Administration and security
You decide who sees what. And how much Aiko may do.
The GRC platform security features your IT team asks for. Administration and security is where your administrator decides who can come in and what each person can see, and keeps a diary of every change: access profiles, MFA and session rules, an audit log with old and new values, and backups you can restore.
Identity
Sample company · Brenvara AGSecurity
Sample company · Brenvara AGUsers
Sample company · Brenvara AGAudit Logs
Sample company · Brenvara AGThe problem
Why do security reviews stall a GRC purchase? IT asks before it signs.
Before they sign, IT and security reviewers ask who can see what, how sign-in is protected and how you prove who changed a record. When the answers are spreadsheets and promises, the review stalls.
An external auditor needs access, but not to everything.
Fix: a starter Auditor profile, limited to scopes and tags, read-only with one switch.
We cannot prove who changed that risk score.
Fix: the audit log keeps the old and new values of every change. Nothing is discarded.
IT wants MFA and session rules before we sign.
Fix: an MFA policy from Off to Required, session and idle timeouts, allowed email domains and Microsoft sign-in.
How administration works
What can an administrator control in Acuna GRC? Who comes in, what they see, what changed.
Your administrator invites users with a role and an access profile, sets the sign-in rules and reads an audit log of every change. Backups capture your whole organization for download or restore.
How do we decide who sees what?
With access profiles, under Admin → Access Profiles. A profile picks the modules a person sees and, for each record type, whether they edit everything, read everything, work only on their own records, or never see it. Limit a profile to scopes and tags, for example hiding everything tagged Confidential, or make it read-only with one switch.
Acuna seeds the starter profiles Auditor, Control Owner, Risk Owner, Supplier Owner and Evaluator, and Duplicate copies any profile. Access profiles are switched on per organization by Acuna.
Access profiles (RBAC) in detail →Can we enforce MFA and session rules?
Yes. Under Admin → Security, set the MFA policy to Off, Optional, Optional enforced if enrolled or Required: under Required, every user enrols an authenticator app at their next sign-in and receives ten one-use recovery codes. Sessions last 12 hours and end after 2 hours idle by default, and you list the email domains that may be invited.
Continue with Microsoft signs in people who are already invited, once Acuna has enabled it for your organization; no user is created automatically. Each user reviews their trusted devices under Profile → Security and revokes one or all.
Can we prove who changed what?
Yes. Admin → Audit Logs captures every creation, update, deletion, link and unlink with the old and new values, plus administrative actions such as invitations, role changes, security changes and restores. Filter by action, type, user and date, and export to CSV.
Entries older than 12 months move to monthly archive files on the Archive tab, to preview or download. Nothing is discarded.
Can we back up and restore all our GRC data?
Yes. Create Backup captures every record, relationship, history trail, measurement, dashboard and report layout, framework selection, privacy and supplier record. Automatic Backups run daily, weekly or monthly with a retention count, and you download a snapshot as JSON, or as a ZIP with your uploaded files and audit logs.
Restore from a stored snapshot or an uploaded file. A restore replaces your current data, and the confirmation says so.
How do we bring in our existing data and frameworks?
With the Data Import wizard: pick a record type, upload a CSV or Excel file, map the columns, validate every row and import, your risk register for example. Custom frameworks import from CSV or Excel too, and Report Templates, Deploy Templates, notification settings and portal branding are set once in Admin.
Linked records resolve by title, and duplicates are skipped.
Aiko and Administration
How do we limit what the AI may do? You set the ceiling for each action.
Under Admin → AI Agents, set the highest mode anyone may use for each Aiko action, from Suggest only to Do it and tell me. Change a risk score never goes beyond Ask me first, every action lands in the Activity log, and one switch turns AI features off for the organization.
Swiss experts
Can someone set it up with us? Yes, done with you.
Done with you: in Program setup in Acuna GRC, our Swiss experts set up access profiles, imports and templates together with your administrator.
GRC Consulting team leader
Bénédicte Sévin
Program setup.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Cybersecurity governance expert
Jean-Emmanuel Rodriguez
Compliance technology integration
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with youOn Admin
Guidance, reviews and audit preparation with your team.
Done for you
Our experts run it. You review.
Sign-in and directory
Does Acuna GRC work with Microsoft Entra ID? For sign-in, invitations and MFA evidence.
Yes. Invited users sign in with Continue with Microsoft, and the Microsoft Entra Directory card lets an administrator invite people by searching your directory. Identity connectors then measure MFA enrolment in the tools you run.
- Sign-in
Continue with Microsoft
Signs in people you already invited. If a rule in your Microsoft Entra refuses the sign-in, Acuna says so.
- Invitations
Microsoft Entra Directory
Pick the person from your Microsoft directory when you invite them, without syncing users.
- MFA evidence
Identity connectors
Microsoft Entra ID, Okta and Google Workspace measure users, admins and MFA or 2-Step Verification for your KPIs.
Entra ID
Entra Directory
Okta
Google Workspace
JumpCloud
Entra Access Reviews- 100+ connectors in all
Missing a connector? We build it. See Integrations and API
Connects with
How does Administration and security fit with the rest of Acuna GRC? It sets the rules for every module.
Access profiles decide which modules, records, scopes and tags every user sees. Admin also holds the Entra and API settings, the Aiko action policy, the single sign-on request for the Staff Portal and the profiles a head office pushes to its subsidiaries.
- AikoAdmins cap each Aiko action
- Integrations and APIEntra directory and API keys
- Administration and securityYou are here
- ComplyCustom frameworks imported in Admin
- ImplementProfiles decide what people see
- OperateStarter documents deployed here
- AssureReport templates built in Admin
- TPRM (Supplier Shield)Your logo on the supplier portal
- Data PrivacyPortal branding set here
- Staff PortalSSO request sent from Admin
- Group managementProfiles pushed to subsidiaries
- Integrations and APIEntra directory and API keys
- AikoAdmins cap each Aiko action
FAQ
What else do people ask about GRC platform security?
Is Acuna GRC itself ISO 27001 certified?
Yes. This page is about what your administrator controls in your organization; how Acuna GRC secures its own platform is on our own Trust Center. Open Acuna GRC’s Trust Center.
Where is our data hosted?
In Switzerland, the EU or the US. Administration and security is part of Acuna GRC core, included for every organization.
Can we self-host Acuna GRC?
On request. Acuna GRC is cloud by default, hosted in Switzerland, the EU or the US, and self-hosting is available on request.
Who are Acuna GRC’s sub-processors?
Acuna GRC’s Trust Center lists them, with our certifications and audit reports. See the sub-processors on our Trust Center.
Can we brand the supplier and privacy portals?
Yes. Under Admin → Identity, upload your logo and set a legal name, a primary color and a privacy contact email. The logo appears on every supplier portal page, the public DSAR form, the processing activity questionnaire and their invitation emails.
Can we restrict invitations to our own domain?
Yes. Under Admin → Security, list the domains that may be invited, for example your corporate domain plus your auditor’s. Empty means any domain, and the check runs at invitation time.
What happens when someone loses their phone?
They sign in with one of their ten one-use recovery codes. An administrator can also use Reset MFA, which signs the user out everywhere and is written to the audit log.
Start with one step.
Bring your security questionnaire. We'll show you access profiles, the MFA policy, the audit log and a backup on a sample company, and answer your IT team's questions.
Hosted in Switzerland, the EU or the US