Features
Every part of GRC, connected in one platform
Frameworks, controls, evidence, policies, risks, incidents, vendors, assessments and audits share one governed data model. Do the work once and use it everywhere it counts.
- Hosted in Belgium, EU
- 21+ frameworks
- 365 integrations and an open REST API
- Dutch, French and English
One control architecture
Assess once, evidence everywhere
At the centre of Secrato is the Unified Control Library. Requirements from every framework you carry point to shared controls, and those controls carry their evidence, policies, risks, assessments and audit findings with them.
Common controls
See where frameworks overlap and manage that work once instead of per standard.
Context stays attached
Evidence, policies, procedures, risks and findings stay linked to the controls they support.
Always current
Live controls and continuous monitoring keep the picture up to date between audits.
Capabilities
Everything you need to govern and prove compliance
Each module works on the same data, so work done in one place is usable in all the others.
Compliance Engine
Run compliance across frameworks in one place.
- Maturity scoring and compliance-based evaluation
- Statement of Applicability with export, snapshots and approval
- Requirement and control views, mapped to each other
Framework Mapping
Connect requirements and controls across the standards you carry.
- Cross-framework mapping on the Unified Controls Library
- Kickstart a new framework with data you already have
- Control labels, control import and custom frameworks
Assessments
Scope, score and complete assessment work end to end.
- All assessment types, per framework or control group
- Compliance and maturity scoring, or your own scale
- Issues management with owners and follow-up
Risk Management
Keep risk connected to controls, evidence and ownership.
- Risk registers with the Secrato Standard 5×5 matrix
- ISO/IEC 27005, ISO 31000, NIST SP 800-30, COSO ERM and more
- Multiple treatments, exceptions, escalation and financial quantification
Policy & Evidence Management
Policies, procedures and evidence linked to what they support.
- Libraries with versioning and ready-made templates
- Review, approve and publish to the policy portal
- Labels that map documents across frameworks
Audit Hub
Plan audits and keep findings under control.
- Audit plan and findings in one place
- Structured, scoped access for auditors
- Evidence already organised per control
Incident & Breach Management
Handle incidents and meet notification deadlines.
- Seven stages with the CCB significance test
- NIS2 filings at 24 hours, 72 hours and one month
- Advanced: GDPR, CRA and DORA notifications, playbooks, corrective actions
Third-Party Risk
Know your suppliers and the risk they bring.
- Vendor register with profile, services and history
- Questionnaire engine, campaigns, tiering and contract follow-up
- External attack-surface (EASM) monitoring
Devices & Personnel
Keep people and assets connected to the controls that govern them.
- Personnel tracking
- Asset management
- User policy portal for acknowledgements
Tasks & Actions
One task list across every module.
- Tasks from controls, evidence, policies and procedures
- Tasks from assessments, issues and risks
- Owners, due dates and status in one schedule
Dashboards & Reporting
See compliance, risk and audit status in one view.
- Cockpit with custom widgets, spider charts and heatmaps
- Role-based and workspace views
- Reports for management and auditors
Trust Network
Share your security posture with customers and partners.
- Approved domains decide who gets access
- NDA gating before documents are shown
- Configurable access expiry
Organisation and access
Built for groups, teams and partners
Set direction centrally and keep accountability local, from one company to a group with hundreds of workspaces.
Workspaces and tenants
Each workspace has its own scope, frameworks and reporting. Enterprise supports unlimited tenants and up to 250 workspaces, with Global Governance in early access.
Multi-tenant & workspaces →Access and identity
Role-based access, single sign-on with several identity providers and a full audit trail in every paid plan.
Multi-IDP support →Your brand per workspace
Give each workspace its own branding, so subsidiaries and clients work in a familiar environment.
See plans →For managed service partners
Manage customer tenants and deliver under your own brand with multi-tenant and white-label options.
Partner Program →Integrations
Turn the tools you already use into evidence
Bring evidence in from identity, devices, cloud, HR, ticketing, code and security tools, linked to the controls, risks and audits it supports.
Browse all integrations · Secrato API · Missing a tool? Customer requests decide what we connect next.
Frameworks
The standards you carry, in one library
EU regulations, international standards and sector schemes, with your own custom frameworks next to them.
Security and hosting
EU-sovereign by design
Included in every plan.
Hosted in Belgium
Self-managed infrastructure in a Tier IV data centre in Antwerp (ISO/IEC 27001), within EU law.
Sovereign security →Encrypted and logged
TLS in transit, AES-256 at rest and comprehensive audit logging.
Your language
Platform and support in Dutch, French and English.
Plans
Start small, grow without switching tools
See Secrato with your own frameworks
A 30-minute demo shows how controls, evidence, risks and audits connect for the standards you need to meet.
