Integrations and API
Evidence from the tools you already use.
GRC integrations that keep your evidence current. Integrations connect Acuna GRC to the tools your company already uses, so numbers and tasks update by themselves instead of being typed in. 100+ connectors feed your KPIs and controls, tasks sync both ways with Jira and ServiceNow, and an API with webhooks covers the rest.
Add connector
1 · Choose the service
Microsoft IntuneShows managed devices and their compliance state.
Microsoft Defender AlertsCounts open security alerts by severity.
CrowdStrike FalconTracks endpoints, stale devices and high alerts.
Jamf ProTracks Macs, FileVault encryption and stale devices.Microsoft Intune
2 · Connect itMicrosoft Intune
3 · What it feedsIntegrations
Sample company · Brenvara AGMicrosoft IntuneEvery 4 hoursThe problem
Why does evidence collection eat audit season? Someone types it all in.
The numbers an auditor asks for already sit in your identity, device and cloud tools, and the fixes sit in your ticketing tool. Without a connection, someone screenshots, copies and chases them every quarter.
Every quarter we screenshot dashboards for the auditor.
Fix: connectors record KPI measurements and control results every 4 hours.
Tasks live in Jira. Compliance lives somewhere else.
Fix: close the ticket and the task closes; create a task and a ticket appears.
Our CMDB and our GRC tool never agree.
Fix: a scheduled import matches on External ID, and Preview shows what will change first.
How integrations work
How do GRC integrations work in Acuna GRC? Connect once, then it runs.
An administrator adds connectors under Admin → Integrations, and each one feeds KPIs and controls on a schedule. Tasks sync with your ticketing tool, and the API, webhooks and scheduled imports connect your own systems.
How do you collect compliance evidence automatically?
Add connector walks you through four steps: Choose the service, Connect it, What it feeds and Turn on. Each connector suggests its own KPIs and controls, ticked by default. The first sync runs when you turn it on, then every 4 hours: a KPI records a measurement when the value changed, and a control records a pass or fail that updates its health and moves its next due date.
With Microsoft app access, a Microsoft connector signs in as the Acuna app instead of as a person, so a sync does not stop when that person leaves. A Global Administrator approves it once, read-only.
KPIs and their measurements in Assure →Does the GRC tool sync tasks with Jira or ServiceNow both ways?
Yes. Close the ticket and the task closes; create a task and a ticket appears. Title, description, status, assignee and due date sync. On Map tasks you map statuses both ways and choose, for each field, which side wins a conflict. It runs every 15 minutes, or at once with Sync now.
Comments, attachments and work logs do not sync. Cloud versions only. Nothing goes out until an admin picks a scope, and closed and recurring tasks are never sent.
Tasks and treatment plans in Operate →Is there a GRC API, and what can it do?
Yes. API v1 creates and updates tasks, controls, KPIs, assets and third parties under the same access rules as the app, and reads risks. Each key has a None, Read or Write choice per object type. Sync a record by its id in your system in one call, and use the change feed to catch up on what changed since a given time.
API Keys, Webhooks and Scheduled imports appear once the API is enabled for your organization: ask Acuna. Every change a key makes is in the audit log as API: key name.
Request more information →Can our systems react when something changes in the GRC tool?
Yes, with signed webhooks. Your endpoint receives a POST with the full record when a task, control, KPI, risk, asset or third party is created, updated or deleted. Each endpoint runs through an API key and receives only the records that key may read.
Failed deliveries are retried, then offered for Redeliver. Send test posts a ping at once.
Can our CMDB keep assets and suppliers current in the GRC tool?
Yes. Your CMDB, procurement or ticketing tool pushes a CSV of assets, third parties or tasks to a push address, as often as it likes. Rows are matched on an External ID column, and Preview shows what a run would create, update or leave unchanged before anything is written.
Imported third parties are managed in TPRM →Can we get a daily compliance summary in Teams or Slack?
Yes, as daily summaries: a post to a Microsoft Teams channel or a Slack channel with counts and a Review in Acuna link, and a daily Slack direct message to each person with their own items. They are summaries, not a two-way sync: nothing in Teams or Slack acts on Acuna data, and every link opens Acuna GRC with the usual sign-in.
Off until an administrator turns it on under Admin → Notifications. Titles are included only if they choose Include titles.
#compliancemore productive: controls are checked automatically, so fixes start soonerMeasured across Acuna GRC customers.
Aiko and your integrations
How do integrations help the AI? They give Aiko evidence to cite.
Connector-fed KPIs and control executions are the evidence Aiko cites when it checks a risk score. Ask "Does RISK-004 still match its evidence?" and Aiko gathers the last control executions and the KPIs against target, each with its source and date.
Swiss experts
What if the connector we need is missing? We build it.
Missing a connector? We build it, designed around your setup. Done with you: in Program setup in Acuna GRC, our Swiss experts help you choose the connectors and the KPIs they feed.
Cybersecurity governance expert
Jean-Emmanuel Rodriguez
Compliance technology integration.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
GRC Consulting team leader
Bénédicte Sévin
Program setup
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with youOn Integrations
Guidance, reviews and audit preparation with your team.
Done for you
Our experts run it. You review.
Connectors
Which tools does Acuna GRC connect to? 100+ connectors.
Identity, endpoint, cloud, code, backup and people tools feed KPIs and controls, scanners feed vulnerable items, and ticketing tools keep tasks in step. Here they are, by the categories the app uses.
Identity
Microsoft Entra ID
Microsoft Entra Access Reviews
AWS IAM
Okta
Google Workspace
JumpCloud
Endpoint
- Microsoft Intune
Microsoft Defender Incidents- Microsoft Defender Alerts
Microsoft Sentinel- CrowdStrike Falcon
Sophos Central- Jamf Pro
Iru (formerly Kandji)
Cloud posture
Microsoft Secure Score
Microsoft 365
Azure Defender for Cloud
Azure Policy Compliance
Azure Activity Log
AWS Security Hub
AWS GuardDuty
AWS Config
Google Cloud
Scaleway
Code
GitHub Dependabot
GitHub Repository Security
GitLab
Azure DevOps
Backup
Acronis Cyber Protect Cloud
People
BambooHR
HiBob
Personio
KnowBe4
SoSafe- OutThink
Vulnerability scanners
Tenable Vulnerability Management
Qualys VMDR
Rapid7 InsightVM
Tickets and tasks
Jira
ServiceNow
- 100+ connectors in all
Missing a connector? We build it.
Connects with
How do integrations fit with the rest of Acuna GRC? They feed every workspace.
Connectors feed KPI measurements and control executions, the API and task sync read and write tasks, controls, KPIs and risks, and the API keeps your third parties and vulnerable items current.
- AikoEvidence Aiko cites
- Integrations and APIYou are here
- Administration and securityKeys and Entra set in Admin
- ImplementConnectors feed control results
- AssureConnector KPIs on your dashboard
- OperateTasks sync with your tickets
- TPRM (Supplier Shield)The API keeps suppliers current
- Vulnerability managementScanners send vulnerable items
- Administration and securityKeys and Entra set in Admin
- AikoEvidence Aiko cites
FAQ
What else do people ask about GRC integrations?
Do comments and attachments sync with Jira or ServiceNow?
No. Title, description, status, assignee and due date sync. Comments, attachments and work logs do not.
Does task sync work with on-premises Jira or ServiceNow?
No. Task sync works with the cloud versions only.
What happens if the person who connected Microsoft leaves?
With Microsoft app access, nothing stops. The connector signs in as the Acuna app instead of as a person, approved once by a Global Administrator, read-only.
Does removing a connector delete our KPIs?
No. Removing a link never deletes the KPI or control it fed.
Where do we see what ran?
On the Activity Logs tab: every sync and API call, with its status, duration and records affected.
Why can we not see API Keys, Webhooks or Scheduled imports?
Those tabs appear once the API is enabled for your organization: ask Acuna to enable it. Connectors, task sync and the activity log are there for every organization.
Can we import data once, by hand?
Yes. Admin → Data Import brings in a CSV or Excel file of assets, risks, third parties, staff, documents and more, with column mapping and validation before anything is created.
Is Integrations and API an add-on, and where is our data hosted?
It is part of Acuna GRC core, set up by your administrator. Your data is hosted in Switzerland, the EU or the US.
Start with one step.
Tell us which tools you run. We'll show you the connectors that fit, the KPIs they feed and a task syncing with Jira.
Hosted in Switzerland, the EU or the US