GRCFlowMulti-entity Attestation

A counterparty queries your instance over an Agent-to-Agent endpoint and gets a signed statement of your control status, recomputed from your latest assessment on every request.

  • Ed25519-signed
  • Both sides self-host
  • Verifies offline

Sign it. Bind it. Verify it. Attest it.

Built for organizations that must keep assuring each other

Wherever one organization has to re-verify another's compliance and the questionnaire has stopped scaling, a signed on-demand query replaces the paperwork.

Parent ↔ subsidiary

Check each business unit's posture on demand. Every subsidiary keeps its own data.

Investor ↔ portfolio

Query a portfolio company's live control status before a follow-on tranche or a board review.

Prime ↔ subcontractor

Verify a subcontractor's CMMC Level 2 posture continuously, not once a year.

MSP ↔ clients

Publish a signed posture per managed tenant and let each client verify it themselves.

Network ↔ partner

Check a merchant's PCI DSS or a partner's SOC 2 status at onboarding, then whenever it matters.

Vendor ↔ customer

Give customers one endpoint to attest against, and query your own vendors exactly the same way.

One posture, shared two ways: the A2A endpoint and the Trust Center

The same compliance posture is exposed for machines through the signed A2A endpoint, and for people through a branded Trust Center page, with every request logged to your audit trail.

The GRCFlow Vendor Portal, subtitled third-party risk management and A2A attestation monitoring: tiles for total vendors, critical tier, high risk and A2A connected, above a vendor table with tier, risk rating, data access, A2A status, next assessment and a Rotate Token action.

Retire the security questionnaire

A vendor record carries the counterparty's A2A status and its own service token, so third-party risk becomes a query instead of a spreadsheet round trip.

  • One protocol and schema for every counterparty, not a different form each time
  • Polled when it matters, rather than collected once a renewal cycle
  • Signed, so it cannot be edited in transit the way a returned document can
  • A NON_COMPLIANT or expired result is a value your own systems can act on
The GRCFlow Trust Center configuration screen: an Enable Trust Center toggle for public accessibility, display name, contact email, description, logo URL and primary colour fields, and a Section Visibility panel with a Compliance Score toggle.

The human counterpart: Trust Center

The A2A endpoint is the machine path. For prospects and auditors, GRCFlow also publishes a brandable page at your own /trust-center/<slug>.

  • Your frameworks, a compliance score and downloadable or NDA-gated documents
  • Per-section visibility, and an access-request workflow for gated files
  • Human-readable and unsigned, on purpose: the A2A endpoint is the verifiable path
The GRCFlow audit log, described in the product as a tamper-evident activity log with hash chain verification: rows of timestamp, action, entity type, entity id and SHA-256 checksum, with a Verify Chain Integrity button.

Share posture without losing visibility

Attestation events land in the same tamper-evident log as everything else in the platform, so you always know who asked for what, and when.

  • Every entry hash-chained and carrying its own SHA-256 checksum
  • Verify Chain Integrity re-checks the chain in place
  • A2A Alerts fan the same events out to your SIEM, with a 60-second redelivery sweep
The GRCFlow framework catalog: SOC 2 Type II, ISO/IEC 27001:2022, CMMC Levels 1 to 3 and NIST SP 800-171 Rev. 2 shown as cards with their control and category counts and a View Controls button, under tabs for catalog, cross-framework mapping, framework changes and assurance map.

What can be attested today

Control-backed posture for SOC 2, ISO/IEC 27001, PCI DSS, HIPAA and CMMC Level 2. The protocol recognizes ten framework identifiers; the rest join as their control mappings are added.

  • Status derived from your latest completed assessment of that framework
  • compliance/capabilities advertises what an instance can attest, and its key
  • All 20 frameworks and 2,082 controls ship in every edition; NIST SP 800-53 Rev. 5 alone is 1,014

Get Flowing

Your free trial is a license key, issued instantly. Run GRCFlow on your own infrastructure, or tour a live instance first.

  1. Get your license key instantlyIssued the moment you submit.
  2. Install on your own serversOne command brings up the full stack.
  3. Run your first assessmentActivate the key, connect AWS, get real verdicts.