SecretLink
Secure
Send a password that self-destructs.
Result in 30 s · account required
Try it
Compliance without the methodology marathon: send a supplier questionnaire in two minutes and get a scored answer back.
Security and GDPR compliance for teams without a full-time compliance officer: assess your suppliers with a link they fill in, keep one action plan with owners and due dates, and know where you stand on ISO 27001, NIS2 and the GDPR.
Hosted in France
No card required
Result in 2 min
Open GRCgo Microsoft account or e-mail · 30 s
Free or Pro?
The free tier covers personal use. Pro is for people who use it every day.
| Feature | Free
0 € | Pro
19 € / month every app | Team
12 € / seat / month every app |
|---|---|---|---|
| Internal audits per 12 months | 2 audits | Unlimited | Unlimited |
| Your own questions and questionnaire templates | - | ✓ | ✓ |
| Excel export of the supplier register, the risk register, the incident and breach registers, the audits and the action plan | - | ✓ | ✓ |
| Incidents recorded per 12 months (reports from staff always arrive) | 25 incidents | Unlimited | Unlimited |
| Questionnaires waiting for an answer at the same time | 3 questionnaires | Unlimited | Unlimited |
| Risks in the register | 10 risks | Unlimited | Unlimited |
| Suppliers in the register | 15 suppliers | Unlimited | Unlimited |
Upgrade to Pro
14-day free trial, no card needed. Cancel any time.
One subscription: Pro unlocks GRCgo and also SecretLink, FocusFlow, QR Forge, PromptPilot, Image Forge, AICase, WorkflowCraft, DataMask, PDF Forge, Screen Recorder, Meeting Notes, Sufler. Every new app is included at no extra cost
🎉 Launch price until 31 January 2027 - and you keep it for as long as your subscription stays active.
Frequently asked questions
Does my supplier need an account?
No. They receive a private link, answer in English or French, can stop and come back, attach evidence, and submit. You see a score per topic, the blocking answers and the gaps, and turn the gaps into actions in one click.
Which questions are asked?
Three levels sized to the supplier’s criticality (light, standard, full), written for today’s requirements: MFA, backups, incident notification delays, GDPR Art. 28, data transfers, use of AI on your data. Sections appear only when they apply, and you can add your own questions.
Is this a certification?
No. GRCgo helps you do what ISO 27001, NIS2 and the GDPR ask, and keeps the evidence. Certification remains the job of an accredited body.
Where is my data?
In the EU (Scaleway, Paris), separated per workspace in the database. No AI service reads your answers.
Want the Microsoft 365 part checked for you?
Olyteck Cyber scans your tenant read-only and shows what to fix first - evidence for your access-control and supplier controls.
Other apps
- EU hosting, French jurisdiction
- GDPR: published DPA and sub-processors
- No passwords stored
- Trust Center →