SCF Controls Platform

CONFor GRC consultants

Every client. One console.

Your clients pay for judgement — scoping, advising, getting them through audits. The platform takes the bookkeeping: one control library, per-client workspaces, and posture you can present without a weekend of formatting.

CON-01The familiar problem

A spreadsheet per client, drifting out of date

Per-client workspaces on one console. Every engagement gets the full SCF catalog, scoped to that client — no copy-pasted workbooks, no version archaeology.

CON-02The familiar problem

Re-mapping controls for every new framework

The SCF's 354+ framework mappings come built in. When a client adds ISO 27001 to their SOC 2, the overlap is already mapped — you advise, the matrix does the bookkeeping.

CON-03The familiar problem

Assembling client reports by hand

Posture views you can walk a client through: implementation progress, evidence maturity L0–L5, and a risk register that links to the controls treating it.

CON-04Built by one of you

This platform is built by a practising GRC consultant who runs client engagements on it. The consultant workflow isn't a feature tier — it's the reason the product exists.

Why this exists

Free, open source, and yours to run.

No pricing tiers, no seat licences, no lock-in. Read the source, self-host it on your own infrastructure, and contribute back.