risk against EU AI Act categories.

  • AI impact assessments

    Structured assessments with findings tracked to resolution, beside the controls they affect.

  • AI suggestions stay proposals

    Drafted answers and mappings are applied only when a person accepts them.

Explore AI governance

AI system recordPlatform view

Customer support assistant

EU AI Act risk class
Limited risk
Owner
Support engineering
Impact assessment
Complete, 2 findings open
Mapped to
ISO/IEC 42001 controls

ISO/IEC 42001 certificates are issued by accredited certification bodies, not by Certifyi. EU AI Act conformity assessment is separate from ISO certification.

Frameworks

Frameworks in the catalogue

Adopt a framework, map your controls to it and track readiness. Each guide explains what the framework asks for and who assesses it.

Being in the catalogue means you can adopt the framework and map controls to it. It does not mean Certifyi certifies you against it. The catalogue is multi-framework and also includes NIST CSF 2.0, SAMA CSF, MAS TRM, APRA CPS 234 and the RBI framework.

Compare all frameworks

Your data

How Certifyi handles your workspace

Security teams ask how a GRC tool protects the evidence it holds. These are the parts of the answer we can show you in a demo.

A database for each customer

Your workspace has its own database, so your evidence never shares a table with another customer’s records.

Roles and multi-factor sign-in

Roles decide what each person can see and change. TOTP multi-factor authentication can be required by role.

Auditors see one engagement

Auditors are invited to a specific engagement with read-only access to its evidence, and nothing else in your workspace.

Read how we secure Certifyi

Questions

What buyers ask first

Not covered here? Ask a compliance lead.

Who is Certifyi for?

Security and compliance teams at startups, SaaS companies, mid-market firms and enterprise groups, including banks, insurers and healthcare organisations. It suits teams that run more than one framework, or answer to a regional regulator as well as SOC 2 or ISO 27001. Audit firms and suppliers get their own scoped workspaces.

Does Certifyi certify us?

No. Certifyi is software for running your programme. ISO certificates come from accredited certification bodies, and SOC 2 reports from independent CPA firms. Certifyi helps you prepare the evidence and controls they will test.

How long until we are audit-ready?

It depends on your starting point, your scope and how many frameworks you need. We will scope it with you on a call rather than promise a timeline before we know your controls.

Where is our data kept?

Each customer has their own database, not a shared table filtered by customer ID. Ask us about hosting location during your evaluation and we will tell you exactly where your workspace would run.

Can we turn off the AI features?

AI suggestions are proposals until a person accepts them. No AI decision is applied automatically. Ask us how AI is set up for your workspace.

Can auditors work inside Certifyi?

Auditors can be invited to a specific engagement with read-only access to its evidence. They can propose findings for you to accept or dispute. They do not see the rest of your workspace.

What frameworks are supported?

ISO 27001, SOC 2, ISO 42001, HIPAA, GDPR, PCI DSS, CMMC, Cyber Essentials, NIS2, DORA, ISO 22301, the EU AI Act and NIST CSF, plus regional rules such as SAMA CSF, MAS TRM, APRA CPS 234, Essential Eight and the UAE IA Standard. Being in the catalogue means you can adopt the framework and map controls to it. It does not mean Certifyi certifies you against it.

Next step

Bring one requirement. We will trace it with you.

Pick a requirement from the framework you are working on. In a walkthrough we follow it from control to evidence to sign-off, in your terms.

Book a demo Explore the platform