// compliance platform
The platform I built to manage compliance every day, not only before the audit: gap analysis, risks, evidence, incidents, suppliers and documents, with the Italian ACN rules. For companies that use it directly and for consultants and MSPs who offer it to their own clients.
Example Ltd · important entity
// frameworks
Equivalent requirements are linked: an ISO 27001 control already compliant carries its status, owner and evidence over to the matching NIS2 measure. Cross-coverage shows at once how much work is left for a company that is already certified.
// what it does
Every requirement with status, rationale, owner, deadline and evidence. The dashboard flags gaps without an owner and overdue actions.
Inventory with confidentiality, integrity and availability, risk register with treatment and residual risk, linked to the Statement of Applicability.
Processes with MTPD, RTO and RPO, dependencies and exercises: if the measured recovery exceeds the RTO, the platform flags it.
Incident register with early warning, notification and final report deadlines, and a summary ready for the CSIRT.
Evidence with expiry dates and SHA-256 fingerprints, an auditor package in one click, policies, procedures and registers generated in Word.
Supplier register, supply chain questionnaires and answers to your clients' questionnaires.
Records of processing and of breaches, AI systems register with AI Act risk classification.
OpenVAS scan import linked to assets, training register, audits and non-conformities.
A PDF for the board with trends, risks, incidents and decisions needed, also sent automatically every month or quarter.
// who it is for
You use the platform directly, on your own or with my support, to be ready for audits and ACN inspections.
Offer compliance to your clients under your own brand: you do the work, the platform keeps order, deadlines and documents.
// security
Two-step verification, single sign-on with Microsoft Entra ID, Google Workspace, OpenID Connect or SAML 2.0, lockout after failed attempts.
Every operation is logged with a fingerprint chained to the previous one: any change, even made on the database, shows up at verification. Auditors can check it independently.
Files scanned by antivirus before storage and fingerprint verified at every download.
Each partner sees only its own clients, each client only its own organisation, with read, edit and admin roles.
It drafts rationales, reviews evidence and prepares questionnaire answers. It never changes anything on its own, is enabled client by client and every request is logged.
// getting started
Thirty minutes on a video call around your real cases: frameworks, number of sites or clients.
I create the environment, set up frameworks, users and branding, and import the data you already have.
Two hours for daily users, with the user manual.
Gap analysis, risks, evidence and deadlines in one place, with the board report ready when needed.
// faq
No. It organises and documents the work; assessments stay with people who know the company. That is why it is also built for consultants, who use it with their own clients.
No. You start from the frameworks you need, usually NIS2 or ISO 27001; if the company is already certified, cross-coverage shows how much of NIS2 is already done.
Yes: evidence, registers and documents can be downloaded at any time. When a licence expires the platform stays readable for 90 days, precisely for exporting.
You pay a platform fee based on the plan and a price for each active client, with discounts that grow with the number of clients. You set the price for your clients.
No, it is an option enabled client by client, only with their consent.
// next step
A thirty-minute demo around your real cases, no commitment.