Governance
Approved and signed policies, defined roles and management oversight based on up-to-date data.
Governance · Risk · Compliance
The GRC solution that takes you from Excel to control.
Audexa brings together audits across 22 frameworks, risk management, policies, evidence, assets and management reporting in one platform. With Focus mode it shows you only what your framework asks for and gives you a single next step; with Sites and group, you run several sites and subsidiaries from a single screen.
- 22 frameworks and 1,763 controls
- 2,543 cross-framework mappings
- 5 languages
22 frameworks with full content in five languages
1,763 controls with guidance, suggested evidence and remediation steps
67 editable policy templates with approval and signature
2,543 cross-framework mappings to reuse evidence
Why a GRC platform
When compliance lives in spreadsheets, nobody sees the full risk picture.
Every new regulation (NIS2, DORA, the AI Act) adds requirements that overlap with the previous ones. Without a platform, the same work is repeated in every audit and management has no single view.
Risk
Risks derived from real gaps, rated by likelihood and impact, with traceable treatment and acceptance.
Compliance
Audits per framework, reusable evidence and an action plan you can track and prove.
What's included
The full GRC cycle, connected in one platform.
Every module shares data with the others: a piece of evidence, a risk or a task is visible from every framework it affects.
Compliance
Audit and measure against each standard.
22 frameworks
NIS2, DORA, ENS, ISO 27001, NIST CSF 2.0, SOC 2, ISO 27017, Cyber Resilience Act, TPRM, GDPR, LOPDGDD and LSSI, ISO 27701, ISO 27018, EU AI Act, ISO 42001, ISO 37301 / UNE 19601, whistleblowing channel, ISO 9001, ISO 14001, ISO 45001, ISO 20000-1 and ISO 22301.
Focus mode
Choose your framework and Audexa shows you only what it asks for. Your path gives you a single next step, with the reason for it and the approximate time.
Smart audit
Suggested answers with their source, a consistency check before submitting and how many points each gap adds. A person always decides.
Continuous auditing
Scheduled re-audits, cycle-to-cycle comparison and Statement of Applicability.
Risk
Prioritize what really matters.
Risk matrix
Risks derived from gaps, with treatment and acceptance signed by management.
Assets and third parties
Devices, software, SaaS, suppliers and contracts with an owner and periodic review.
CVE exposure
vRadar matches your inventory against known vulnerabilities and creates remediation tasks.
AI Governance
Registration, classification and obligations under the EU AI Act.
Governance
Decide, document and report.
Policies and signatures
67 templates with versions, approval and internal or link-based signing.
Reusable evidence
A private evidence vault with expiry, review and history.
Reports and dashboard
Executive and technical reports in PDF, Excel and Word, plus a configurable dashboard.
Sites and group
A main site with branches and subsidiaries, a group overview with a map and ranking, and custom roles by group, region or site.
Some features depend on your plan and active modules.
Focus mode
Concentrate on your framework and go step by step.
Choose the framework you want to work on, for example NIS2, and the Focused view shows you only what it asks of you. Your path is the new home page: your score, the phase you are in and a single next step. Nothing is deleted: everything else stays under More or behind See all.
- Each question shows its exact reference where one exists: the article or the clause
- Suggested answers with their source, which you accept or change one by one
- Consistency check before submitting: it warns, never blocks
- Points per gap and a plan toward your target, with one task per gap
Sites and group
Several sites and subsidiaries, one program.
A main site manages its sites: each branch or subsidiary keeps its own data and its own team, and works with the group's plan. Audexa activates it on request on Premium (3 sites) and Diamond (5), extendable.
- Group overview with a map, ranking and site comparison
- Custom roles by group, region or site, with expiring access
- Suppliers, policies and evidence shared without duplicating
- Multi-site ISO 27001 audit and the group's DORA register of information
Multi-framework
Do the work once, meet several standards.
Cross-framework mappings let you reuse evidence and suggest reviewable answers when coverage is high. A control is never marked as compliant automatically.
- ISO 27001 ↔ NIS2, ENS, GDPR, NIST CSF 2.0, ISO 9001 and ISO 14001
- DORA ↔ ISO 22301 for business continuity
- Evidence linked to several controls without duplicate files
- Reviewable drafts, always with a human decision
Mappings2,543 pairs
- ISO 27001 ↔ ISO 900153 pairs
- ISO 27001 ↔ ENS122 pairs
- DORA ↔ ISO 2230146 pairs
- NIS2 ↔ ISO 2700161 pairs
- GDPR ↔ ISO 2700143 pairs
Integrations
Connect Audexa with your team's tools.
Your inventory is fed by your device management and security tools, tasks can become Jira issues, and the REST API and MCP server let you query your compliance from other systems and, with each key's permissions, create and update tasks. They never approve or delete.
- NinjaOne and SentinelOne for the inventory, in read-only mode
- Jira Cloud to turn tasks into issues
- REST API and MCP with per-key permissions
- Sign in with Google and Microsoft, with two-factor authentication
How it works
Launch your GRC program without a months-long project.
Choose your frameworks
Start with the most urgent standard and add the rest, reusing the work already done.
Measure and prioritize
Guided audits, weighted gaps and risks rated by likelihood and impact.
Govern and report
Tasks with owners, signed policies, current evidence and reports for management.
Before and after
GRC in spreadsheets vs. GRC with Audexa.
AreaSpreadsheets and foldersAudexa
Overall view
One Excel file per standard
Dashboard covering every framework
Risks
Matrix isolated from compliance
Risks derived from real gaps
Evidence
Duplicated in every audit
One piece of evidence for several controls
Policies
Word files with no version or signature
Lifecycle with approval and signature
Reporting
Manual slide decks
Exportable executive reports
Where to start
Unordered lists of requirements
Your path with a single next step
Several sites or subsidiaries
One Excel file per site
Group overview and shared resources
Frequently asked questions
What people usually ask us about GRC software.
What is GRC software?
A platform that brings together governance (policies, roles, decisions), risk management and regulatory compliance so the organization manages them in a connected way rather than in isolated documents.
Which standards does Audexa cover?
22 frameworks: NIS2, DORA, ENS, ISO 27001, NIST CSF 2.0, SOC 2, ISO 27017, Cyber Resilience Act, third-party risk management (TPRM), GDPR, LOPDGDD and LSSI, ISO 27701, ISO 27018, EU AI Act, ISO 42001, ISO 37301 / UNE 19601, whistleblowing channel (Spain's Law 2/2023), ISO 9001, ISO 14001, ISO 45001, ISO 20000-1 and ISO 22301, plus the AI Governance module. Framework availability depends on the plan.
Does Audexa answer the audit for me?
No. The smart audit suggests answers with their source (evidence, other audits, assets, policies or tasks) and flags the ones that don't add up before submitting, but a person accepts or changes each one. Nothing is answered or submitted on its own.
Does it work for a group with several sites?
Yes. With Sites and group, a main site manages branches and subsidiaries that keep their own data and team, shares resources and sees the status of all of them in a group overview. Audexa activates it on request on Premium (3 sites) and Diamond (5), extendable.
Is it a tool for large companies?
Not only. Audexa is designed so that a small IT, security or compliance team can run the program without relying on ongoing consulting, and it scales to organizations with several teams.
How long does implementation take?
It's a web platform: you can start your first audit the same day. With Focus mode you choose your framework and Your path tells you the next step; assets, policies and evidence are loaded progressively.
Which languages is it available in?
Interface, frameworks, policies and reports in Spanish, English, French, Italian and German.
Where is the data hosted?
Audexa runs on EU infrastructure, with role-based access, two-factor authentication and activity traceability.
Request a demo
See Audexa with the frameworks that matter to you.
In 30 minutes we look at your starting point, the frameworks that apply to you and what your GRC program would look like in Audexa.
- We review which regulations affect you today and which are coming.
- We show you audits, risks, policies and evidence working together.
- We explain which plan fits your team.