Controls and policies
The control inventory with its owner, and versioned policies with staff acceptance on record.
- Multi-standard mapping of each control
- Change history with date and author
- Policy acceptance per person
Legale GRC · Governance, risk and compliance
Governance, risk and compliance on autopilot.
Connect your systems, map your controls once and keep the evidence current continuously. Legale GRC turns compliance into a living operation, not a folder you rebuild for every audit.
Continuous control monitoringLive
MFA access on critical systemsUp to date
Quarterly access reviewUp to date
Backup policy · annual reviewExpires in 12 days
Staff security training94% complete
Evidence from critical suppliersUp to date
Illustrative example of the dashboardAudit ready · 96 %
1 platform
Controls, policies, risks, suppliers and evidence in one place, with traceability for every change.
Multi-standard
One control answers several standards at once: what proves ISO 27001 also serves SOC 2 or the local law.
Living evidence
Evidence is collected continuously from your systems, not the week before the audit.
Move time
Compliance is not lost all at once
It is lost little by little: a policy that needed reviewing, an access nobody recertified, a supplier whose certificate expired. Drag the line and watch the same five controls in both scenarios.
Since the last audit
It has been 0 days
Today30 days90 days180 days1 year
Drag to move time forward
Without a GRC
100% audit ready
Everything up to dateYou have just closed the audit.
With Legale GRC
100% audit ready
Everything up to dateThe evidence collects itself.
Why a GRC
Three things that cost you dearly today
The problem
Evidence lives in shared folders, screenshots and emails. When the audit arrives, someone has to go hunting for it.
With Legale GRC
A single repository
Every piece of evidence is dated, with its owner and its trail. You don't look for it: it's already there.
The problem
Each standard is handled separately, with its own spreadsheet and its own folder. The same control gets documented three times.
With Legale GRC
One control, several standards
The inventory is mapped once and answers every standard you have to meet.
The problem
Customer security questionnaires slow down sales: each one is answered by hand and takes weeks.
With Legale GRC
Pre-approved answers
They come from a validated library, and what is public the customer finds on their own in the trust center.
One control, many standards
Map once, comply many times
The same access control answers ISO 27001, SOC 2, Law 21,719 and your customer's questionnaire. Tap a standard to see which controls cover it, or a control to see how many standards it answers.
38 mappings across 8 controls. Tap a standard or a control.
Control mapped to the standard
Risk that moves
From inherent risk to residual risk
Logging a risk does not reduce it. What reduces it is the treatment plan, with an owner and a deadline. Switch the plans on and watch the matrix move.
Impact
Likelihood
Six modules, one inventory
Governance
Compliance
Risk
Third parties
Trust
Sales
Governance, risk and compliance on the same base
Every module works on the same control inventory. There is no spreadsheet per standard and no folder per audit: there is one control, with its owner, its evidence and its history.
Continuous monitoring and evidence
Evidence is collected from the connected systems, not assembled by hand before each review.
- Automatic, dated evidence
- Alerts to the owner, not to a shared inbox
- Permanent audit readiness
Risk management
Risk register with an impact and likelihood matrix, treatment plans and calculated residual risk.
- Inherent and residual matrix
- A plan with an owner and a deadline
- Progress tracking
Supplier risk
A register of suppliers assessed by criticality, with expirations under control and a file for each one.
- Assessment by criticality
- Alerts for documents about to expire
- A complete file per supplier
Trust center
A public page where the customer finds what they need without emailing you, and the confidential material stays under NDA.
- Public certifications and policies
- Reports and pentests under NDA
- A record of who accessed what and when
Questionnaire assistant
Security questionnaires stop blocking deals: the answers come from an approved library.
- A library of validated answers
- Review before sending
- Traceability of what was answered
What you have to comply with
International standards and local ones
An operator in Chile does not just meet ISO. It meets ISO, SOC 2, the personal data law, the cybersecurity framework and whatever its most demanding customer asks for. All on the same inventory.
International
The frameworks asked of you abroad
- ISO/IEC 27001Information security
- ISO/IEC 27701Data privacy
- ISO/IEC 42001Artificial intelligence management
- SOC 2Audited controls · AICPA
- GDPRData protection · European Union
Chile
What is already a local obligation
- Law 21,719Personal data protection
- Law 21,663Cybersecurity framework · ANCI
- Vitally Important OperatorReinforced obligations
- Labor DirectorateElectronic employment records
Trust center
Stop answering the same email
Every time a customer asks for your certifications, somebody puts together an email with attachments. The trust center publishes what is public and delivers the confidential material under NDA, with a record of every access.
Trust center
ISO 27001ISO 27701ISO 42001SOC 2ISSAANCI Chile
Public Current certifications
Public Security and privacy policies
Public Subprocessors and suppliers
Under NDA Audit report
Under NDA Penetration tests
We use it ourselves first
Despapeliza runs its own public trust center. What we are proposing is not an idea: it is the tool we use to answer our own customers' audits.
How it is implemented
Connect, map, monitor, prove
Step 01Connect
The identity, infrastructure, HR and document systems the evidence comes from are integrated.
Step 02Map
The control inventory is defined once and cross-mapped to every standard you have to meet.
Step 03Monitor
Controls check themselves and, when something fails or is about to expire, the named owner is notified.
Step 04Prove
The evidence is already there: for the audit, for a tender or for a customer's questionnaire.
Where the evidence comes from
A GRC does not invent the evidence: it collects it
The evidence already exists in your operation. It is in the contracts being signed, in the policies the team accepts and in the files being archived. The rest of the ecosystem hands it over on its own.
Legale CLMObligations into controls
Obligations arising from a contract become controls with an owner and a deadline.
Legale SignSigned policiesPolicies and agreements signed electronically remain as evidence with their own traceability.
DigitizationPaper joins the circuitFiles still on paper become auditable, indexed documentation.
Legale APICollection with no manual workThe integration brings the evidence from your systems, with nobody having to go and fetch it.
Boardroom questions
Does this replace the compliance officer?
No. It takes off their plate the part that needs no judgement: gathering screenshots, chasing expirations and rebuilding folders. The decisions remain theirs.
Is it useful if we are not certified yet?
That is when it helps most. Starting with the control inventory mapped to the standard you are after shortens the preparation, because evidence builds up from day one instead of being gathered at the end.
What about Law 21,719?
It is mapped as one more standard in the inventory. The controls you already have for ISO 27701 cover much of its requirements, and the rest shows up as a visible gap with an assigned owner.
How does the evidence get in if our systems are old?
Through the API when the system exposes it, and through controlled upload when it does not. Whatever cannot be automated still gets a date, an owner and a reminder: it never goes back to being a loose screenshot in an email.
And customer questionnaires?
They are answered from an approved library and, in many cases, they never even arrive: the customer finds what they are looking for in the public trust center.
Next step
We show you with your own standards on the table
Bring the standard you have to meet this year —an ISO, SOC 2, the data law or your most demanding customer's questionnaire— and we build the mapping in the same meeting.
Which standard do you have to meet this year?
Book a demo