How SolveGRC fits together
SolveGRC is one connected system, not a bundle of modules. Anything you feed it keeps working across the platform: a policy you upload becomes evidence, backs controls, grounds AI answers, and shows up in reports — without being entered twice. This page is the map. Most core module pages also have a Connections button in the page header, which lists what that page consumes, what it produces, and what it feeds.
The map
Flows worth knowing
Upload once, prove everywhere. A document is extracted, chunked, and embedded on upload. From that moment it is searchable, citable by the AI, linkable to controls as evidence, and, once you seal it, attachable to your auditor's requests. Each processed upload is registered in the Evidence Library and quality-scored automatically, and a nightly sweep marks aging evidence stale.
Map once, satisfy many frameworks. Controls crosswalk between frameworks. When a control is satisfied, other frameworks that reach it through an approved equivalent mapping count it too, so activating a second framework is a head start, not a restart. Evidence links are not copied between frameworks.
The cloud does its own paperwork. A read-only cloud connection syncs every six hours. Findings from your provider's security service (AWS Security Hub, Microsoft Defender for Cloud, or Google Security Command Center) arrive mapped to compliance standards, assets land in one canonical registry, and topology and attack paths redraw themselves. New attack paths appear under Attack surface changes, and you can turn on email for new high-risk paths.
Answers compound. A questionnaire answer your team approves is registered as evidence automatically, unless it was approved over an open check. Answers approved in the past year are also used as reference wording when the AI drafts the next questionnaire.
The map is a view, not a second copy. Every night the Knowledge Graph is rebuilt from your frameworks, controls, evidence, crosswalks, and cloud findings, so you can see which controls are proven and which are only asserted, and the AI assistant walks that same graph when it answers. It changes nothing in your records. See Knowledge Graph.
Your carrier reads the same records your auditor does. A cyber-insurance carrier states the controls it needs proven, you accept those terms once, and each reporting period SolveGRC scores the obligated controls from your assessments, evidence and cloud findings into a frozen report the carrier receives after you release it. Some live signals, such as obligation status, reach the carrier before a release. The carrier's report views and downloads are recorded on your own audit chain. See Insurance Exchange.
A partner runs many clients without living in any of them. An MSP works its whole book from one portal: per-client scores roll up into a portfolio view when you refresh them, evidence requests go out in batches to clients with an audit in planning, and reviews and SLAs sit in one queue. When an operator needs to act inside a client, they open a time-boxed session with a stated reason, and the client's audit log records when the session started and ended. Nobody at the partner holds a standing seat in a client. See MSP Portal.
The architecture diagram becomes evidence. Upload a network diagram and SolveGRC turns it into a topology of nodes, connections and zones. After you approve the diagram, each element gets control suggestions for the frameworks you run (a firewall on a boundary points at boundary-protection controls), you confirm the ones that hold, and Link to Evidence registers the diagram as evidence with an integrity hash. Diagrams generated from a cloud account are not registered as evidence. See Network Diagrams.
Everything explains itself. Scores show their inputs. AI answers cite their sources and flag their own weak spots. Coverage score cards and the Review Center show what fed their numbers and when. If you ever wonder "where did this number come from," the answer is one click away — and if it isn't, that is a bug we want to hear about.
Follow a single document through the system
- You upload InfoSec-Policy.pdf to Documents.
- It is extracted, embedded, registered as evidence, and quality-scored — automatically.
- You link it to three access-control controls. SolveGRC re-assesses each one, and when you accept a compliant verdict, the framework's compliance score counts the control.
- A customer questionnaire arrives asking about access reviews. The AI drafts the answer citing the exact passage in your policy; a teammate approves it.
- That approved answer registers as evidence itself, and the AI uses its wording as a reference when it drafts next quarter's questionnaire.
- You seal the policy and attach it to your auditor's request, and the auditor downloads that same file. Nothing is uploaded twice.
That is the platform in one sentence: feed it once, and every module keeps proving things with it.