Skip to content
CompliKey
Cyber governance · Evidence-based audit

Run your governance. Prove your progress.

The level that counts is the one the audit has proven. CompliKey links your frameworks, internal audit, tasks, documents and statement of applicability in a single thread, and tells you every week what to do next.

Book a demo Try it free

No credit card · Your data exportable at any time

Application home screen, sample account.
What sets us apart

The level that counts is the one the audit has proven.

You first declare your level, control by control. Your internal audit, scored on evidence, confirms or corrects it. The score retained is always that of the latest published audit; until an audit has confirmed it, the level stays marked “Declared”.

The result: a compliance table you can show your management or an auditor without having to defend it line by line.

The method, as the application guides you

Five steps, the same for every client.

Each step unlocks the next. At any time, the application home screen shows the current step and the next action.

  1. 1

    Scope

    Choose the information system and the frameworks. Shared controls are created only once.

    SoA · Compliance
  2. 2

    Audit

    A score per control, from 0 to 4, backed by evidence. An audit is complete only when every applicable control is scored.

    Audit
  3. 3

    Declare

    The level of each control, from Non-existent to Optimised, and a justified statement of applicability, published as a version.

    Compliance · SoA
  4. 4

    Remediate

    Every audit finding gets a task, an owner and a due date, tracked through to the effectiveness check.

    Tasks · Remediation
  5. 5

    Monitor

    Dated evidence, documents reviewed on time, visible deadlines. The next review starts from the history.

    Documents · Dashboard
The product

The screens you will use, not illustrations.

All modules

Multi-framework compliance

A control assessed once covers several requirements. Marketplace frameworks are versioned: you choose when to apply an update.

Evidence-based internal audit

Set up in 3 steps, full or flash audit. Each finding is qualified in auditors' vocabulary and becomes a tracked remediation. Report exported to PDF.

Versioned statement of applicability

Published through a 4-step wizard and approved by its owner. Every exclusion is justified, every version kept. PDF in your colours.

Tasks and remediation

List, Kanban, calendar and “My tasks”. On closure, the application suggests the new level. Jira key and CSV export to follow up in your own tools.

Documents and reviews

Your policies and procedures stay in your tools; CompliKey keeps the link, the version and the review date. No policy goes out of date unnoticed.

Risks and treatment plan

Configurable 4 x 4 matrix, aligned with EBIOS RM. Each risk is linked to the controls and tasks that treat it, and submitted for approval.

Fragments reconstructed from the application's designs, sample account.

Consultants, auditors, virtual CISOs

Your method, your deliverables, at every client.

  • One workspace per client, your internal frameworks reused
  • Statement of applicability and audit report with the client's logo and your firm's
In preparation Portfolio view: delays and audit score for each client
See CompliKey on an engagement
SMEs and mid-sized companies

Every week, you know what to do next.

  • A next action, not a 200-row spreadsheet
  • A summary view for management, which must approve and oversee the measures under NIS2
  • Guided onboarding included in paid plans
See CompliKey in my context
“A method proven in the field and suited to the SME context.”
Beta tester, 2025
“At last an affordable platform to frame my engagements.”
Beta tester, 2025
“The first GRC platform suited to SMEs and accessible to clients.”
Beta tester, 2025

Quotes translated from French.

Trust

Everything your procurement team will ask for, before they ask.

Your security gaps are sensitive data. We publish what we do, what we do not store, and how you get your data back.

Security and trust
Terms of sale and useIn French GDPR data processing agreementPart of the contract, sent on request SubprocessorsList and purpose (in French) Service statusService availability (new tab)
Daily backups7 and 30-day retention Evidence by linkYour files stay with you PaymentCard or SEPA direct debit
Public prices, excluding VAT

Start free. Pay when it helps.

Compare plans
Freemium €0 No credit card · no time limit · 1 scope
Business €199 /month excl. VAT or €1,990/year excl. VAT · 3 scopes
Advanced €349 /month excl. VAT or €3,490/year excl. VAT · 5 scopes

Guided onboarding included in paid plans. Full 30-day trial granted after a demo.

Frequently asked questions

Does the internal audit replace a certification audit?

No. The internal audit carried out in CompliKey prepares the certification audit; certification is still issued by an accredited body.

I have never been audited: where do I start?

With the declared level. You assess each control yourself; the internal audit then confirms or corrects that level.

Can I get my data back if I stop?

Yes. Controls, levels and tasks export to CSV, the statement of applicability and reports to PDF, at any time. After the contract ends, you can still request an export for 30 days; backup copies are deleted no later than 90 days afterwards (terms of sale, article 11).

Where is my data hosted?

By OVHcloud, in France. Evidence is referenced by link: no file is stored, your documents stay in your own tools.

See CompliKey on a complete engagement.

Scope, audit, declaration, remediation, monitoring: the whole journey, on the sample account.

Book a demo Try it free