We have no security team.
Fix: Our Swiss experts set up your program in Acuna GRC for you, while your team keeps building the product.
See program setupStartup
Compliance software for startups
Your first enterprise customer wants proof. Start from a plan that already works.
Acuna GRC gives a small team a step-by-step roadmap, starter controls and policies to adopt instead of writing them, and an assistant that prepares the work for you to confirm. Our Swiss experts can set it all up for you.
1 · PICK YOUR FRAMEWORKS4 adopted
✓ISO/IEC 27001:2022Adopted
✓NIS2 DirectiveAdoptAdopted
✓FINMA Circular 2023/1Adopted
✓NIST CSF 2.0Adopted
2 · CLOSE THE GAPSApply selected
Orphan requirements4112Aiko proposes
✓Backup and disaster recoveryLinked
✓ICT readiness for continuityLinked
3 · FOLLOW THE ROADMAPISO 27001
SupportLeft to do: 94
✓Context and leadershipDone
✓Planning and riskDone
Does this sound like you?
Why is a first security audit so hard for a startup? Nobody has done it before.
A big customer asks for ISO 27001 or SOC 2, and the team that builds the product now has to write policies, set up controls and prove they run. Most of it is new to everyone.
We don’t know where to start.
Fix: The compliance roadmap puts the steps of your framework in order. Approve & seed creates the tasks, controls and documents in one pass.
See the roadmapWe’d write every policy from scratch.
Fix: Deploy Templates adds starter documents aligned to your frameworks, and Add from repository adopts controls from a curated catalog.
See starter policiesHow Acuna GRC covers it
What should compliance software do for a startup? Show the way, then do the paperwork.
Acuna GRC gives you the steps in order, controls and policies to start from, and one place to answer the security questionnaires your customers send.
01 · Comply
Where does a small team start?
Adopt your framework in Comply and open its compliance roadmap, switched on for your organization by Acuna: an ordered path of steps grouped in phases. Tick the items you want and Approve & seed creates the tasks, controls, measures and documents in one pass, already linked.
See Comply →02 · Implement
Do we have to write every control ourselves?
No. In the Control Library, Add from repository adopts controls from Acuna’s curated catalog, filtered to your frameworks, with suggested measures pre-checked. Then choose how each control is judged and set its schedule.
See Implement →03 · Operate
Do we have to write every policy from scratch?
No. Deploy Templates offers curated bundles of starter documents aligned to your selected frameworks: preview them, deploy, and they become your own templates under Operate → Documents, ready to edit, approve and publish.
See Operate →04 · Trust Center
How do we answer a big customer’s security questionnaire?
Import the customer’s own file into the Trust Center. Answers are drafted from the facts you have approved and nothing else, your team reviews them, and the approved answers go back into that file.
See Trust Center →Aiko at your pace
How much can AI do for a startup? Aiko prepares. You decide.
Ask which controls have no measure and Aiko plans the missing links in a bulk run on its own page. Nothing is linked until you tick what is right and click Apply.
1Aiko proposes
Bulk run · Ready for reviewWhich controls have no measure? Plan the missing links.12 controls have no measure · a link planned for each✓CTRL-012 → IAM-05Both cover privileged access reviews.High✓CTRL-017 → IAM-05Rotation is part of managing secrets.High✓CTRL-031 → ASM-01Partial overlap with the inventory.Medium2You confirm
You tick the links you trustApply✓2 links applied, saved in the Activity logControls with no measure12103You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
Your roadmap, checked
Ask Aiko about this roadmap, and it compares the plan with your live data.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Can someone run it for us while we build the product? Yes, our experts set it up.
With program setup in Acuna GRC, our Swiss experts put your frameworks, controls and policies in place for you, so your team can keep building.
GRC Consulting team leader
Bénédicte Sévin
GRC project leadership.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Cybersecurity governance expert
Jean-Emmanuel Rodriguez
Gap analysis and framework implementation
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youProgram setup
Our experts run it. You review.
Program setup in Acuna GRC, done for you
- Adopt your frameworks and follow the roadmap
- Put starter controls and policies in place
- Get you ready for your first audit
Integrations
Does Acuna GRC connect to the tools a startup runs? Yes, with 100+ connectors.
Identity, cloud, code, devices and HR: connectors pull the data on a schedule, so measurements and control results come in without anyone typing them.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Google Workspace
Entra ID
Okta
JumpCloud
Microsoft 365
AWS
Azure
Google Cloud
GitHub
GitLab
Jamf Pro
Intune
CrowdStrike
Personio
KnowBe4
Jira
Slack- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Which parts of Acuna GRC does a startup use? The core, then what you need.
Start with the four core workspaces and Aiko. Add the Trust Center when customers send questionnaires, and more modules as you grow.
Acuna GRC core
Add-on modules
Across the platform
FAQ
What else do startups ask about compliance software?
Should a startup start with ISO 27001 or SOC 2?
Start with the one your customers ask for. Both run in Acuna GRC on one library of measures, so the work for the first one counts toward the second. SOC 2 in Acuna GRC
How do we get ready for the audit itself?
Assure keeps your records and audits in one place. Our experts can also prepare the audit with you. Audit preparation
What happens when we grow?
You keep the same library and add frameworks, scopes and modules as you need them. Larger groups add group management, access rules and the API. Acuna GRC for enterprises
How is Acuna GRC priced?
Pricing is per organization, not per seat; the price depends on the modules you add. See pricing
Where is our data hosted?
In Switzerland, the EU or the US, as you choose.
First audit on the horizon? Start from a plan.
Tell us which framework your customer asks for. We show you the roadmap, the starter controls and policies, and how our experts can set it up for you.
Hosted in Switzerland, the EU or the US