Compliance One runs ISO 27001, SOC 2, ISO 42001, ISO 22301, ISO 27701, ISO 27017, ISO 27018, HIPAA, PCI DSS, NIS2, the EU AI Act, Singapore’s Cyber Essentials, Cyber Trust and DPTM, the Philippines DPA and India’s DPDP Act from one platform with a shared evidence layer — collecting evidence automatically, cross-mapping it across the frameworks it satisfies, and keeping you audit-ready every day, not just the week before.
Controls satisfied
142 of 169 mapped
+9 this week
AI drafted this policy
you approve every word
Compliance, minus the busywork
Built-in threat intelligence — no other platform at this level
16
Frameworks, cross-mapped
1
Evidence set, mapped everywhere
3
Data regions: EU · US · APAC
24/7
Continuous monitoring
Why Compliance One
Most platforms digitise the busywork. We remove it — so proving trust stops being a fire drill.
Do it once, prove it everywhere
Security frameworks overlap heavily, so one control you implement — and the evidence behind it — can count toward ISO 27001, SOC 2, HIPAA and more at once. We map it across them automatically, so shared work isn't repeated and each framework's specific requirements are still tracked on their own.
No one else does this at this level
Compliance tools stop at checklists. We ship a full threat-intelligence command centre inside the platform — actively-exploited vulnerabilities prioritised by CISA KEV × CVSS × EPSS, live ransomware activity, threat-actor and malware dossiers mapped to MITRE ATT&CK, network indicator feeds and curated security news. Your programme is driven by real-world risk, not just a control list — one click from your dashboard, with nothing extra to buy.
Training included — don't pay twice
Most GRC tools make you buy a separate training platform — another vendor, another bill, another login. We build the LMS right into Compliance One at no extra cost. Assign framework-specific courses to your staff, deliver them through a secure no-skip player, test understanding with AI-drafted (human-approved) quizzes, and auto-issue branded completion certificates that write straight back to each person's training record. Reminders, overdue chasing, per-department analytics and recurring re-training are all included — so awareness training is finally part of your compliance programme, not a line item next to it.
Built for the AI era
Draft policies, summarise evidence and triage gaps with an assistant that understands your control set. Bring your own model key or use ours — your call, your data boundary.
Bring your compliance to your AI
Every account ships with a built-in Model Context Protocol server, so you can connect Claude — or any MCP client — straight to your live compliance data. Ask about risks, controls, your SoA, evidence and audits in plain language, and make audited changes, all org-scoped with secrets never exposed. Sign in with per-user OAuth (one click) or a scoped API key. No add-on, no extra cost.
Your data, your region
Choose where your evidence lives — EU, US or APAC — at signup. Or point us at your own S3 bucket and keep full custody. Isolation is physical, not just a row in a shared table.
Honest by design
Live connectors watch your cloud and identity stack and collect timestamped evidence automatically. We show you what's actually covered — never a green dashboard hiding a red reality.
The platform
From your first control to your fifth audit — without stitching five tools together.
Every control, its justification and status — generated and export-ready.
Connectors pull from AWS, identity and ticketing on a schedule you set.
Framework-mapped templates you can adopt, edit and version in minutes.
Schedule assessments and surveillance audits; nothing slips through.
Score, treat and track risks with links straight to the controls that mitigate them.
Org admins configure every integration; least-privilege throughout.
Connect Claude — or any MCP client — to your live compliance data. Query and make audited changes in natural language, via OAuth or an API key.
Assign framework courses to staff, quiz them, and auto-issue certificates — a full security-awareness LMS included, so there's no separate training tool to buy.
Coverage
Subscribe to what you need today; add more without starting over. Evidence maps across all of them.
CSA baseline mark
Certification · baseline
Learn moreCSA mark of distinction
Certification · risk-based
Learn moreData Protection Trustmark
Certification · data protection
Learn moreAI Regulation
Regulation · risk-based
Learn moreHealth Data
Privacy & Security
Learn moreData Protection (India)
Act 22 of 2023 · Rules 2025
Learn moreBusiness Continuity
Certification · resilience
Learn moreInformation Security
Annex A · ISMS
Learn moreCloud Controls
Certification · cloud
Learn moreCloud PII (Processor)
Certification · cloud privacy
Learn morePrivacy (PIMS)
Certification · privacy
Learn moreAI Management
Responsible AI
Learn moreEU Cyber Resilience
Directive 2022/2555
Learn morePayment Security
v4.0.1
Learn moreData Privacy Act
Regulation · data protection
Learn moreTrust Services
Type I & II
Learn moreHow it works
No six-week onboarding. Pick frameworks, connect your stack, and watch coverage climb.
Choose the frameworks you need. Controls, policies and an SoA are provisioned instantly.
Link cloud, identity and email so evidence starts flowing automatically.
Work a clear, prioritised list — assign owners, attach evidence, track progress.
Export auditor-ready packages and stay continuously compliant, not just at audit time.
Pricing
No tiers, no per-seat math, no per-framework add-ons. Every framework, every feature, your whole team — one number.
No tiers to decode. No line items to negotiate. One price covers the whole platform.
One flat price
no per-seat fees · no per-framework add-ons
The longer you stay, the less you pay. Every renewal earns a loyalty discount — staying compliant should cost you less each year, not more.
30 minutes · no obligation · you leave knowing your number
See Compliance One mapped to your frameworks in a 30-minute walkthrough. Bring your hardest audit question.