DefendFlow Security
GRCFlow one-pager

The self-hosted GRC platform for compliance you can cryptographically verify.

GRCFlow runs SOC 2, ISO 27001, CMMC and 17 more frameworks on customer infrastructure, with a hash-chained audit entry behind every verdict.

Runs on your infrastructure Air-gap ready No telemetry, ever
Frameworks
20
Controls shipped
2,082
NIST 800-53 Rev. 5
1,014
Full-platform trial
30 days

What It Does

GRCFlow runs SOC 2, ISO 27001, CMMC and 17 more frameworks on customer infrastructure, with a hash-chained audit entry behind every verdict.

It is built for organizations that need compliance evidence they can verify, not a dashboard they simply have to believe.

Trust You Can Verify

  • Tamper-evident audit trail: a SHA-256 hash chain behind every verdict, Ed25519-signed when a person records it.
  • Honest state, never a fake green: a control that cannot be verified is a gap, never a fabricated pass.
  • Continuous controls monitoring: seven scheduled jobs watch drift, tests, reviews and training.
  • Automated assessments: deterministic OPA verdicts on live AWS evidence; everything else is labelled review.
  • AI governance: ISO 42001, NIST AI RMF and the EU AI Act ship as first-class frameworks.
  • Board packs and auditor evidence: executive roll-ups; auditors see evidence inline, watermarked and logged.

Framework Coverage

All 20 frameworks ship in every edition.

SOC 2ISO 27001CMMC L1/L2/L3NIST 800-53NIST 800-171NIST CSF 2.0HIPAAGDPRPCI DSSDORANIS2CCPA/CPRANYDFS 500GLBATISAXISO 42001NIST AI RMFEU AI Act

Install. Assess. Prove.

  • Install: one command starts the stack on your own servers: curl -sSL https://get.defendflow.xyz | bash.
  • Assess: connect AWS. Deterministic verdicts run where live evidence exists, labelled review where it does not.
  • Prove: every verdict is hash-chained and signed when a person records it, for your auditor or a partner.

A2A Attestation

  • Live posture: a parent company, prime or bank queries your instance and gets back a signed attestation.
  • Re-checkable: partners can verify the attestation any day without moving into a shared cloud tenant.
  • Included posture: control-backed attestations cover SOC 2, ISO 27001, PCI DSS, HIPAA and CMMC Level 2 today.

Free Trial

  • 30 days: minted instantly, shown on the page and emailed as a backup.
  • 5 seats, 1 organization: the organization name is signed into the key and appears on exported reports.
  • All 20 frameworks: the trial covers the full platform, with no credit card. Nothing converts or renews on its own.