Evidence once.Confidence always.
Nine frameworks in one workspace — ISO 9001, ISO 27001, SOC 2, PCI DSS and more — with a genuine cross-walk between them, embedded AI, and an AI consultant that plans the work. A human signature on every record.
- UK / EU data residency
- Self-host option
- SSO / SAML
ISO 9001
Built by the teams behind Obligara
Why Obligara
One source of truth for quality, security and trust
Most teams bolt a SOC 2 tool onto a spreadsheet QMS and a separate ISMS. Obligara is one workspace where the frameworks share evidence and reinforce each other.
Every framework, one workspace
Run ISO 9001, ISO 27001, SOC 2, Cyber Essentials and sector schemes like NSI on the same process map, the same documents and the same audit trail — instead of separate tools and a folder of spreadsheets.
The ISO 27001 → SOC 2 cross-walk
Enable SOC 2 and 71 mappings carry your existing ISO 27001 control evidence onto the Trust Services Criteria. Evidence once, satisfy everywhere — weeks of duplicate work removed.
AI that does the work, not theatre
Gap analysis, readiness verdicts, mapping suggestions and form drafting — all inside your row-level-security boundary. The AI reads and drafts; a person reviews and signs off every save.
Frameworks
Nine frameworks, modelled properly
Not checklists bolted onto a generic tool. From ISO 9001, ISO 27001 and SOC 2 to PCI DSS, ISO 42001 and ISO 45001, each framework is instantiated with its real clauses, controls and criteria — and they all share the same evidence.
A living quality system, not a binder.
The QMS module is auto-enabled on every new workspace. 35 clauses and roughly 120 audit questions, quality objectives with per-period measurements, a visual process map, and management reviews that pull live data from the rest of the workspace.
- clauses modelled
- 35
- audit questions
- ~120
- enabled on new orgs
- Auto
clauses modelled
audit questions
enabled on new orgs
Quality objectives & measurements
Define clause 6.2 / 9.1 objectives and record per-period KPI measurements against them — the numbers your management review actually needs.
Process map as the spine
A visual flowchart of your processes. Every risk, document, CAPA and audit finding links back to a process, so context is one click away.
Management reviews
A guided review that assembles inputs from complaints, findings, audits, risks and objectives — no more rebuilding the pack from scratch each year.
Internal audit wizard
Setup → clauses → walkthrough → findings, backed by an ISO 9001 question bank, with audit programmes for the multi-year schedule.
The workspace
Everything a working compliance programme needs
The modules a real QMS/ISMS uses day to day — all linked back to your processes and one shared audit trail.
Process map
A visual flowchart that links risks, documents and CAPAs to the processes they belong to.
Document control
Versioned documents with an approval workflow and a distribution log. Uploaders can’t self-approve.
CAPAs & non-conformance
Corrective and preventive actions, non-conformances and complaints with root-cause and action plans.
Internal audit wizard
Framework-aware: setup → clauses → walkthrough → findings, with programmes for the multi-year schedule.
Evidence store
Typed uploads with expiry tracking and polymorphic links to the controls and criteria they support.
Competency matrix
Employees × skills × level, so training and competence evidence is structured, not anecdotal.
Management reviews
Reviews that assemble live inputs from every module, with linked actions tracked to closure.
Multi-framework cross-mappings
One control maps to many criteria across frameworks — evidence once, satisfy everywhere.
Public Trust Center
Publish your posture, certifications and policies on a branded page — with gated access and an AI assistant that answers only from what you’ve published.
Embedded AI
AI across the workflow — not a chatbot bolted on the side
Five AI surfaces, all opt-in per workspace, all bound by the same row-level security as the rest of the app. They draft and assess; you stay accountable for what gets saved.
Chat assistant
Answers questions against your live workspace.
Read-only tools walk your QMS inside the same row-level-security boundary as the rest of the app. It cites record references (CAPA-012, RISK-007) that link straight to the detail page — no vector-search-and-pray.
AI gap analysis
Verdicts each control as ready, partial or gap.
Per-control verdicts with the cited evidence references behind them, so you can see what is covered and what still needs work before an audit.
AI readiness analyser
Narrative readiness, criterion by criterion.
Per-criterion narrative verdicts for SOC 2 readiness, persisted as snapshots so you can track how readiness moves over time.
AI mapping suggester
Proposes control → TSC criteria mappings.
Suggests how each ISO 27001 control maps to SOC 2 Trust Services Criteria — one control at a time, or in bulk across the set.
AI form-fill assists
Drafts the long fields for a human to approve.
CAPA root-cause, risk treatments, management-review inputs and the SOC 2 system description — drafted from your live data, then edited and signed off by a person.
Why it’s trustworthy
Read-only tools, not freeform retrieval
The assistant calls typed functions that hit the database inside your row-level-security context. It reads what you can read — nothing more.
AI cannot mutate your records
Every assist fills a form for a human to review and save. The audit log only ever records a person’s signature, never the model’s.
Shaped output, not loose text
Structured suggestions run a tool-using research pass and a schema-bound generation pass, so output is always shaped and checkable.
The wedge
The ISO 27001 → SOC 2 cross-walk, in about 60 seconds
Enable SOC 2 on a workspace that already has ISO 27001 and 71 mappings carry your control evidence straight onto the Trust Services Criteria. Watch one control light up the criteria it satisfies.
- 71
- mappings
- ~3 wks
- work removed
- 1
- evidence set
ISO 27001
SOC 2 — TSC
Access control policy · joiner/leaver records · quarterly access reviews
The platform
More than a set of frameworks
An AI consultant that plans the work, an integration hub that keeps evidence fresh, and an API to build on — all inside the same row-level-security boundary as the rest of the app.
AI Consultant
An always-on virtual consultant: a computed readiness score, a prioritised roadmap, document drafting and maintenance automation — per framework.
Learn moreObligara Connect
An integration hub with hundreds of pre-built connectors that pull the signals proving your controls, so evidence keeps itself current.
Learn moreREST API
Read and write your compliance data — API keys, granular scopes, evidence upload and an OpenAPI 3.1 spec with Swagger UI.
Learn moreWho it’s for
Built for the teams walking the framework journey
Mid-market service organisations that have outgrown spreadsheets or hit a customer-driven audit requirement.
Head of Quality
ISO 9001-led, growing into ISO 27001
You run a mature QMS and now customers want security assurance too. Add ISO 27001 on the same process map and audit trail you already trust.
ISMS Lead
Head of Information Security at a growth-stage SaaS
You own ISO 27001 and the Statement of Applicability. Instantiate all 93 Annex A controls per workspace and stop maintaining the SoA in a spreadsheet.
CTO / VP Engineering
Series A–C SaaS hitting SOC 2 for US enterprise sales
A big customer needs a SOC 2 report to close. If you already have ISO 27001, the cross-walk gets you most of the way; if not, start with the 40-control starter pack.
Compliance consultancy
ISO lead-implementer / reseller
You implement frameworks for a portfolio of clients. Run them all in one tool, reuse evidence across frameworks, and join the partner programme.
“A real customer quote goes here once a design partner is referenceable — keep it specific (a metric, a before/after), never invented.”
We don’t publish quotes we don’t have. Real design-partner references land here as they go live.
See it on your own frameworks
A 30-minute walkthrough on your QMS, ISMS or SOC 2 scope — no slideware, just the workspace.