Decide what you follow
Activate frameworks, define scope and interested parties, and publish your policies. ISO 27001's 93 controls arrive ready to edit.
ISO/IEC 27001Activated
Scope statementWritten
Policies approved12
Compliance, risk and security training in one platform
Bring yoursecurity programinto focus.
CompliLens replaces spreadsheets, shared folders and audit-week panic with one connected workspace. Plan your program, train your people, prove it to auditors and customers, and keep it healthy all year.
8frameworks and overlays
9regimes with live deadlines
12attack types to simulate
132automated evidence checks
Without CompliLensMove the lens
PassMFA for every user
06:00:00CERT-In
Phish reported in 38s
93 controls mapped
ISO/IEC 27001:2022SOC 2 Type IIISO 9001:2015ISO/IEC 42001:2023GDPRDPDP ActCERT-InRBISEBI CSCRFIRDAIEU AI ActCCPAUK GDPRPDPALGPDPOPIAISO/IEC 27001:2022SOC 2 Type IIISO 9001:2015ISO/IEC 42001:2023GDPRDPDP ActCERT-InRBISEBI CSCRFIRDAIEU AI ActCCPAUK GDPRPDPALGPDPOPIA
From scattered to systematic
Watch your program come together
Today: a dozen spreadsheets, three shared drives and an inbox full of sign-offs.CompliLens pulls each piece into one connected record.Every risk, control, policy and person, in one place and always current.
Risk_Register_FINAL_v7.xlsx
Risk register28 risks scored
RE: RE: policy sign-off??
Policies12 approved
SoA_2025 (copy).xlsx
Controls93 mapped
audit evidence/ (412 files)
Evidence84% complete
vendor list - Priya.xlsx
Vendors17 assessed
training_attendance.csv
Security training94% complete
phishing test results.pdf
Human riskScore 22 · low
incident notes.docx
IncidentsCERT-In clock running
MR minutes draft (2).docx
Management reviewMinutes locked
access review Q3.xlsx
Access reviewsEvery account decided
#security-questions
QuestionnairesDrafted with citations
DPDP requests · inbox
Rights requestsAll on time
How it works
Five steps, running all year
Frameworks
Run the program every day
Assess risks, track assets and vendors, respond to incidents and close tasks. Reminders reach the right person before anything slips.
RSK-018 · RansomwareCritical 20
Vendor NDA expires in 9 daysAlert
Open tasks due this week6
Make people your strongest control
Assign role-based training, run realistic attack simulations and watch your human risk score fall quarter by quarter.
Phishing simulation · Q34% clicked
Report rate71%
Human risk score22 · Low
Collect the evidence automatically
Connect cloud, code, identity and device systems. Checks run daily and attach proof to the right control.
AWS · S3 public access blockedPass
GitHub · branch protectionDrift
Evidence completion84%
Check, fix and review
Audit, raise findings, fix root causes with CAPA, and review performance with leadership using live numbers.
NCR-031 · MajorCAPA open
5 WhysRoot cause found
MR-003 minutesLocked
Inside the product
One workspace, from the first risk to the final certificate
01 / 05Dashboard
Know where you stand in five seconds
Your compliance score, open risks, incidents and overdue work on one screen, computed live from the records underneath. No status meetings to find out.
Good morning, PriyaLive
Compliance score87%
Open risks11
Open incidents2
Overdue tasks3
Controls implemented71 / 92
Evidence complete84%
Training complete94%
Policies acknowledged86%
02 / 05Risk
Every risk scored, treated and linked
The same scoring method for every risk, residual risk after treatment, and a direct line to the controls, assets and vendors involved.
| Ref | Risk | Inherent | Residual | Controls |
|---|---|---|---|---|
| RSK-018 | Ransomware on file server | 20 | 8 | 8.13 |
| RSK-024 | Vendor data exposure | 12 | 6 | 5.19 |
| RSK-031 | Credential phishing | 15 | 4 | 6.3 |
| RSK-027 | Laptop theft | 6 | 3 | 8.1 |
03 / 05Controls
One control set across every framework
Activate ISO 27001 and 93 controls arrive mapped. Map them to SOC 2, GDPR or RBI once, and the work counts everywhere.
ISO/IEC 27001:2022 · Annex A93 controls
Implemented71
In progress15
Not started6
Not applicable1
| Ref | Control | Status | Maps to |
|---|---|---|---|
| 5.15 | Access control | Implemented | SOC 2 CC6 |
| 8.24 | Use of cryptography | Implemented | GDPR Art. 32 |
| 5.23 | Cloud services security | In progress | RBI |
| 8.30 | Outsourced development | Not applicable | Justified |
04 / 05Security training
Watch human risk fall, quarter by quarter
Training, simulations and policy acknowledgement roll up into one human risk score, by person, team and attack type.
Human risk scoreLow · falling
22
Phishing click rate4%
Report rate71%
Training complete94%
Knowledge score82 / 100
05 / 05Trust Center
Turn the work into a sales asset
Share a live, passcode-protected page with customers. Certifications, practices and sub-processors update themselves.
Northwind Foods · Trust CenterUpdated today
ISO 27001Certified
SOC 2Type II
DPDPReady
Organisational34/37
People8/8
Technological29/33
Security awareness training
Your people are part of the attack surface. Train them like it.
Most breaches start with a person: a convincing email, a rushed payment, a reused password. CompliLens trains every employee, tests them with realistic attacks across email, SMS, voice and QR codes, and shows you exactly where your human risk sits.
- Fourteen core topics with role-based tracks for engineers, finance, executives and support
- Simulations for phishing, smishing, vishing, QR codes, MFA fatigue and deepfakes
- A live human risk score by person, team and attack type
- Every completion and acknowledgement filed as audit evidence automatically
IT Service Desk <it-support@northwind-helpdesk.co>Look-alike domain
09:12Action required: your password expires in 2 hours
Hi Aisha, our records show your account will be locked today. To keep access, verify your sign-in details now.
Verify my accountLink goes to an unknown siteSent to 200 recipients · do not reply
Report phishingReported by 71% of staff
The platform
Every part of the program has a place
Ten areas, more than forty modules, one data model. Choose an area to go deeper.
5 modules
Governance & ISMS
Context, objectives, management review, controls and certifications.
Explore6 pages
Security training
Curriculum, assessment, attack simulation, human risk and acknowledgement.
Explore9 modules
Risk
Risks, incidents, CAPA, vendors, assets, devices and AI systems.
Explore6 modules
Audit & assurance
Programme, plan, sampling, findings and evidence.
Explore2 modules
Policies
Approval workflow, version history and timed acknowledgement.
Explore18 connectors
Integrations
Cloud, code, identity, HR, device and IoT systems feed evidence daily.
Explore4 modules
Privacy
Rights requests, consent, classification and disposition.
Explore2 modules
Resilience & access
Disaster recovery drills and access reviews.
Explore2 modules
Trust & AI
A public Trust Center and questionnaire auto-fill.
ExploreIndia compliance
Built for Indian regulation from day one
CERT-In's 6-hour reporting window, the DPDP Act's rights register, and RBI, SEBI and IRDAI overlays ship with the product, alongside GDPR and the EU AI Act.
Explore India complianceIntegrations
Evidence that collects itself
AWS, Azure, GitHub, Okta, Intune and 13 more connector types are checked every day against 132 rules mapped to real controls.
- Findings attach to the right control automatically
- Critical drift drafts an NCR for a person to review
- Accepted items flow to Jira and Slack
CompliLens
rule engine
rule engine
Two more reasons teams switch
Answer questions before they slow the deal
Do you encrypt customer data at rest?
Draft answer
Yes. Customer data is encrypted at rest with AES-256, and keys are rotated every 90 days under our cryptography policy.
Control 8.24 · Use of cryptographyPOL-ISP-004Evidence · KMS rotation log
AI, grounded in your data
Answers you can check
Security questionnaires draft themselves from your own controls, policies and evidence. Every answer shows its sources, and nothing is sent until a person approves it.
Explore AINorthwind Foods · Trust CenterLive
ISO 27001Certified
SOC 2Type II
DPDPReady
Passcode protectedLink expires in 14 days
Trust Center
Answer security reviews early
Send buyers one link with your certifications, security practices and sub-processors. It updates itself as your program changes, and you control who sees it and for how long.
Explore Trust Center