Compliance automation

Tools that connect to company systems to collect evidence and track readiness for frameworks such as SOC 2, ISO 27001 and FedRAMP.

7 vendors · alphabetical, never ranked

AnecdotesAnecdotes sells an enterprise GRC platform that pairs AI agents with a company's live systems data for governance, risk and compliance work, plus a third-party risk management tool that automates vendor discovery, evidence gathering and reassessment.Ownership not established
DrataDrata sells a compliance automation platform that collects evidence and monitors controls continuously so companies can prepare for and pass security audits, plus a Trust Center for sharing security posture with customers and a third-party risk management tool for assessing vendors.Ownership not established · primary category
HyperproofHyperproof sells a GRC platform with modules for compliance management, risk management, audit management and third-party risk management, plus a FedRAMP-certified version called Hyperproof Gov.Ownership not established · primary category
MetricStreamMetricStream sells a governance, risk and compliance platform with modules for enterprise risk, regulatory compliance, audit, cyber risk, third-party risk and operational resilience.Ownership not established
SecureframeSecureframe sells Secureframe Comply, software that automates evidence collection and continuous control monitoring so companies can get and stay compliant with standards such as SOC 2, ISO 27001, HIPAA, PCI DSS and GDPR, and that includes vendor risk management.Ownership not established · primary category
SprintoSprinto sells a platform that scopes and automates compliance work for standards such as SOC 2, ISO 27001 and HIPAA, monitors controls continuously, and automates vendor risk assessments and AI-tool discovery.Ownership not established · primary category
ThoropassThoropass sells a compliance automation suite that handles policy creation, control monitoring and evidence collection, paired with in-house audit services, penetration testing and a risk register.Ownership not established · primary category

No vendor pays to be listed or to change what we write. Descriptions are ours, drawn from each company's own site and filings. Corrections: /corrections.