Governance, risk and compliance (GRC)

Security certification software 5 companies

To get a certificate such as SOC 2, a company must show an auditor evidence that each security rule is followed. This software connects to the company's cloud accounts, code, HR system and laptops, checks the rules every day, and collects the evidence automatically, instead of staff taking screenshots before each audit.

ClearwaterClearwater, from Nashville with engineers in Pune, sells compliance software for American hospitals and healthcare companies.PuneHiring now

HyperproofHyperproof, from the Seattle area with engineers in Bengaluru, collects evidence for many different certificates and rule sets at once.BengaluruHired recently

SprintoSprinto, a Bengaluru company, is India's main company in this market. It checks a start-up's security rules every day and collects the evidence for its certificate.

SecfixSecfix, a German company with engineers in Bengaluru, does the same for ISO 27001 and SOC 2 certificates, for smaller customers.

ZaniaZania, a young Palo Alto company with engineers in Bengaluru, sells an AI agent that collects the evidence and answers customers' security questionnaires by itself.

The tech, explainedCompliance automation HIPAA compliance software

Risk registers for the board 7 companies

A large company keeps a register of its risks, the controls that reduce each risk, and who is responsible. This software keeps that register and turns it into reports for the board and the regulator.

Risk and compliance platforms

Platforms for the whole register.

CCorporaterCorporater, with engineers in Bengaluru, sells one platform for governance, performance and risk management.Bengaluru

NAVEXNAVEX, from Oregon with engineers in Bengaluru, combines policy management, hotlines where staff can report wrongdoing, checks on suppliers and staff training.BengaluruHired recently

Archer Integrated Risk ManagementArcher is one of the older names in risk-register software for large companies. It has engineers in Bengaluru.

LRNLRN is here for Catalyst, its platform for ethics and compliance training and for a company's code of conduct.See alsoOnline legal services

One part of the register

Companies that handle one part: the board's risk score, SAP access or suppliers.

ISS-CorporateISS-Corporate, in Mumbai, is part of ISS, a firm that advises investors on how to vote at shareholder meetings. It gives a company's board a cyber-risk score, compared with similar companies.Mumbai

ToggleNowToggleNow, from Hyderabad, manages access and risk for SAP, the software that many large companies run their finance and operations on. For example, it checks that no one person can both create a supplier and pay it.

SecureOSSecureOS, a young company with engineers in Bengaluru, manages only the checks on a company's suppliers.

The tech, explainedGRC platform Cyber risk quantification↗ Vulnerability and exposure management Third-party risk management (TPRM)↗ Vulnerability and exposure managementSAP access control

Privacy and communication records 3 companies

Privacy laws require a company to know what personal data it holds, where the data goes and who agreed to its use. Financial firms must also keep every email, chat and call that their staff send, and check them for misconduct.

OneTrustOneTrust is the largest company on this page, with engineers in Bengaluru. It began as the cookie-consent banner on websites, and grew into software for a company's whole privacy programme.BengaluruHiring now

SmarshSmarsh, with engineers in Bengaluru, keeps the record of every email, chat, text and call that staff at financial firms send, and checks them for misconduct, as regulators require.Bengaluru

Relyance AIRelyance AI, a Bengaluru team, keeps a live map of where a company's data flows, including into AI models, and checks privacy rules against that map.

The tech, explainedPrivacy management↗ Enterprise cybersecurity Communications compliance and archiving

How it all worksGovernance, risk and compliance (GRC)Proof that the controls exist and work.

See how it works →

What's changing

AI now answers the security questionnaire.

A company selling to large customers answers hundreds of security questionnaires a year, each with hundreds of questions. AI agents now draft the answers from the company's own evidence, and a person checks them before they are sent.