RisQore
Multi-Tenant GRC Platform
Run your entire compliance portfolio from one command center.
RisQore is the GRC platform built for advisory firms. Manage ISO 27001, SOC 2, NIS2, DORA and 24 more frameworks across every client: risk, controls, evidence, audits, AI and a white-label client portal. Without a single spreadsheet.
7 days on your selected package · Card required · Monthly billing starts automatically unless you cancel first
48 in the catalogue, 28 ready to activateApplication-scoped client workspacesPrimary hosting documented in Germany
48 in the catalogue · 28 ready to activate · unlimited per client · cross-mapped
ISO 27001SOC 2NIS2DORAGDPRPCI DSSISO 22301ISO 9001HIPAATISAXCyber Essentials
NCA ECC-2:2024NCA CCCNCA DCCNCA CSCCNCA OTCCSAMA CSFCST CRFAramco SACS-210PDPL (KSA)UAE IA (NESA)UAE PDPLSIRA (Dubai)Dubai DESC ISRADHICSQatar NIA
Deep GCC & MENA coverage
The frameworks your region actually audits against
NCA ECC-2:2024, CCC, DCC, CSCC and OTCC, SAMA CSF, CST CRF, Aramco SACS-210, the Saudi PDPL, UAE IA (NESA), UAE PDPL, SIRA, Dubai DESC ISR, ADHICS and Qatar NIA ship as requirement sets you can activate per client — next to ISO 27001, SOC 2, NIS2, DORA and the rest.
The regulator’s own wording, not a template
The Saudi sets were built clause by clause from the official NCA, SAMA, CST and SDAIA documents — current editions, full control lists. You run the actual regulation, not a generic checklist bent into shape.
One evidence base, many frameworks
The crossmap groups every active framework’s requirements by topic, so one control and its evidence can be linked to each requirement it satisfies. Collect once, reuse deliberately — for the auditor in Riyadh and the client in Frankfurt.
Regional and international, one console
Serve a Saudi bank and a European SaaS company side by side. Each client lives in its own isolated, branded workspace.
Kingdom of Saudi Arabia
Built for advisory firms working under NCA, SAMA and SDAIA
Saudi consultants audit against the regulator’s numbering, in the regulator’s structure, and their clients’ staff read Arabic. RisQore brings those needs together in one multi-client GRC console.
- NCA ECC-2:2024108 controls in the 2024 structure — not the retired 2018 edition
- NCA CCC-1:2020provider and tenant cloud controls, 177 requirements
- NCA DCC-1:2022data controls by classification level, 66 requirements
- NCA CSCC-1:2019critical-systems controls, 105 requirements
- NCA OTCC-1:2022OT/ICS controls, 169 requirements
- SAMA CSF v1.0all 32 subdomains with their control considerations, 148 requirements
- CST CRF v2 (2023)ICT-sector regulatory framework, 215 controls
- PDPL + RegulationsLaw, Implementing and Transfer Regulations, article by article
- Aramco SACS-210Third Party Cybersecurity Standard 2026, 149 TPC controls by supplier classification
Arabic client portal
Your client’s employees acknowledge policies, report incidents and see their tasks in clear Arabic, right-to-left, designed for Saudi business workflows. You keep working in English.
Evidence that speaks the regulator’s language
Controls carry the official identifiers (ECC-2-13-1, SAMA-3.3.15-1, DCC-1-1-1), so an NCA or SAMA assessor finds their way without a translation layer.
In-Kingdom deployment on request
Tenant data lives in Europe today. For SAMA-regulated or CCC-classified workloads we set up a dedicated deployment on a Saudi cloud region — scoped, priced and confirmed with you before anything moves.
Control lists are derived from the published official documents and kept current with new editions. They support your professional judgement; they do not replace the regulator’s text.
Managing many clients on spreadsheets doesn’t scale
If any of this sounds familiar, you’ve outgrown the old way.
Every client in a different file
Versions drift, evidence goes missing, and nobody trusts the master copy.
Audit season is a scramble
Days lost hunting for the screenshot, the policy version, the sign-off.
You can’t grow past a handful
Each new client means more manual work. So you stop saying yes.
The RisQore difference
One platform for your whole book of business
One portfolio
Every client in its own isolated, branded workspace, managed from a single command center.
Answer once
Cross-framework control mapping means evidence and answers carry across ISO, SOC 2, NIS2 and more.
Prove it fast
Trust Center, scoped exports and continuous monitoring help teams keep current evidence ready for review.
Built for the people who run compliance for others
If you carry more than one organisation’s posture, RisQore is for you.
Consultancies
GRC & ISO consultancies
Run every engagement from one console: onboard a client, pick frameworks, and deliver a structured programme without rebuilding spreadsheets each time.
MSSP / MSP
Managed security providers
Add compliance to your managed services. Give each customer a branded portal and prove posture continuously, not once a year.
vCISO
vCISOs & advisory firms
Carry risk, controls and board-ready reporting across your whole book of clients, and show value every month.
In-house
Multi-entity compliance teams
Manage subsidiaries, regions or business units as isolated workspaces under one corporate roof.
Connected GRC workflows, in one platform
From first control to signed audit, the core workflows of a multi-client practice work together.
Compliance core
One control library that satisfies every framework you run.
- ✓Unlimited per client: 48 in the catalogue, 28 ready to activate
- ✓Single control library across all frameworks
- ✓Automatic cross-framework control mapping
- ✓Statement of Applicability (SoA)
- ✓Evidence vault with ownership & status
- ✓Gap analysis & control recommendations
- ✓Certificate lifecycle & renewals
Audit & operations
Everything that turns a programme into evidence on the day.
- ✓Internal & external audits
- ✓Auditor portal & interview mode
- ✓Findings & corrective action plans (CAPs)
- ✓Remediation tracking
- ✓Incident & issue management
- ✓Tasks & workflows
- ✓User access reviews (UAR)
- ✓Regulatory obligations register
- ✓Business continuity (BCM)
- ✓Assets & sites inventory
Risk management
Quantify, treat and monitor risk, with a posture that rolls up.
- ✓Risk register (inherent & residual scoring)
- ✓Interactive risk heatmap
- ✓Key Risk Indicators (KRIs)
- ✓Maturity assessments
- ✓Treatment & remediation plans
Sky, the AI assistant
An expert co-pilot grounded in each client’s own data.
- ✓Talk to Sky: voice in English, German and Arabic
- ✓Draft policies from a prompt
- ✓Summarise gaps & next actions
- ✓Recommend the right evidence
- ✓Answer framework & control questions
- ✓Speeds up onboarding and audit prep
Third-party & privacy
Manage the risk you do not directly control.
- ✓Vendor / supplier risk register
- ✓Supplier security questionnaires
- ✓Portfolio third-party risk dashboard
- ✓Privacy register (GDPR records of processing)
Client experience
Surfaces your clients actually see, under your brand.
- ✓White-label client portal
- ✓Trust Center, NDA-gated and shareable
- ✓Policy attestations & acknowledgements
- ✓Branded, audit-ready report exports
Portfolio command center
Run the whole book of business from one screen.
- ✓Cross-client board & work queue
- ✓Audit-readiness reports
- ✓Executive briefings & ROI dashboard
- ✓Live regulatory feed
- ✓Portfolio-wide posture at a glance
Platform & enterprise
Built multi-tenant and secure from the ground up.
- ✓Central application scope gates per client
- ✓White-label branding & custom domain
- ✓REST API & webhooks
- ✓CSV import / export
- ✓Auditable access and workflow history
- ✓30-day partner-account deletion recovery window
Live in three steps
1
Spin up a workspace
Create a branded, isolated workspace per client in seconds and switch on the frameworks they need.
2
Map, collect & assess
Controls auto-map across frameworks. Collect evidence, run the risk register, and let Sky draft the heavy lifting.
3
Prove & report
Share a Trust Center, export structured reports, and surface evidence and monitoring gaps before review.
What changes when you switch
Onboard a client in minutes
A branded workspace plus a ready framework in a few clicks, not a weekend of spreadsheet surgery.
Answer once, satisfy many
Cross-framework mapping carries one piece of evidence across ISO, SOC 2, NIS2 and the rest.
Walk into audits ready
A live evidence vault, control coverage and audit-readiness reports. No last-minute scramble.
Scale with a consistent delivery model
Reuse governed delivery patterns across clients and keep local decisions visible instead of rebuilding each engagement.
Win more deals
Send prospects a Trust Center link instead of filling in another 100-row security questionnaire.
Your brand, everywhere
White-label portal, custom domain and branded reports. It’s your product, powered by RisQore.
White-label & multi-tenant
Your brand. Your domain. Your platform.
Every client portal carries your logo and colours. On Enterprise, run it on your own custom domain. To your clients it is your product, with RisQore doing the heavy lifting underneath. Access is scoped per client through central application-level tenant gates.
Security controls with stated evidence
Practical controls for your team and clients, with current limitations published separately.
Central tenant scope gates
Each client’s data is scoped and separated. Cross-tenant access is blocked by one fail-closed application scope gate on every request.
Auditable workflow history
Critical identity, access and compliance workflow changes create tenant-scoped audit records.
Role-based access
Owner, member, auditor and client roles with least-privilege defaults.
Account deletion recovery
Partner-account deletion uses a 30-day recovery window before the scheduled purge.
Four packages. Fully modular.
Start small and grow. Every tier includes the full GRC core; higher tiers unlock more clients, seats and capabilities.
Starter
For independent GRC consultants starting out
$99/ mo
5 clients3 seats
- ✓Unlimited frameworks (ISO 27001, SOC 2, NIS2, DORA, NCA ECC …)
- ✓Controls, risk register & policies
- ✓Evidence vault & continuous monitoring
- ✓Audits, CAPs, incidents & tasks
- ✓Certificate lifecycle & cross-framework mapping
- …and the full GRC core
Most popular
Pro
For growing consultancies managing more clients
$199/ mo
15 clients8 seats
- Everything in Starter, plus:
- ✓Sky, the AI assistant
- ✓Trust Center
Growth
Scale your practice with full platform access
$399/ mo
40 clients20 seats
- Everything in Pro, plus:
- ✓White-label branding
- ✓REST API & webhooks
- ✓CSV import / export
Enterprise
Unlimited scale for large GRC firms
$999/ mo
Unlimited clientsUnlimited seats
- Everything in Growth, plus:
- ✓Custom domain
Choose Starter, Pro, or Growth and trial that exact package for 7 days. A card is required when the trial starts. The displayed monthly price is charged automatically afterwards unless you cancel first. VAT is handled by Lemon Squeezy as Merchant of Record. Contact us.
Why firms switch to RisQore
vs. spreadsheets
Reduce version drift and missing evidence with mapped, owned, time-stamped and exportable records.
vs. single-tenant GRC tools
Those are built for one company. RisQore is built for your whole portfolio: isolated clients, one console, your brand.
vs. hiring to scale
Standardise recurring work across clients so the team spends less time rebuilding the same delivery structure.
Frequently asked questions
Who is RisQore for?
GRC and ISO consultancies, MSSPs/MSPs, vCISOs and advisory firms: anyone managing compliance for multiple client organisations from one place. In-house teams use it to manage multiple entities or regions.
Which frameworks are supported?
International: ISO 27001, SOC 2, NIS2, DORA, GDPR, PCI DSS, ISO 22301, ISO 9001, HIPAA, TISAX and Cyber Essentials. Deep GCC/MENA coverage: NCA ECC and NCA CCC, SAMA CSF, PDPL (Saudi Arabia and UAE), UAE IA (NESA), SIRA (Dubai), Dubai DESC ISR, ADHICS (Abu Dhabi Health) and Qatar NIA. Unlimited frameworks per client, custom frameworks, and automatic cross-mapping between them.
Is it really multi-tenant?
Yes. Every client lives in a separately scoped workspace. Your team works across the whole portfolio, while central application checks limit client users to their own workspace.
Can I use my own brand?
On Growth and above you get white-label branding: your logo, colours and client portal. Enterprise adds a custom domain. Enterprise SSO is planned, but is not available today.
What does the AI assistant do?
Sky drafts policies, summarises gaps, recommends evidence and answers framework questions, grounded in each client’s own data. It accelerates onboarding and audit prep.
How is my data secured?
Central application tenant gates and server-enforced roles protect workspace access. Critical identity, access and workflow changes create audit records. Partner-account deletion has a 30-day recovery window. Mandatory tenant-wide MFA and Enterprise SSO are not yet available. The public Trust Center separates current evidence from planned controls.
How does billing work?
Choose Starter, Pro, or Growth and add your card securely through Lemon Squeezy. After 7 days, that exact package continues at the displayed monthly price unless you cancel first. Enterprise is agreed individually.
Run your whole portfolio in one place
Choose your package, use it fully for 7 days, and set up your first branded client workspace.
7 days on your selected package · Card required · Monthly billing starts automatically unless you cancel first