One platform for all your compliance

Atalaya GRC is compliance management software that brings together in one place what you keep today in scattered spreadsheets. For example, it shows which regulations apply to you and what each service complies with. It also tells you what evidence backs it up and which deadlines are coming. As a result, you get less chaos, less risk and the peace of mind of always staying ahead. If you are comparing options, start with our guide to choosing GRC software. You can also download the product datasheet (PDF).

Per-service compliance management

Instead of a blurry company-wide average, it shows the real status of each service. In other words, what it complies with, what’s missing and which regulation requires it. You define your services once, and then the compliance management software works out which obligations they’re subject to. As a result, you know exactly where you stand, not a global percentage that says nothing.

Charts from a dashboard on a screen, the kind of view compliance management software gives you

The regulatory clock: never miss a deadline again

The compliance management software tracks your deadlines and recurring obligations, from notifications to reviews and renewals. It also warns you in advance by email. Therefore, critical dates (24h, 72h, expiries) no longer depend on someone remembering. Atalaya warns you before the date catches you out.

One control, several regulations: compliance management without duplication

Here’s the real saving. You define an evidence item or a control once, and then it’s reused by every regulation that shares it. NIS2, DORA, ISO 27001 and the ENS overlap in much of their requirements. So instead of doing the work four times, you do it once. Therefore, the more regulations you manage together in the compliance management software, the more you save.

And more from the compliance management software

Document management with evidenceAll your compliance documentation centralised, with its audit trail and ready for an audit. Every requirement also comes with its evidence, so there is no digging through scattered folders.
Incident management and reportingLog incidents and prepare notification drafts, with their deadlines under control. Each draft carries the fields its authority asks for: DORA, NIS2, GDPR, CRA, ENS (via CCN-CERT) and the EU AI Act.
Downloadable compliance reportsGenerate reports on your compliance status whenever you need them: for management, a client or an audit.
For consultants and groupsDesigned for those handling compliance for several clients. Each company is also an independent, isolated space with its own compliance. It is therefore ideal for consultants and firms managing multiple clients.
Per-service dashboardAn at-a-glance view of each service’s status and of all your compliance, so you instantly know where to focus.

Risk management

Identify, assess and treat your risks (ISO 27005) by likelihood and impact, both inherent and residual. A heat map then shows at a glance where to act first.
Third-party (vendor) managementKeep your critical providers under control, with the services they support and their contract validity. You also see which regulations they cover (DORA, NIS2, GDPR, ENS). In short, the third-party oversight the new rules demand.
Vendor questionnairesSend security questionnaires to your providers via a secure single-use link. Then collect their answers and attach the evidence, without endless email threads.
AI systems inventoryRegister your AI systems and classify them by EU AI Act risk level, including GPAI and generative AI. You can then see the obligations and dates that apply to you (high risk: 2 December 2027 and 2 August 2028, under Regulation (EU) 2026/1744).
Business continuity (BIA)Per-service business impact analysis: RTO, RPO and MTPD with the dependency chain. As a result, you know what to recover first and how fast, in line with ISO 22301.

And much more in our compliance management software

Assets and dependenciesInventory of assets linked to your services, plus a dependency map. That way you understand what underpins each service and, in particular, how a failure spreads.
Privacy and GDPRRecords of Processing Activities (ROPA) and data protection impact assessments (DPIA). In addition, data subject rights management (access, erasure and more), all in one place.
Operational resilience testingPlan and record the resilience tests DORA requires, with their schedule and results. Each test is also linked to the services it assesses.
Task managementTurn findings, risks and incidents into tasks with an owner and a due date. Then track your open tasks so nothing falls through the cracks.
Indicators and KRIsA dashboard with your compliance KPIs and key risk indicators (KRIs). You can therefore monitor progress and stay ahead of problems.
Audit logFull traceability of who did what and when, with the before and after of every change. In other words, the evidence any audit asks for.
Microsoft 365 / Entra ID integrationSync the users from your Microsoft Entra ID directory (read-only). As a result, there is no manual onboarding and the list is always up to date.
SSO sign-in (Entra ID)Federated access via OpenID Connect and Entra ID, so users sign in with their corporate account. It also offers automatic provisioning and optional enforced SSO, with a break-glass account.

AI assistant (optional)

Optional AI assistant to analyse compliance gaps and draft documents, always with human review. Moreover, the model is hosted in the EU (Azure OpenAI) and identifiable personal data is removed automatically before each query. Enabled by licence when you need it.
Continuous evidenceConnect your identity provider (Microsoft Entra ID, Google Workspace) and Atalaya collects evidence automatically and periodically. That evidence then feeds your compliance status and indicators, with no manual gathering.
Two-factor authentication (2FA)Strengthen access with a second factor via an authenticator app (TOTP), on top of SSO sign-in. It is optional per user, with backup codes, and every login is also recorded in the audit trail.
Compliance exceptionsDocument and justify exceptions when a requirement does not apply or the risk is accepted, with approval and validity. As a result, they are traceable decisions, not gaps.
REST APIConnect Atalaya to your tools through a token-authenticated API, with every access logged. Read your compliance data and, if you allow it, also let your SIEM or ITSM open incidents, risks and tasks. However, write access is granted token by token and is off by default.
ENS Statement of Applicability (SoA)Generate and maintain the ENS Statement of Applicability for Spanish RD 311/2022. It then lists the measures and their reinforcements, by system category and per service.

Regulatory watch

In addition, the compliance management software tracks the regulatory developments that affect your frameworks and services. It also records their assessed impact and adoption status across your organisation.
Policies and trainingFull lifecycle for your corporate policies: draft, approval and review. You also keep a record of your team’s compliance training.
Third-party offboardingClose out supplier exits with a checklist: access revocation, data return or deletion, and evidence of contractual closure.
Data portabilityEvery client downloads all their data as a ZIP with JSON, CSV and files, without depending on support. Real portability, in line with Art. 30 of the Data Act.
Trust CenterA public page with your compliance status, so you answer your customers’ due diligence once. Revocable link, no internal data, and you decide what gets published.
External auditor portalYour auditor enters through a link, with no account, and sees only their engagement scope. They then download the evidence and give their opinion. With reproducible sampling they can verify themselves.
Inbound security questionnairesAnswer the due diligence your customers send you with a library of reusable answers. So what you wrote once is put to work in the next questionnaire.
Accountable peopleLink the roles you write down — CISO, DPO, Head of Risk — to whoever holds them today. When that person changes, you change it in one place and it is up to date across the platform.
Module access profilesBetween “writes nothing” and “writes everywhere”: there is a middle ground. For example, give your legal counsel or your data protection officer write access only in the modules that concern them.

That’s how compliance gets easier

Want to see it with your own services?

Request a demo

FAQ

Frequently asked questions

What exactly does Atalaya GRC do?

It brings your compliance across several regulations into one platform: it tells you what applies, manages documentation and evidence service by service, tracks deadlines and generates reports and notifications.

Does it handle several regulations at once?

Yes, that’s its core: one control is reused across the regulations that share it, avoiding duplicate work.

Can I manage compliance for several clients?

Yes. Each client is an independent, isolated space with its own compliance, so a consultant or firm can manage multiple clients with full separation between them.

How does it warn me about deadlines?

The regulatory clock tracks obligations and expiries and warns you in advance by email.