Norrsent · the GRC platform
GRC software
that holds up
at audit.
Risk, compliance, and governance run on one data model. Every write gets signed and attributed when it happens, so the audit firm doesn’t turn into a three-week scramble.
Risk Management
Replace the risk spreadsheet.
The ISO 31000 lifecycle in one register: identification, scoring, mitigation, controls. Plus an audit trail your auditor can actually use.
Threat Management
Threat data, kept current for you.
3,000+ canonical threats across sectors and geographies. You link them to your risks once. After that, updates propagate without you doing the work again.
Controls Management
Controls you can actually test.
Build the control library once and apply it to risks, obligations, or policies. Test scheduling and evidence capture come with it.
Incident Reporting
Incidents that feed the register.
Capture incidents in the platform, not in email. Escalation routes by severity. Each incident links to a risk so the register learns from it.
CSRD
Built for cycle two.
Double materiality, ESRS data lineage, evidence packs your assurance provider can read directly. Built so cycle two reuses cycle one rather than starts over.
Policy Management
Policies that don't sit in PDFs.
Author and version policies in the platform. Distribute them, track who attested, link each policy to the controls it actually governs.
Third-party Risk
Vendor risk you can keep up with.
Run due diligence assessments. Tier vendors by exposure. Each profile links back to the contract that scopes the relationship.
Audit Management
Internal audit lives in the platform.
Plan internal audits, capture findings, track remediation. The evidence trail is signed and ready when the regulator or external audit firm asks.
Norrsent Copilot · Responsible AI
Copilot drafts.
Your team decides.
Copilot proposes risks, controls, mitigations, and reports. It does not write to the register, sign disclosures, or make risk-acceptance calls. Those still belong to whoever owns them today.
- Surfaces threats relevant to your sector and geography
- Suggests control fit and ranks by effort
- Drafts mitigation options with effectiveness scoring
- Audits the existing register for gaps and stale entries
- Drafts reports for your team to review and sign
Cloud infrastructure & platform security
Built so your security team can sign off without escalation.
EU-hosted on AWS. Zero-trust between services, AES-256 at rest, TLS 1.3 in transit. ISO 27001 and SOC 2 Type II aligned. We’ve already written the answers your security team will ask for.
Read the full security architecture →Start with Norrsent