Products
One portal, two products, kept completely separate
GRC and VAPT never share data with each other. A customer can buy either one, or both, and each keeps its own risk register and evidence. Pick a part below to see how it looks.
Frameworks
Each item says what to do, what proof to keep, and how it is going.
Compliance
A state data security law, summarised in four short answers.
Massachusetts 201 CMR 17.00 to 17.04
Sets minimum standards to protect residents' personal information.
Defines what counts as a breach of security and personal information.
Full compliance was required by March 1, 2010.
Secure sign-in, encryption of data in transit, and up-to-date security software.
Policies
Start from a finished policy. Edit it, view it, copy it, email it.
Business Continuity Policy
Assessments
Send a questionnaire to a team or a supplier. Answers arrive in one place.
0responses received
Risk register
Likelihood against impact, so you fix the biggest risks first.
Scan your code
Every issue found explains what's wrong, how to fix it, and gives a ready-to-paste prompt for your AI coding tool.
User input is concatenated straight into a SQL query — an attacker can read or change any row in the table.
VAPT Advisor
Tell it your stack in plain English — it builds the checklist for you.
0% of the checklist covers your actual stack
Vulnerabilities library
Six curated reference lists, each with the "why" and an AI-prevention prompt.
One user can act on another user's data because the server never checks who is asking.
Reports
Generate the same findings through whichever lens your stakeholders want.
Internal and external penetration testing — 2 findings reviewed.
Audit logs for access to cardholder data — not yet tested.
A VAPT-generated summary, not a compliance certification — shareable with developers and stakeholders as Markdown or PDF.
Two advisors, built in
Not sure what applies, or what's exposed? Ask.
The GRC Advisor turns five short questions about your business into the laws and frameworks that apply to you. The VAPT Advisor turns a description of your tech stack into a weighted security checklist, with an AI prompt for every item.
- Separates what is required by law from what customers expect
- Says how much effort each one takes and how urgent it is
- Ends with a 90-day plan — or a prioritised fix list — you can start inside the platform
Made for everyone who touches security at your company
For your company
Everyone from the founder to the office manager can follow along.
- Add your team and give each person access
- See progress for every framework and law on one screen
- Try everything free before you pay
For developers & security leads
VAPT speaks developer, not auditor.
- Paste code or scan a website, get real findings
- Every fix comes with a ready-to-paste AI prompt
- CWE, OWASP, EPSS and KEV for the ones who want the detail
For area managers and sales teams
Run your own territory without asking for help.
- Create companies and set up their first administrator
- Track renewals and payments for your accounts
- See only your own companies