Compliance teams rarely fail for lack of frameworks. They fail because the work is scattered: policies in one place, risks in another, evidence in someone’s inbox, and audit findings that never quite close.
This is the GRC platform we built to fix that. Django API, Vue 3 front end, multi-tenant, proper roles, and a full activity trail. Teams adopt frameworks once and map requirements across standards without duplicating controls. Evidence collectors can run on a schedule. Day-to-day work lands in My GRC Work: one inbox instead of chase-threads. Each major module has its own dashboard; records include clear next-step guidance. Auditors can run structured engagements with scoped controls and scoring. Asset Discovery v1 feeds the inventory through a review gate rather than writing the CMDB automatically. A Co-Pilot sits inside the workspaces it understands, grounded in live org data and constrained so it does not invent control codes.
“One control implementation per organisation, mapped across every adopted framework.”
“My GRC Work: one inbox for tasks, approvals, control implementations and findings.”
“Discover first. Review before import. Enrich with evidence.”
The problem
Before a platform like this, most teams lean on spreadsheets, shared drives and email. Fine until the second framework or the first serious audit.
| Area | Problem | Impact |
|---|---|---|
| Governance | Policies, controls, and frameworks tracked in separate documents | Inconsistent interpretation; weak accountability |
| Risk management | Risk registers disconnected from controls and incidents | Poor prioritisation; hard to defend acceptance decisions |
| Compliance tracking | Manual mapping between ISO, NIST, PCI, and internal controls | Coverage gaps; expensive re-work each audit cycle |
| Audit / evidence | Evidence gathered ad hoc; tests not linked to live control state | Audit delays; unclear remediation paths |
| Policy / controls | Versions, attestations, and exceptions managed by email | Expired waivers; no central approval history |
| Reporting | Per-module spreadsheets; no unified compliance score | Leadership lacks timely posture view |
| Manual processes | Approvals and reminders in email | Missed deadlines; no single work queue |
| Asset inventory | Hosts discovered ad hoc or imported blindly into the CMDB | Noise, wrong-tenant risk, weak audit trust in inventory |
Product screens
Product screens from the live platform, shown with client permission. Customer organisations stay confidential.
Tap or click any screen to enlarge. Pinch or use + / − to zoom, then swipe to browse.
What we built
Executive & hierarchy views
- Organisation compliance dashboard with posture, findings, risk and audit pipeline
- Module-specific dashboards for policy, incidents, GDPR, assets, and more
- Cross-organisation analytics for parent/child hierarchies
- Global coverage summary — requirements mapped across adopted frameworks
- White-label branding per tenant organisation
Framework & control management
- Framework catalog and adoption with requirement/domain/control hierarchy
- Canonical control implementation — one live row per organisation and control
- Cross-framework mapping via Common Elements and visual mapping explorer
- Bulk adopt/update and custom organisation controls alongside catalog controls
Risk registers & assessments
- Risk register, library, threats, and vulnerabilities
- Risk assessments with governance workflow and acceptance criteria
- Risk–control/threat/vulnerability mappings with snapshots and decision history
Audit management
- Audit engagements with lifecycle phases and control tests
- Weighted scoring, quality score, and critical-gap signals
- Report generation, calendar, dashboard, and AI assist for narratives
Evidence & integrations
- Evidence records, artifacts, and control/requirement mappings
- Scheduled collectors for AWS, Azure, GCP, GitHub, Okta, Microsoft 365, and more
- Webhook ingestion and Fernet-encrypted integration credentials
Policy lifecycle
- Draft → approval → publish with versioning and attestation campaigns
- Policy exceptions, reviews, and propagation to child organisations
- Knowledge Center template catalog and AI policy assistant
Workflow automation & My GRC Work
- Unified workflow engine across policy, exceptions, findings, audit, vendor, incident, and GDPR
- Record-level flow guides that show users the current stage, next step, and action path
- Sequential and parallel steps with delegate, escalate, and governance rules
- Single inbox for tasks, reviews, attestations, and workflow approvals
Unified findings & exceptions
- Single finding model across audit, incident, control failure, assessment, and vendor sources
- Corrective action and verification workflow with immutable verified snapshots
- Time-bound exceptions with renewal rules and duplicate-active guards
Incidents, assets & vendor risk
- Incident lifecycle with timeline, artifacts, risk/control mapping, and lessons learned
- Asset register (CMDB) with dependency maps, cascading impact, and control health — populated manually or via review-gated discovery
- Vendor register with risk tiering, assessments, and finding linkage
Asset Discovery (v1)
- Controlled pipeline: Collect → Review → Import → Enrich — not scan-and-auto-create into the CMDB
- Collect: on-prem Discovery Connector inside the customer LAN; configured ranges; mainly ICMP (ping) + ARP in v1; JSON upload and HTTP POST ingest for integrations
- Windows and Linux install packages (standalone binaries where available); organisation derived from the connector API key, not payload spoofing
- Review: findings land in a Discovery Review inbox; import or dismiss; non-host noise such as multicast/broadcast filtered where applicable
- Import: only human-approved discoveries become Asset Inventory / CMDB records
- Enrich: post-import Asset Intelligence suggestions (relationships, classification, control/framework mappings against adopted frameworks) — accept/dismiss, not silent CMDB mutation
- Honest scope: discovers reachable devices on configured ranges — not complete enterprise network visibility
GDPR / privacy operations
- ROPA, DSAR, consent, breaches, DPIA, privacy notices, and cross-border transfers
- Public org-scoped data-subject portal with email verification
RBAC, security & admin
- Custom permission model aligned to menu and API endpoints
- Activity logging, security dashboard, rate limiting, and onboarding wizards
- Organisation hierarchy with parent/child scope and platform vs org segregation
AI-assisted compliance
- Context-aware copilot grounded in live organisation data
- Module-specific AI assists for audit, evidence, and policy
- Multi-provider routing including on-prem Ollama option
Roadmap (not claimed as shipped)
- Executive board-pack reporting
- Regulatory-change / obligation management
- Business continuity / crisis management (BCM)
- Formal backup/DR SLOs and framework compliance export
- Deeper discovery sources when product need is real (services, SNMP, WMI, Active Directory, cloud)
Technology choices and outcomes
| Component | Technology | Why it matters |
|---|---|---|
| Frontend | Vue 3 + PrimeVue + Pinia + Tailwind | Module-rich SPA for policy, risk, audit, evidence, and admin workflows. |
| Backend / API | Django 5 + DRF | Monolithic API with org-scoped domain services and unified workflow engine. |
| Database | PostgreSQL | Relational model for frameworks, controls, evidence mappings, and audit history. |
| Auth & RBAC | JWT + custom permission model | HttpOnly cookies, least-privilege API enforcement, and menu-aligned roles. |
| Evidence integrations | AWS, Azure, GCP, GitHub, Okta, M365 collectors | Scheduled cloud evidence ingestion mapped to control implementations. |
| Asset discovery | On-prem connector + review inbox | Reachability evidence from configured ranges; human review before CMDB import; post-import suggestions stay evidence-bound. |
| Workflow engine | Unified WorkflowDefinition / Instance / Task | One approval model across policy, exceptions, findings, audit, vendor, incident, and GDPR. |
| Hosting | Gunicorn + Nginx | Multi-tenant single-server deployment pattern with production security headers. |
| AI assist | Multi-provider engine + grounded copilot | Context-aware assists for audit, evidence, and policy with an optional on-prem Ollama path for tighter data control, and guardrails against fabricated control data. |
Security model
Access control, activity logging and security monitoring are built in. We do not claim ISO 27001, SOC 2 or HIPAA certification for the product itself. Those depend on how you deploy and operate it.
- JWT authentication with HttpOnly, Secure (production), and SameSite=Lax cookies.
- Custom RBAC enforced on API endpoints and navigation — not Django default permissions.
- Login lockout, password history reuse prevention, and configurable rate limiting.
- CSP, Trusted Types, HSTS, and X-Frame-Options enabled in production configurations.
- Security event logging with an admin dashboard for abuse and policy violations.
- Organisation-scoped logical multi-tenant isolation with parent/child hierarchy rules.
- Discovery connector organisation binding via API key — findings cannot spoof into another tenant.
- Activity log for create, update, delete, login, export, and permission changes.
- Integration credentials encrypted at rest with Fernet field encryption.
- GDPR public forms use honeypot protection, rate limits, and email verification.
- Framework alignment with ISO 27001-style access control and NIST CSF patterns — not product certification.
Hardest technical challenges
The hard part was not drawing screens. It was making cross-framework compliance, workflow enforcement, and AI assists behave predictably in a regulated environment.
01
Canonical control implementation across adopted frameworks
Organisations adopt ISO, NIST, PCI, and other frameworks, but controls share one catalog spine. The platform enforces one live control implementation per organisation and control, with per-framework applicability overlays so compliance math stays consistent.
02
Cross-framework requirement mapping at adoption time
Framework adoption must materialise hundreds of control implementations only where requirement-to-catalog chains exist. Bulk adoption unions direct framework controls with catalog controls via requirement mappings, with idempotent create/skip counts and gap reporting.
03
Unified workflow engine across disparate modules
Policy, exceptions, findings, audit, vendor, incident, and GDPR each need approvals without duplicating workflow code. Shared workflow definitions, governance rules, and a normalised My GRC Work inbox solved cross-module consistency.
04
Evidence automation from heterogeneous cloud APIs
Continuous compliance evidence from AWS, Azure, GCP, GitHub, Okta, and Microsoft 365 required encrypted credentials, per-vendor collectors, and reliable mapping from collected records to control implementations.
05
Unified findings with verification integrity
Findings from audits, incidents, control failures, and vendor assessments share one lifecycle. Workflow completion only verifies from Resolved, and verified records keep immutable classification fields.
06
Governance rules runtime enforcement
High-severity incident closure, risk acceptance, and similar events need mandatory workflows. A governance rules engine evaluates conditions at runtime and blocks mutations while workflows are in flight.
07
Organisation hierarchy scope without data leakage
Parent and child organisations need shared policies and rolled-up views without cross-tenant exposure. Scope utilities and role-aware filters enforce hierarchy rules across list, detail, and dashboard views.
08
AI copilot grounding in regulated contexts
LLM assists must not invent control codes or metrics. Context blocks load from live organisation data, with intent classification and fabricated-code stripping; multi-provider routing includes an on-prem option.
09
Trusted discovery without polluting the CMDB
Asset discovery is easy to overpromise. Scan-and-auto-create sounds efficient until multicast noise, cross-tenant mistakes, or partial scans pollute inventory. v1 treats discovery as a controlled pipeline: an on-prem connector collects reachability evidence into a review inbox; only human-approved findings become CMDB assets; post-import suggestions stay evidence-bound and require accept/dismiss. Multi-tenant safety comes from connector API-key org binding, not payload claims. Discover first. Review before import. Enrich with evidence.
Results
Qualitative outcomes — no invented user or revenue metrics.
| Metric | Before | After |
|---|---|---|
| Compliance visibility | Fragmented spreadsheets per framework | Unified org compliance dashboard with hierarchy and scores |
| Control operations | Manual tracking per audit cycle | Canonical implementations with scope status and bulk operations |
| Evidence collection | Point-in-time manual uploads | Scheduled cloud collectors mapped to controls |
| Approvals | Email chains | Workflow engine with My GRC Work inbox |
| Findings | Siloed audit vs incident issues | Unified finding lifecycle with remediation tasks |
| Policy governance | Static documents | Versioned policies with attestation and propagation |
| Risk acceptance | Informal sign-off | Assessment workflow with snapshots and governance rules |
| Vendor risk | Ad hoc spreadsheets | Register, tiering, assessments linked to findings |
| Asset discovery | Ad hoc spreadsheets / blind import risk | Review-gated discovery into CMDB with optional post-import suggestions |
| Security operations | Limited app-level monitoring | Security dashboard with CSP, rate limits, and event log |
| Hierarchy visibility | Per-department spreadsheets | Cross-org compliance rankings and rolled-up dashboards |
| Onboarding | Ad hoc setup | Guided org and module onboarding wizards |
Where the platform is now
The platform is live. Judge it from the product screens and a walkthrough of the modules, not from a customer name we can’t publish. We built it from scratch for the client and show it here with permission. Shipped areas include policy, risk, controls, compliance scoring, audit, evidence, tasks, assets (including review-gated Asset Discovery v1), incidents, exceptions, findings, vendor risk, GDPR, and AI assists. Board-pack reporting, regulatory-change tracking, formal DR SLOs, and deeper discovery sources are still on the roadmap; we’d rather say that plainly than imply they’re finished.
Engineered by AEK Tech UK Ltd for the client. Shown with permission. Not an AEK-owned product.