Home / Platform
The Doniastack platform
Everything your compliance programme needs, connected.
Nine modules that read from the same controls and evidence. Do the work once, and it counts in the audit, the customer review and the board report.
Audit readiness
Know exactly where you stand against each framework.
Every control is tracked against the frameworks you are working towards, with an owner, a due date and the evidence behind it. Readiness is worked out from your records, so the number on screen is the number your auditor will see.
- Control-by-control readiness for SOC 2, HIPAA and ISO 27001
- Gap assessment against frameworks you have not started yet
- A shared workspace and message thread for your auditor
- Audit periods, requests and sampled populations in one place
Evidence room
Every piece of proof, in one place and never stale.
Evidence is linked to the controls it proves, with who owns it, when it was collected and when it needs refreshing. Stale items surface before an auditor finds them.
- Evidence linked to every control it supports
- Collection dates and freshness tracked automatically
- Outside requests from vendors and auditors land on the record
- Export the controls and evidence as an auditor package
Policy management
Policies your team actually reads and acknowledges.
Draft policies tailored to your business, amend them section by section, and keep every version. Publish, and staff are asked to acknowledge; the record of who did and when is kept for the auditor.
- Policies drafted for your company, not a generic template
- Every amendment saved as a new version
- Acknowledgement campaigns with due dates
- Policy coverage mapped to controls
Risk register
One living list of risks, scored, owned and treated.
Record each risk with its likelihood and impact, decide the treatment, and track it to closure. Exceptions are raised against the control, policy or risk they cover, approved, and expire on a date.
- Likelihood and impact scoring with a heat map
- Treatment plans with owners and dates
- Exceptions with approval and expiry
- Appetite and residual risk side by side
Vendor risk
Know the suppliers you depend on.
Tier every vendor by risk, track their agreements and renewals, and request what you need through a secure, single-use link. The vendor answers on one page without an account, and the reply lands on their record.
- Risk-tiered vendor register
- Secure vendor request links that expire after one use
- DPAs, BAAs and NDAs with expiry tracking
- Follow-ups to the vendor contact on record
Security questionnaires
Answer customer reviews once, then reuse.
Track every customer security review from received to submitted, with an owner and a due date. Approved answers live in a library, so the same question never has to be researched twice.
- A pipeline of reviews from inbox to sent
- An approved answer library
- Owners and due dates on every questionnaire
- Export answers for the customer
People & training
Security that follows your people from first day to last.
Joiner, mover and leaver checklists make sure access, devices, training and policies are handled every time. Training is assigned and tracked, and a human-risk view shows where attention is needed, built from your own records.
- Joiner, mover and leaver checklists
- Security-awareness courses assigned and tracked
- A human-risk score from overdue training and privileged access
- Personnel register that training and policies read from
Incidents & continuity
Be ready for the bad day, and prove it.
Log incidents with their severity and the reporting deadlines that apply. Record business-continuity tabletop exercises, who took part, what happened and the gaps you found.
- Incident log with severity and status
- Reporting clocks for notification deadlines
- Tabletop exercises with outcomes and gaps
- Recovery targets per system
Sev 2 · containedContained
Sev 3 · closedResolved
Exercise · 2 gapsFollow up
Illustration
Reports & exports
The view leadership needs, and your data whenever you want it.
Board and client reports show posture, trend and top risks. Schedule a report to arrive by email each month. Export your controls, risks or assets as spreadsheets, or everything your workspace holds as one file.
- Board and client posture reports
- Monthly report emails
- CSV exports for assets, questionnaires and controls
- A full data export at any time
Emailed monthlyScheduled
On demandReady
One JSON fileAvailable
Illustration
Get started
See where you stand in 30 minutes
Tell us which review or audit is in front of you. We'll walk you through the platform and map what readiness takes, with no obligation.