Frequently asked questions
Does using GRC Flow make me compliant or certified?
No. Certification is granted by an accredited certification body after an audit, and compliance depends on what you put in place. The platform prepares the deliverables and evidence; you remain responsible for reviewing and implementing them.
Are deliverables written by AI?
Every deliverable starts from templates and expert libraries (controls, risk scenarios, policy rules). What can be calculated is calculated by the code; where a service uses AI, it writes the text from your answers. Names of people, such as risk owners, are never filled in by the AI. You review and approve every deliverable.
Can I edit the deliverables?
Yes. Every deliverable opens in an editor. Within a pack, its version history lets you compare or restore earlier states; outside a pack, one version is kept.
What happens to my data when a pack period ends?
The pack becomes read-only. Its deliverables and their history stay accessible; a monthly pack can be reactivated, a one-month pack ends.
Can I keep several profiles in one account?
Yes. Your account has its own company profile, and each project can be for one of your clients: that client's company profile prefills every service run for the project, and its deliverables stay apart from yours and from other clients'.
Which frameworks are covered?
ISO/IEC 27001, GDPR, NIS2 and DORA, as well as HIPAA and PCI DSS where they apply, plus your own internal or contractual requirements through the general Gap Assessment.
How do working groups work?
Any account can create a working group and invite people by email; each person joins with a GRC Flow account on the address invited. A group has its own packs and deliverables. Members see each other's name and role, and only what is in the group: your own account stays private, and a deliverable enters a group as a copy. Every member, viewers included, can run a single service; only administrators launch the group's packs.