320 of 348 implemented
Built for the work between audits
Compliance that stays ready.
Run frameworks, risks, policies, vendors, evidence and audits in one calm workspace. Every owner knows what is next. Every answer keeps its proof.
No credit card · Full platform · Free for your first 2 users
Workspace / DashboardSecurity program Live posture
ISO 27001v2022
76/93
SOC 2v2022In audit
38/51
NIST CSFv2.0
135/173
79%
Overall coverage249 / 317elements implemented
2 of 3 audit-readyCurrent and approved
Current⌄
Impact
121121111
LikelihoodSupplier reviewDue in 3 days→
Access control policyApproval pending→
Backup evidenceOwner requested→
One program, every framework
Do the control once. Carry it forward.
Map one control to every obligation it satisfies. The owner, implementation and proof stay shared—even as the framework list grows.
Review elevated access, confirm accountable owners and retain the same proof for every mapped requirement.
OwnerJohn DoeSecurityReview cadenceQuarterlyNext · 30 Sep 2026EvidenceQ3 access review.pdfAttached · 18 Aug 2026ISO 27001A.5.18 · Access rights Inherited from AC-04
The framework library
40+ frameworks, ready out of the box.
ISO 27001SOC 2NIST CSFNIS2DORACyFun
The operating system for GRC
One workspace from scope to proof.
Thirteen connected modules run on the same living model of your organisation. Scope the program, operate the work and arrive at proof without rebuilding context between tools.
01 / 13
01Frameworks
Import a framework. Inherit the work.
Deploy ISO 27001, SOC 2 or NIST in minutes: controls, owners and maturity tracking included. Cross-mapping carries every implemented control into the next framework you adopt.
- Controls cross-mapped between frameworks, so nothing is done twice
- Version diffs imported automatically (2013 → 2022 remapped for you)
- Implemented → partially → not applicable, tracked per element
ISO/IEC 27001:2022, Annex A93 controls · 4 owners · evidence linked
94% coveredA.5.1Policies for information securityImplemented100%
A.8.12Data leakage preventionPartially implemented64%
A.8.16Monitoring activitiesNot implemented28%
A.5.19Supplier relationships securityNot applicable0%
Coverage by domain
Organizational91%
People88%
Physical76%
Technological68%
Versions
v2022ISO/IEC 27001:2022Active
v2013ISO/IEC 27001:2013Archived
Diff imported, 31 controls remappedAuto
One shared operating layerContext moves. Traceability stays.
Activity trailComments & ownershipAPI & MCPRole-based access
Integrations
Connect the stack you already trust.
Bring evidence into the same workspace through native connectors for core cloud, identity and engineering systems. Extend everything else through the CSFaaS API and MCP—without breaking the audit trail.
Amazon Web Services·Native evidence connector
Bring your own AI
Ask the program. Keep the guardrails.
Connect Claude, ChatGPT, Gemini, Mistral or any MCP-capable client to live CSFaaS context. The same row-level permissions still decide what each person can see and do.
- OAuth connection with one-click revocation
- Read-only by default; write access is explicit and audited
- Every answer stays grounded in the user’s live workspace access
Live program query
Which controls need attention before our ISO 27001 audit?
OAuthUser-scoped accessLive evidenceRequest logged
AC-04Access reviewDue 4dBC-02Recovery evidenceMissingTP-07Supplier reviewDue 8d
Built for the whole team
Compliance is a team sport.
Give security, legal, IT, leadership and external reviewers one shared place to move the program forward—without turning everyone into a GRC specialist.
- Live presence and collaborative editing
- Comments, mentions and a personal action inbox
- Clear ownership without spreadsheet chasing
NadiaSecurity
IsaacIT
LeaLegal
AriReviewerConfirm privileged accounts, owner approval and quarterly review evidence.
OwnerNadia · SecurityAssignedEvidenceAccess review · Q2AttachedReviewAri · Independent reviewReady
Evidence attachedAccess export · just now
@Nadia clause approvedComment resolvedYour workspace, your rules
Switch off everything you don’t need.
Under six core sections sit 155 capability-level choices. Start with a sensible shape, then keep only the workflows, fields and scoring logic your organisation actually uses.
- Tailor 155 capabilities across the working program
- Configure risk matrices, levels and review rhythms
- Adapt catalogs without breaking shared traceability
Pricing
Free for everyone. Pay only as your team grows.
The full GRC platform is free for your first 2 users. After that it is a flat €79 per user, with optional add-ons for full audit history and extra storage. Connect your own AI over MCP, included with every seat. No per-framework fees, no hidden tiers.
Free
Everything included, for up to 2 users.
Free
Get started free- 2 users included
- Unlimited frameworks, policies & audits
- Unlimited risks, demands & remediation
- Unlimited third parties, systems & forms
- 7-day activity history
- Full data portability via API
- Bring your own AI (API & MCP), included
- 5 GB secure storage
Most chosen
Pro
For your whole team. The first 2 users are always free.
€79/ user / month
Get started- Everything in Free, for your whole team
- Unlimited members (first 2 free)
- Add or remove seats anytime
- Priority support
Enterprise
Tailored to your organization
Custom
Contact us- Unlimited users, policies, frameworks, assets, and evidence storage
- Enterprise SSO integration (Microsoft Entra ID, Google Workspace, Okta, and custom identity providers)
- Advanced connectors and automated evidence collection (AWS, Azure, GitHub, Jira, and more)
- Custom integrations and feature development tailored to your compliance requirements
- Dedicated instance, flexible deployment options, and enhanced security controls
- White-glove onboarding, priority support, and dedicated compliance guidance
Prefer experts to run it for you?
Our operating partner DarkProtect deploys and runs CSFaaS end to end: the platform, the program and the people behind it.
Meet DarkProtectCSFaaS deployed and operated for you: continuous evidence, live posture.
ISO 27001, SOC 2, NIST CSF, GDPR, DORA and NIS2 programs that pass review.
Penetration testing, cloud and configuration review, and threat modeling.
Senior security leadership on demand: strategy, reporting and ownership.
Questions, answeredThe short version.
The short version.
No sales fog.
If your question is not here, book a demo and bring the awkward version. Those are usually the useful ones.
Can we start with one framework and add more later?
Yes. CSFaaS is designed around one shared control library, so the work you complete for one framework can be reused wherever requirements overlap.
Does CSFaaS replace our auditor or security team?
No. It gives them a cleaner operating system: live ownership, evidence, review history and audit workflows. You can run it yourself or pair it with DarkProtect services.
How is workspace data isolated?
Workspace separation is enforced in PostgreSQL through row-level security. Evidence is stored privately and served through time-limited signed links.
Can our AI tools work with the platform?
Yes. The Platform API and OAuth-enabled MCP server expose the same governed workspace data and respect each user’s live permissions.
What does it cost to try?
The full platform is free for the first two users, with no credit card required. Pro is €79 per additional user each month, or €790 yearly.
Why CSFaaS
Built for the work behind every audit.
Multi-Tenant Architecture
Manage multiple workspaces, clients, and business units with complete data isolation.
Multi-Framework Compliance
Streamline compliance across ISO 27001, NIST, GDPR, and 40+ frameworks automatically.
Real-Time Insights
Data-driven decisions with live dashboards, analytics, and audit-ready reports.
No Vendor Lock-In
Full data portability: pull everything over the API anytime, integrate seamlessly, scale without restrictions.
Scalable & Growth-Ready
Perfect for startups to enterprises, including managed service providers.
Role-Based Governance
Built-in collaboration tools with granular permissions and real-time workflows.
Full Customization
Tailor policies, workflows, and controls to meet your specific requirements.
Transparent Pricing
Start free, scale affordably, no hidden costs or surprise fees.
Always Up-to-Date
Continuous updates with new frameworks and evolving compliance features.
From the library
Latest compliance insights.
Frameworks decoded, regulations translated, practice over theory, from the team behind the platform.
Your next audit can feel different
Make the next audit boring.
Put the program, the work and the proof in one place. Start with two users free, or bring us your current stack for a focused walkthrough.