Platform
Everything a security programme actually runs on
Compliance, risk, third parties, access, vulnerability management and audit in one tenant-isolated workspace — with APIs and automations for everything else.
Core capabilities
Compliance readiness
Framework-by-framework readiness computed from implementations, tests and evidence — never asserted.
Control ownership
Assign owners, applicability, justification, effectiveness and review dates.
Versioned tests
Registered handlers, severity, frequency, remediation and exceptions with expiry.
Evidence intelligence
AI summaries and mapping suggestions that require human approval before applying.
Policy lifecycle
Draft, review, publish, version, acknowledgement tracking and review reminders.
People & training
Employee directory, onboarding/offboarding, training completion and policy acknowledgement.
Devices & assets
Intune device inventory, asset register, ownership, criticality and classification.
Vulnerability SLAs
CVE/CVSS tracking with severity-based remediation windows and prioritisation.
Questionnaire automation
Import Excel, Word, PDF or CSV; draft from an approved answer library with confidence scores.
Trust Center
Per-tenant public page, NDA workflow, expiring grants and visitor audit log.
AI agents
Ten specialised agents with defined tools, tenant-scoped context and approval gates.
Reporting
Executive dashboards, CSV and PDF exports, scheduled reports and audit trails.
Enterprise controls
The platform is built with the same discipline it measures.
Tenant isolation
PostgreSQL row level security on every tenant table, enforced with a non-bypass runtime role plus application-level scoping.
Immutable audit trail
Append-only audit logs protected by database triggers and revoked UPDATE/DELETE privileges.
RBAC & custom roles
Nine built-in roles, validated permission catalogue, vendor and auditor portal isolation.
Session security
Short-lived access tokens, rotating refresh tokens with reuse detection, TOTP MFA and CSRF protection.
Evidence handling
Signature validation, MIME allow-list, size limits, malware screening and short-lived download URLs.
Safe automation
Destructive actions become approval proposals; workflows keep execution history and retries.
See AUREXIS on your own controls
Start with the framework library, connect Microsoft 365, and watch control tests run continuously.