FAQ
Frequently asked questions
Does using GRC Flow make my company compliant or certified?
No. Certification is granted by an accredited certification body after an audit, and compliance depends on what you put in place. The platform helps you prepare structured, consistent documentation and evidence faster; you remain responsible for reviewing and implementing it.
Are documents written by AI?
Every deliverable starts from professional templates and expert libraries (controls, risk scenarios, policy rules). What can be calculated is calculated by the code; where a service uses AI, it writes the text from your answers. Names of people, such as risk owners, are never filled in by the AI. You review and approve every deliverable.
Can I edit the results?
Yes. Every deliverable opens in an in-browser editor. Within a project, its version history lets you compare or restore earlier states; outside a project, one version is kept.
What happens to my data when a project period ends?
The project becomes read-only. Documents and their history stay accessible, and you can reactivate the project later.
Can I manage several companies with one account?
Yes. Add each company in your account: each has its own profile, projects and deliverables, kept separate from the others.
Which frameworks are covered?
ISO/IEC 27001, GDPR, NIS2 and DORA, as well as HIPAA and PCI DSS where they apply, plus your own internal or contractual requirements through the general Gap Assessment.
How do free runs work?
When a service includes free runs for account holders, your service list and its form show how many are left. They come back at the start of each month, and are never carried to the next month or to another service. Your email must be verified, and a disposable address is refused; one mailbox has one allowance, whatever the number of accounts. A run that fails does not use a free run. Afterwards each run is paid at the price shown beside Run, and your deliverables stay in your account. If a refusal seems wrong, tell us through Help.
How does the referral link work?
Every account has its own referral link, in My profile. When someone creates an account through your link, you receive in credits 10% of every purchase that account pays: services, projects or credits. Spending credits already bought gives nothing new. No commission is paid on your own mailbox, or while the other account's email is not verified. You see the amount, never who bought what.
How do working groups work?
Any account can create a working group and invite people by email. Joining requires a GRC Flow account on the address invited. A group has its own projects, deliverables and credits. Members see each other's name and role, and only what is in the group: your own account stays private, and a deliverable enters a group as a copy. A service run on its own is paid by the person who launches it. A group's project is paid by a member, or from the group's credits by an administrator; every member can buy credits for the group, and they stay in the group when a member leaves. A renewal is paid from the group's credits, and nobody is charged without having clicked.