HashGo · Governance, risk and compliance
HashGo GRC
Live
HashGo GRC maps 124 standards and regulations, including ten for Saudi Arabia, the UAE, Qatar and Bahrain, to one set of controls, tests those controls continuously, and keeps the evidence next to the control it proves. AI agents draft the work; named people approve every decision that matters.
Product tour
What your team sees after sign-in: every framework, every control test, every risk and audit, and what is waiting for a decision.
Screens from the live platform, shown with sample data from a fictional company. Select any screen to see it full size.
Capabilities
One platform for the whole cycle: scope, map, implement, test, find, fix, report and review.
Do the work once and reuse it for every standard that asks for it.
Evidence collects itself, and failures turn into work without anyone copying them across.
Residual risk moves when the controls behind it pass or fail.
From the risk-based plan to the signed report, with the evidence already attached.
Agents draft mappings, policies, risk analyses and findings. People decide.
The modules a regulated company needs, sharing one control set and one risk register.
How it works
The applicability engine suggests what applies to your sector, regions and data.
Live collectors and uploads gather evidence; control tests run on a schedule.
Mappings, policies, risk analyses and work programmes arrive ready for review.
Open a scoped portal for your auditor and export a bundle they can verify.
Human in the loop
Every agent action has a tier. The higher the tier, the more senior the person who has to approve it. You can restrict agents to read-only, or switch them off, at any time.
| Tier | What the agent does | Who decides |
|---|---|---|
| Tier 0 | Reads and analyses | Runs on its own |
| Tier 1 | Drafts a record, such as a policy, risk or mapping | Runs on its own; the record is marked AI-drafted |
| Tier 2 | Changes a score, status or mapping | A reviewer approves |
| Tier 3 | Communicates outside the company or closes a finding | A named approver signs off |
Coverage
124 content packs across security, privacy, finance, resilience, AI and ESG, including ten for the Middle East, plus your own internal standards.
Every pack is labelled Preview today; labels move to Reviewed and Verified as our compliance team completes each review, and the product shows the current label on every framework. Plus 84 more packs, including cloud authorisations, sector rules, ESG reporting and the audit profession's own standards. Licensed standards carry identifiers and summaries; the full text comes from your licensed copy.
Integrations
Collectors read your systems on a schedule, store what they read as hashed evidence and run the control tests against it.
Beta collectors call each provider's read-only APIs and are being verified on customer tenants. A test the source cannot measure is skipped, not failed. Evidence from any other system can be uploaded, or pushed through the REST API and webhooks.
Trust
Where your data lives, who can process it, and how you take it with you.
| Topic | How HashGo GRC handles it |
|---|---|
| Hosting | HashGo GRC runs in Mumbai, India. Enterprise customers can also install it in their own data centre or cloud region. |
| Encryption | TLS on every connection. Connector and AI credentials are encrypted in a vault and never shown again, to people or to agents. |
| Evidence integrity | Every artefact is hashed with SHA-256 when it is captured and stored write-once, with a chain of custody. The audit log is hash-chained and can be verified. |
| AI data residency | You choose the geographies where AI calls may run. Workspaces in India and the Gulf never route AI to the US by default, and every call records its endpoint and geography. |
| Sub-processors | Hostinger International (hosting, Mumbai). AI runs only through the provider you choose: your own Anthropic, AWS, Google Cloud or Microsoft account, a private model, or HashGo AI credits. |
| Your data, your exit | Export controls, risks, issues, findings, vendors, tests and the evidence register as CSV, Excel or JSON, frameworks as OSCAL, and Statements of Applicability as PDF, at any time, including after a trial ends. |
Pricing
Plans are sized by active frameworks and users. External auditors, read-only viewers and employees completing attestations never count as users.
Prices are per organization per month, billed yearly.
Evaluation
₹0
$0 · 30 days
Startups preparing for a first audit
₹24,999/month
$349/month
Regulated companies running several programmes
₹69,999/month
$999/month
Teams wanting one predictable bill
₹89,999/month
$1,249/month
Banks, insurers, groups and the public sector
From₹25 lakh/year
From $30,000/year
Growth + AI includes every Growth feature.
| Feature | Starter | Growth | Enterprise |
|---|---|---|---|
| Compliance | |||
| 124 standards and regulations, crosswalked to one common control set, each with a maturity label | Included | Included | Included |
| Middle East: NCA ECC and CCC, SAMA CSF, PDPL (KSA), UAE IA and PDPL, DESC ISR, ADHICS, Qatar NIA, Bahrain CBB | Included | Included | Included |
| Active framework programmes | 2 | 8 | Unlimited |
| Clause coverage, gap analysis and readiness forecast | Included | Included | Included |
| Statement of Applicability (English or Arabic), SSP, OSCAL and crosswalk exports | Included | Included | Included |
| Applicability engine and version migration, such as ISO 27001:2013 to 2022 | Included | Included | Included |
| Custom frameworks and OSCAL, CSV or JSON import | Not included | Included | Included |
| Regulatory change tracking with impact assessments | Not included | Included | Included |
| Monitoring and evidence | |||
| 925 prebuilt control tests | Included | Included | Included |
| Live collectors: web and TLS, DNS and email authentication, GitHub, REST APIs, webhooks | Included | Included | Included |
| Cloud and identity collectors (beta): AWS, Azure, Google Cloud, Entra ID, Okta, Google Workspace | Included | Included | Included |
| Evidence hashed on capture, write-once, with chain of custody | Included | Included | Included |
| Retention schedules and legal hold | Not included | Included | Included |
| Risk | |||
| Risk register with residual risk driven by live control results | Included | Included | Included |
| Appetite, tolerance, KRIs and risk acceptance with expiry | Not included | Included | Included |
| FAIR Monte Carlo quantification with loss exceedance curve | Not included | Included | Included |
| Third-party risk: diligence, contract checks, monitoring, offboarding | Not included | Up to 100 vendors | Unlimited |
| Audit | |||
| External auditor portal: scoped, watermarked, auto-expiring | Included | Included | Included |
| Internal audit: risk-based plan, engagements, sampling, workpapers, findings | Not included | Included | Included |
| Verifiable audit bundle with hash manifest | Not included | Included | Included |
| Programmes | |||
| Policies with attestation campaigns | Included | Included | Included |
| Issues and remediation with re-test verification | Included | Included | Included |
| Privacy: RoPA, DPIA, transfer assessments, DSR deadlines, breach clocks | Not included | Included | Included |
| AI governance: AI system inventory with EU AI Act classification | Not included | Included | Included |
| Trust centre and security questionnaires | Not included | Included | Included |
| Business continuity: impact analysis, plans and exercises | Not included | Not included | Included |
| Committees, decision log and RACI | Not included | Not included | Included |
| AI agents and automation | |||
| 16 AI agents with tiered human approval | Included | Included | Included |
| Rules engine for every agent task, with no AI key | Included | Included | Included |
| AI through your Anthropic key, your Bedrock, Vertex AI or Foundry account, or HashGo credits | Included | Included | Included |
| AI data-residency policy, with the endpoint of every call logged | Included | Included | Included |
| Agent traces, evaluations, cost cap and kill switch | Included | Included | Included |
| 15 prebuilt event-driven workflows | Included | Included | Included |
| Workflow designer, versioning, simulation and process mining | Not included | Included | Included |
| Security and deployment | |||
| 12 roles with segregation of duties | Included | Included | Included |
| Hash-chained audit log with SIEM export | Included | Included | Included |
| Encrypted credential vault | Included | Included | Included |
| SCIM 2.0 user provisioning | Not included | Not included | Included |
| Private or self-hosted AI model | Not included | Not included | Included |
| Self-hosted installation | Not included | Not included | Add-on |
| Support | Email, next business day | Priority, business hours IST / GST | 24x7, named manager, 99.9% uptime SLA |
AI usage
HashGo GRC agents run on Claude by Anthropic. Use your own account, buy HashGo credits, run a private model, or switch AI off; the platform keeps working either way.
| Option | How it works | Where data is processed | Price |
|---|---|---|---|
| Your Anthropic key | Add an Anthropic API key under Settings; Anthropic bills you directly. | Anthropic's infrastructure, with global routing, or the US only if you choose | Licence only |
| Your cloud account | Connect Claude through your own Amazon Bedrock, Google Vertex AI or Microsoft Foundry account; your cloud provider bills you. | The geography you choose: EU, US, Japan or Australia on Bedrock; EU or US on Vertex AI; global or US on Foundry | Licence only |
| HashGo AI credits | We provide the model access; you buy prepaid credits. 1 credit = $1 of model usage at the provider's list price. | Only in a geography your AI policy allows; never the US for India and Gulf workspaces | ₹120 / $1.25 per credit |
| Growth + AI | The Growth plan with 200 credits a month included. | As for HashGo AI credits | ₹89,999 / $1,249 per month |
| Private model | Your self-hosted model through an OpenAI-compatible endpoint. | Your network | Enterprise |
| No AI | A deterministic rules engine runs every agent task, and its output is labelled. | HashGo GRC only | Included |
In-country AI in India and the Gulf. Anthropic's published platform documentation does not list in-country processing of current Claude models in India, the UAE, Saudi Arabia or Qatar on Amazon Bedrock, Google Vertex AI or Microsoft Foundry; requests from those regions use global routing. HashGo GRC blocks those routes for India and Gulf workspaces by default. For AI that never leaves your country, use a private model or the rules engine.
| Pack | Credits | India (INR) | International (USD) | Saving |
|---|---|---|---|---|
| Small | 100 | ₹12,000 | $125 | None |
| Medium | 500 | ₹57,000 | $595 | 5% |
| Large | 2,000 | ₹2,16,000 | $2,250 | 10% |
Add-ons and services
| Add-on | India (INR) | International (USD) | What you get |
|---|---|---|---|
| Extra active framework | ₹4,999/month | $69/month | One more compliance programme on Starter or Growth |
| Extra 10 users | ₹4,999/month | $69/month | On Starter or Growth |
| Extra 100 vendors | ₹9,999/month | $129/month | More third-party risk capacity on Growth |
| Self-hosted installation | +30% on Enterprise licence + ₹3 lakh one-time | +30% on Enterprise licence + $4,000 one-time | Docker installation inside your network |
| Middle East framework pack | ₹9,999/month | $129/month | All ten Middle East packs as active frameworks, outside your plan's framework allowance, with Arabic Statements of Applicability |
| Readiness assessment, one framework | ₹1.5 lakh | $2,500 | Gap assessment by the ThreatXIntel compliance team, loaded into HashGo GRC with a remediation plan |
| Internal audit by ThreatXIntel, per audit | ₹1.5 lakh | $2,500 | An internal audit run by the ThreatXIntel compliance team in your HashGo GRC workspace |
| Virtual CISO, per month | ₹1.5 lakh | $2,500 | A ThreatXIntel security leader for your programme |
| Certification audit through a partner audit firm | Quoted | Quoted | An external certification audit arranged through a ThreatXIntel partner firm |
| Onboarding and framework setup | Free on Growth and Enterprise | Free on Growth and Enterprise | Guided setup of frameworks, collectors and workflows |
Partners (MSSPs, consultancies, VAPT firms): 30% off list price, rising to 40% at 10 or more client organizations, with a multi-client console and white-label reports.
Discounts and terms
| Offer | Discount | Applies to |
|---|---|---|
| Launch offer | 30% off the first year | First 20 paying customers who agree to a published case study; ends 31 Dec 2026 |
| Multi-year | 10% off for 2 years; 15% off for 3 years | All paid plans, billed yearly |
| Startups | 50% off Starter for the first year | Companies under 2 years old with fewer than 20 employees |
| HashGo suite bundle | 20% off the combined list price | HashGo GRC with HashGo SAST and HashGo Threat Modeling |
Discounts do not combine.
| Term | Detail |
|---|---|
| Free trial | 30 days, 2 frameworks and 5 users, no card required; includes a free readiness report for one framework, prepared with the ThreatXIntel compliance team |
| Billing cycle | Yearly in advance by default; monthly available at +20% |
| Adding users or frameworks | Billed pro rata for the rest of the term |
| Payment in India | Bank transfer, UPI or card, with a GST tax invoice |
| International payment | Wire transfer or card in USD |
| Enterprise payment terms | Net 30 days from invoice |
| Renewal | Price increase capped at 7% a year |
| Billing entity | Threatxintel Cyber Labs LLP, Bengaluru, India |
Sales and Enterprise quotes: info@threatxintel.com
Prices are valid from 10 October 2026 and may change with notice. Existing customers keep their price until renewal.
Governance, risk and compliance: deciding who is accountable, knowing which risks the business carries, and proving to auditors and regulators that the controls you promised are in place and working.
124 standards and regulations, including ISO 27001, SOC 2, PCI DSS, NIST CSF 2.0, the DPDP Act, GDPR, HIPAA, RBI and SEBI rules, DORA, NIS2, the EU AI Act, and ten Middle East frameworks such as NCA ECC, SAMA CSF and the UAE IA. All of them map to one common set of controls, so evidence collected once counts everywhere it applies. You can also add your own internal standards.
Verified: every clause reviewed and mapped by our compliance team, and used in at least one audit. Reviewed: mappings checked by our compliance team, not yet used in an audit. Preview: AI-drafted mappings awaiting review; use them for gap analysis, not for an audit. Today every pack is Preview. Only our compliance team changes a label, and exports from a Preview pack say so.
No. Every agent task also runs on a deterministic rules engine, and its output is labelled as such. When you want Claude to do the drafting, add an Anthropic API key, connect your own Amazon Bedrock, Google Vertex AI or Microsoft Foundry account, or use HashGo AI credits.
Only in the geographies your policy allows. Workspaces in India and the Gulf never send AI requests to the US or to global endpoints by default, because Claude is not yet offered with in-country processing there on Bedrock, Vertex AI or Foundry; allow the EU, Japan or Australia, or use a private model. Every agent run records the endpoint and geography it used.
HashGo GRC runs in Mumbai, India. On Enterprise you can install it in your own data centre or cloud region instead.
Only within its tier. Agents can read, analyse and draft on their own. Changing a score, status or mapping needs a reviewer, and anything that goes outside the company or closes a finding needs a named approver. Nobody can approve their own request.
Live collectors cover web and TLS posture, DNS and email authentication, GitHub, any REST API and incoming webhooks. Collectors for AWS, Microsoft Azure, Google Cloud, Microsoft Entra ID, Okta and Google Workspace are in beta. You can upload evidence for everything else; tell us which connectors you need.
Through a portal scoped to one engagement, with watermarked downloads and an expiry date. External auditors are free on every plan.
Each file is hashed with SHA-256 when it is captured and stored write-once, with a chain of custody. Every action in the platform goes into a hash-chained audit log that can be verified and exported to your SIEM.
Anyone who creates, edits or approves records. External auditors, read-only viewers and employees completing policy attestations are free.
Yes, on Enterprise. HashGo GRC installs with Docker inside your network and can use a private or self-hosted AI model.
Yes. Upgrades take effect immediately and are charged pro rata. Downgrades take effect at renewal.
Start a 30-day trial: 2 frameworks, 5 users, live collectors and AI agents, no card required, with a free readiness report for one framework. Or book a demo and we will set up your organization.
Start a 30-day trial, or book a demo and we will set up your organization.
