Project-management-native GRC for consultants
The delivery platform for compliance consultants: project management and audit-grade GRC (ISO 27001, ISO 42001) in one system. Your clients, your methodology, your data. Your cloud. Your AI.
Or meet Jessica in the free demo, no signupNew to ISO 27001? See a real control with evidence examples first, then start a simple readiness project.
6
Client projects
78 / 93
Controls on track
124
Evidence attached
82%
Audit readiness
Illustrative example, not a real client’s data.
Jessica catches everything the moment you think of it. The workbench turns it into an audit-ready compliance program.
Free forever
A risk surfaces mid-call. A control idea lands in the shower queue. Jot it, hand it to Jessica, and she files it on your board, whether that's the web or desktop overlay, so nothing slips between the audit cracks. Solo capture and your personal kanban, free. The dog is free; compliance pays.
Try Jessica now: free, no signupThe workbench
Every client company is an isolated Project: compliance tracks, audits, risk register, evidence, and a living kanban plan, with your global planning board sitting above them all.
All 93 ISO 27001:2022 Annex A controls with NIST CSF and SOC 2 crosswalks, plus all 38 ISO 42001:2023 AI-management controls, each with guidance and a concrete example of conforming evidence.
Audit → findings → corrective actions → verification: the ISO internal-audit loop as a workflow, ending in a dated, professional readiness report you hand your client.
Bring your own model: local Ollama by default, OpenAI or Anthropic opt-in with your keys. Ask it: does this evidence satisfy control A.8.12? Verdict, reasoning, and what's missing.
And underneath it all: your compliance roadmap and project plan are the same living board: PM on top of GRC, not a separate tracker.
The loop you already run as a consultant, minus the spreadsheet archaeology.
Step 1
One container per client company. Add the framework packs the engagement needs and invite client contacts: they view, comment, and upload evidence for free.
Step 2
Every control ships with guidance and a concrete example of conforming evidence. Attach files, links, or notes per item, and let your own LLM check whether the evidence is sufficient.
Step 3
Run a dated audit and produce a professional audit-readiness report: the billable deliverable your client keeps, with gaps and next steps spelled out.
Meanwhile, in the background
Jessica keeps catching stray risks, controls, and tasks, and files them into the right client Project.
Each pack is a complete engagement kit: guided checklist with a concrete example of conforming evidence per control, evidence slots, an audit template, and a report template. Packs stay updated as standards revise, and crosswalks light up when a Project holds more than one.
ISO 27001 and ISO 42001 ship inside every Solo and Consultancy subscription, no extra pack fee. Additional standards, starting with SOC 2, are $25/mo add-on packs. Run as many client Projects on a pack as you like.
The full information-security management pack: guided Annex A checklist with concrete evidence examples, evidence slots, audit template, and readiness-report template.
AI management systems: the standard everyone will be asked about and almost nobody tools for yet. All 38 Annex A controls with concrete evidence examples, study notes per control, and crosswalks to your 27001 track, NIST AI RMF, and the EU AI Act.
The US attestation pack, shipping when the pull is real. Same shape: guided checklist, evidence examples, audit and report templates.
Vanta and Drata price per company and assume you are the company. GRCDog works whether you are the consultant with six of them, or the one company getting audit-ready on your own. Compliance by design means the same living board serves whoever is running the program.
Five clients, three overlapping frameworks, one brain. GRCDog gives each client an isolated Project, lets you reuse control structures across them, and generates the professional deliverables your invoices point at.
“We need the certificate for that deal.” The guided checklist with concrete evidence examples turns the standard into a to-do list you can work through yourself, with or without a consultant. No expertise assumed.
Run dated internal readiness assessments against any active pack and hand leadership a report that reads like it cost a consulting engagement.
Breaking into GRC as a career changer? Join the early-access list for the job-seeker portfolio track
Start here
If a customer just asked for your certificate and this is all new, GRCDog walks you from “what even is Annex A?” to a simple readiness project in three steps, with or without a consultant.
Look at two actual Annex A controls (access control and logging) with the exact evidence examples the product gives you. No signup.
The setup wizard asks about your company and picks ISO 27001 for you. No jargon, no consultant required to get started.
The standard becomes a to-do list: each control tells you what it means and what evidence to attach. Progress is visible from day one.
Solo runs $99/mo with ISO 27001 and ISO 42001 included: roughly one billable hour. The per-company platforms start around $7,500–40,000 a year, per client.
$99/mo
Your clients, your methodology, your data.
$249/mo
For agencies running client staff as editors.
5 included editor seats · +$15/mo per extra editor
$25/mo each
Add standards beyond the ISO base.
from $499/mo
Your own private cloud instance. Never discounted.
Client collaborators are always free and unlimited. Self-hosted licensing comes later: your data can stay on your own infrastructure.
Your data lives in a VPC you own. You keep your own Hetzner account and its infrastructure bill; GRCDog sets everything up and keeps an eye on it. This is priced on its own axis: it is not part of, and never bundled into, your Pro or Team subscription.
One-time setup: infrastructure-as-code, region selection, secrets, and how-to videos. You own the account; we do the wiring.
from $499one-time
Ongoing resource-consumption alerts, capacity forecasts, and update orchestration for your VPC.
from $49/mo
Exact pricing is quoted per region during onboarding. Investors and early-birds run on GRCDog-hosted VMs during the beta.
Compliance by design, built in the open. Here's what's shipping now, what's next, and the vision behind it, with no dates beyond the beta.
Now
Next
Later
For the buyers where data sovereignty is the deal, GRCDog never touches the data plane.
Six founding-partner slots. Free for the private beta, then 50% off year one, grandfathered at 30% off for as long as you stay. Tell us which plan fits: no charge today, just your place in line.
Want the desktop & iOS companion early?
The Jessica companion ships through TestFlight first. Register as an Apple Developer to get on the beta build.
Consultants, communities, and content creators: send us customers and share in the revenue for a full year.
On every customer you refer, including framework packs. Computed off the actual Stripe invoice.
Referrals are tracked by your personal link and a Stripe promotion code. Customers get 20% off their first 3 months.
Commissions approve 60 days after each invoice and pay out quarterly once you've earned $50+. US affiliates submit a W-9.
We approve every affiliate by hand, so expect a reply within a few days. A flat $100 one-time bounty is available as an alternative to revenue share.
More detail in the help center, or try the free demo, no signup required.
AI collapsed the cost of building, so shipping a working product no longer proves much on its own. At diligence, an acquirer or investor comparing two similar companies picks the one whose compliance is already closed; the other inherits a three to six month cleanup tax before the deal can close. Compliance readiness is the differentiator that survives.
GRCDog is its own receipt: an AI-agent fleet, orchestrated by one person, built this platform in under three weeks, and it runs its own ISMS on itself the whole way.
Jul 2, 2026
First commit
526
Commits
40+
Merged PRs
1,600+
Tests
GRCDog is being built in the open by a PMI-certified project manager and working GRC consultant, and it runs its own compliance on itself. Join the early-access list and shape what ships.
Prefer to sniff around first? Play with Jessica in the free demo
