Built for people who read the small print.

Where we are

Context GRC is in beta. We do not currently hold, and do not claim, any third-party security certification or attestation. We won't show certification badges, customer logos or compliance guarantees we can't back up.

The product itself doesn't make you compliant. It helps qualified people do their work more efficiently and keeps a clear record of what was decided and by whom. Statutory duties, such as appointing a DPO where required, stay with your organisation.

If you're evaluating Context GRC for your organisation, we're happy to walk through the architecture and controls described here in a demo. Request a demo.

Human authority stays human

AI Command prepares proposed changes. People decide what happens to them.

• Changes prepared by AI are saved only after a person explicitly approves them, typically with one clear Approve & Save action that shows the scope.
• The AI model has no tool to save records, approve them or sign them off on its own.
• Formal sign-offs, external disclosures and other consequential actions use the module's own governed workflow.
• Conversation history never restores approval authority. Restored drafts need fresh evidence before they can be saved.

Access and organisation isolation

• Every read and write is checked on the server against current organisation membership, role and record-level grants. What the browser displays is never treated as a security boundary.
• The AI works under the same permissions as the person using it. Conversation context identifies the task; it never grants access.
• Team membership and invitations are managed through authenticated server-side transactions, with expiring single-use invitations and protections against self-service privilege escalation.
• Evidence files are stored privately and released only after the parent record's authorisation is re-checked.
• Access to technical audit history requires a separate, explicitly granted permission.

How the AI is bounded

• Scoped to authorised data. AI Command retrieves only records, organisation structure and policy passages the user is allowed to see, and re-checks access before using them.
• Public research is sanitised. When AI Command researches current public sources, private organisation and case details are excluded from the query.
• Usage limits. Model usage is metered per user, per organisation and across the platform, with hourly and daily limits that fail safely when reached.
• No AI on page load. Dashboards, news feeds and ordinary screens don't call AI automatically. AI runs when someone asks it to.
• Model provider. The current AI features use Google's Gemini models through a provider adapter. We'll tell you if that changes.

Evidence and honesty

Professional work depends on knowing where an answer came from and how certain it is.

• Answers reference the records and policy passages they relied on, with title, scope and version where available.
• Recorded facts, policy requirements, AI recommendations, assumptions and unknowns are kept distinct.
• A policy requirement is never treated as proof that a control is implemented. An AI suggestion is never treated as risk reduction.
• Missing search results are never presented as proof that something doesn't exist. Unknown values stay unknown rather than becoming zeros.
• Dashboards show what has actually been recorded. There are no invented compliance percentages or synthetic trends.

Uploaded documents

• PDF, Word, Excel, CSV and text files can be attached to a conversation, within size limits.
• Text inside a document is treated as data, never as instructions to the AI.
• Long documents may be read only in part. When that happens, the answer says so, with the coverage achieved. We don't claim a full review when one hasn't happened.
• Image-only scans aren't read (there is no OCR today), and uploaded documents aren't automatically attached to records as evidence.

This website

This marketing site is separate from the application. It sets no cookies, runs no analytics and loads no third-party scripts or fonts. Details are in our website privacy notice.