GRC platform
One platform for the whole journey.
From the first control to the audit.
Sightadel guides you through every requirement, suggests the next content based on your input, imports data from your systems and reminds you of everything someone would otherwise have to trigger. All in one place – with real consultants when things get tricky.
Product tour
Nine modules. Click your way through.
This is what working in Sightadel looks like – module by module, with sample data.
How it all fits together
Five steps, one cycle.
The features are not a kit of separate parts. Every answer, every piece of evidence and every task is attached to the same control – from the assessment to the audit and back again.
- 1Assessment
You answer the requirements control by control. Guiding questions show what matters, industry templates give you a starting point.
- 2Evidence
Every answer is backed up. A piece of evidence is attached to every control it supports – across frameworks, too. If it expires, you see it in good time.
- 3Action plan
Where a control is not met, an issue is raised. It becomes an action plan with an owner and a deadline. The Security Score shows how you are progressing.
- 4Trust Center
Whatever you release, you show to customers and partners: certificates, policies, answers to common questions. Document by document, nothing without your approval.
- 5Audit
The auditor gets a role of their own and reviews everything in the system, without deletion rights. Findings turn back into action plans – the cycle closes.
Roles
Everyone sees what they need.
Six roles cleanly separate those who do the work, those who advise and those who audit. External consultants and auditors work directly in the system – no evidence folders sent by e-mail.
You assign roles per person. Whoever changes something appears in the activity log. External roles are by invitation only, and you revoke them with one click when an engagement or an audit ends.
| Role | View | Edit | Manage |
|---|---|---|---|
| Admineverything, incl. users and invitations | ● | ● | ● |
| Consultant (internal)all content across all frameworks | ● | ● | – |
| Contributor (internal)only assigned controls and evidence | ◐ | ◐ | – |
| Viewerreads along, changes nothing | ● | – | – |
| Consultant (external)by invitation only, revocable at any time | ● | ● | – |
| Auditoralways external; comments, creates and edits after approval, never deletes | ● | ◐ | – |
● yes · ◐ limited · – no. Every change is recorded in the activity log.
Who it is for
One platform, five perspectives.
Compliance is rarely the job of a single person. Sightadel brings together the people who would otherwise work in separate spreadsheets.
Management
You are liable for implementation, for example under NIS2, and need an honest overview instead of long reports. The Security Score and open action plans show the status at a glance – and with the Viewer role there is no risk of changing anything by mistake.
Information security officer and CISO
You build the ISMS and keep it alive. Sightadel guides you through Annex A, links evidence, reminds you of deadlines and shows where the gaps are. You manage vendor risk in the same system.
Quality manager
You are responsible for quality management under ISO 9001 or a HACCP plan. Document control, internal audit, management review and corrective actions all happen in one place.
Data protection
Technical and organisational measures, processors and incidents overlap heavily with information security. What has been evidenced once, you reuse for the GDPR.
IT
You supply most of the evidence: permissions, backups, patches, logs. As a Contributor you see only what is assigned to you, and you upload proof directly in the right place.
A typical start
Your first weeks in Sightadel.
No implementation project, no training series. You start with what you already know today, and Sightadel shows you what is missing.
- Choose a framework and assign rolesYou decide who is responsible, who contributes and who only reads along. You invite external people once you are ready.
- Take stock in the assessmentAnswer the controls as honestly as you can. “Not yet implemented” is a valid answer and becomes the starting point for the action plan.
- Bring in what you already haveImport policies, procedures and spreadsheets via Excel or Word and attach them to the matching controls.
- Plan for the gapsOpen points become action plans with an owner and a deadline. The Security Score shows how your status develops.
- Show it to the outside worldWhatever is released appears in the Trust Center. Once everything is in place, you invite the auditor.
Consultants at your side
For important questions or tricky cases, real consultants help – right where you are working.
Learn more →Independent auditors
The audit is carried out by an accredited auditor from our partner network or of your choice. No commission, for anyone.
Learn more →Security and data protection
Developed and hosted in Germany, with processing on behalf under Art. 28 GDPR included.
Learn more →Do I have to use every feature?
No. Many start with an assessment and evidence. Action plans arise on their own as soon as gaps become visible. You add the Trust Center and vendor risk when you need them.
Can I bring in existing documents?
Yes. Policies, procedures and spreadsheets can be imported from Excel or Word and attached to the matching controls. You do not have to start from scratch.
How many users can I create?
That depends on the edition: Basic includes 5 users, Professional 10, Enterprise by agreement. Details are on the pricing page.
Can I run several frameworks in parallel?
Yes. Each framework has its own assessment; they share evidence. A piece of evidence is stored once and attached to every requirement it supports.
How quickly will I see a first status?
As soon as the first controls are answered, the dashboard and Security Score show where you stand. That is why many use the assessment as a stocktake first, before planning a project.
What happens to our data after the free trial?
If you choose a plan, everything you have created carries over into the paid plan. If you do not, the trial ends. You do not need payment details for the trial.
Who in our organisation should be Admin?
The person who is responsible for the project and manages users, often the information security officer or quality manager. Admins can invite external consultants and auditors and revoke their access again. It is advisable to register a deputy as Admin as well.
Can management see what it is responsible for under NIS2?
Yes. With the Viewer role, management reads assessments, action plans and the Security Score without changing anything. This lets it oversee the implementation of the measures, as section 38 of the German BSI Act (BSIG) requires.
Is there an integration with our existing tools?
Yes. Sightadel imports assets, evidence and tasks from Jira, Confluence, Zendesk, Microsoft Azure, SAP, Microsoft Dynamics and Salesforce. We connect further systems quickly on request. You create users manually or upload them as a CSV list. In addition, there is import and export for Excel and Word.
Start with one standard.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.