Policy management with AI drafting
Draft, review, approve, version and distribute policies. Guided completion explains every placeholder in plain English, so inexperienced owners still produce audit-grade documents.
AI-assisted, multi-framework compliance platform
One compliance platform for every standard you are held to.
Policies, risks, controls, evidence, audits and customer assurance in a single workspace — cross-mapped across ISO 27001, ISO 9001, ISO 42001, SOC 2, GDPR and PCI DSS so you collect evidence once and use it everywhere.
11+
frameworks cross-mapped
1 control
satisfies many standards
AI drafting
policies written with you
Multi-tenant
workspaces for consultants
A compliance platform should remove the administrative drag of proving that your organisation does what it says it does. That means one place for policies and their approvals, one risk register, one control library, one evidence store, and reporting that leadership and auditors can read without a walkthrough.
ISO-STANDARD.app is compliance management software built for organisations that need real governance discipline without an enterprise GRC budget. Whether you are certifying for the first time, maintaining several standards at once, or answering security questionnaires every week, the same workspace carries the work.
Features
Everything a modern compliance platform should include
Live risk register
ISO 31000-aligned scoring, appetite and tolerance, treatment plans with owners and due dates, and residual risk tracked over time.
Cross-mapped control library
Annex A, ISO 9001 clauses, ISO 42001, SOC 2 TSC, GDPR articles, PCI DSS requirements and Cyber Essentials — one implementation, many frameworks.
Evidence requests and collection
Request evidence from owners, chase automatically, and keep everything timestamped and attributable in one repository ready for audit week.
Internal audits and corrective actions
Plan an audit programme, record findings, raise nonconformities and track corrective actions through to verified closure.
Reporting and trust profiles
Management review packs, control health dashboards and a shareable trust profile that answers customer due-diligence questions before they are asked.
Benefits
What changes when compliance lives in one system
Collect evidence once
Cross-mapped controls mean an access-review record satisfies ISO 27001, SOC 2 and PCI DSS at the same time instead of three separate chases.
Stop preparing for audits
Because evidence accumulates continuously, audit preparation becomes a report export rather than a four-week fire drill.
Make ownership visible
Every policy, risk, control and action has a named owner and due date, so accountability does not sit with one overloaded person.
Win deals faster
A live trust profile and ready answers to security questionnaires shorten procurement cycles with enterprise buyers.
Cut consultancy spend
Built-in methodology and templates handle the routine work; expert help is there for the judgement calls that genuinely need it.
Scale to many entities
Group companies, subsidiaries and client portfolios each get an isolated workspace with rollup reporting.
Use cases
Where a compliance platform earns its place
First-time certification
Pain: No management system, no documented policies, and a customer deadline for an ISO 27001 or SOC 2 certificate.
With ISO-STANDARD.app: Pre-loaded standards content, AI-guided policy drafting and a gap-to-certificate path you can follow without a consultant on retainer.
Multi-framework maintenance
Pain: Separate spreadsheets per standard, duplicated evidence, and surveillance audits that always arrive too soon.
With ISO-STANDARD.app: One cross-mapped control set, continuous evidence collection and a single audit calendar covering every framework.
Consultants, MSPs and group entities
Pain: Rebuilding the same management system for every client and losing hours to file wrangling.
With ISO-STANDARD.app: Isolated multi-tenant workspaces, reusable templates and portfolio dashboards from one login.
Sales-led security reviews
Pain: Every enterprise deal stalls on a 200-question security questionnaire.
With ISO-STANDARD.app: A searchable Q&A library and a public trust profile that answer most questions before the buyer asks.
Frameworks
Cross-mapped coverage, one workspace
Comparison
Spreadsheets vs legacy GRC vs ISO-STANDARD.app
| Capability | ISO-STANDARD.app | Spreadsheets | Legacy GRC |
|---|---|---|---|
| Multi-framework control cross-mapping | |||
| AI-assisted policy drafting | Add-on | ||
| Evidence requests with automatic chasing | |||
| Internal audits and corrective actions | |||
| Public trust profile for buyers | Add-on | ||
| Multi-tenant client workspaces | Expensive | ||
| Setup measured in hours, not months | |||
| Transparent SME pricing |
Implementation
From sign-up to audit-ready
01
Create your workspace
Pick your frameworks and the relevant standards content, controls and policy templates load instantly.
02
Draft policies with AI
Guided completion explains each field in plain English and produces documents an auditor will accept.
03
Assess risk and assign controls
Score risks, apply cross-mapped controls, and give every action an owner and a due date.
04
Collect evidence continuously
Automated requests and reminders keep the evidence store current between audits.
05
Audit, report, certify
Run internal audits, close nonconformities and export the evidence pack your certification body asks for.
FAQ
Common questions about compliance platforms
What is a compliance platform?+
A compliance platform is software that centralises the work of meeting a standard or regulation: policies, risk registers, controls, evidence collection, corrective actions, internal audits and reporting. Instead of spreadsheets and shared drives, everything lives in one system with owners, due dates and an audit trail.
How is a compliance platform different from compliance management software?+
The terms are used interchangeably. In practice a platform covers multiple frameworks in one workspace and maps a single control to several standards, while narrower compliance management software often handles one framework or one activity such as policy distribution.
Which frameworks does ISO-STANDARD.app support?+
ISO 27001, ISO 9001, ISO 20000-1, ISO 42001, SOC 2, GDPR, PCI DSS, NIS2, DORA, the EU AI Act and Cyber Essentials. Controls are cross-mapped, so evidence collected once can satisfy several frameworks.
Do we need a consultant to use the platform?+
No. The methodology, templates and guided AI drafting are built in, so most teams get productive on day one. Consultancy and fractional CISO or quality-manager support is available if you want expert help alongside the software.
Can consultants and MSPs manage multiple clients?+
Yes. Multi-tenant workspaces keep each client's data fully isolated, with reusable templates and portfolio-level reporting from a single login.
How long does implementation take?+
There is no multi-month rollout. Workspaces are created instantly, standards content is pre-loaded, and most organisations have policies drafted and a working risk register inside the first week.
How much does a compliance platform cost?+
ISO-STANDARD.app uses transparent SME pricing rather than the annual enterprise contracts and per-framework upsells typical of legacy GRC suites. See the pricing page for current plans.
AI-enabled — privacy-respecting
AI does the drafting. You keep the control — and the data.
AI that assists — not replaces
Assisted drafting for policies, risks, controls and buyer questionnaires. Every AI suggestion is reviewed and approved by you before it lands in the record.
Opt-in, workspace-scoped
AI features run only when you invoke them, only against the workspace you're in. We never mine your data to answer someone else's prompt.
Your data stays yours
Prompts routed via the Lovable AI Gateway to model providers whose API terms exclude your content from model training. Nothing is sold or shared for advertising.
Isolated by design
Row-level security enforces workspace boundaries at the database. MFA, SSO, audit logs and least-privilege roles govern who sees what.
We never sell personal information, never share it for advertising, and never use your workspace content to train third-party models. Full sub-processor list and Acceptable Use Policy on the Trust page.
MM
Michael McCarroll
Founder · 25+ years
IT governance · Information security · AI
Why this platform exists
Enterprise-grade governance — built for the SMEs and consultants enterprise GRC forgets.
I've spent 25 years in corporate governance — aligning technology, controls and compliance with what the business is actually trying to do. Time and again, the same pattern: the organisations that win new clients aren't the ones with the biggest GRC budget. They're the ones who can demonstrate trust on demand. This platform is the tool I wanted for the SMEs and consultants I've worked with — institutional-grade governance without an institutional price tag, built on the way audits and buyer reviews actually happen.