⚡ Built for teams who want clarity, not complexity

Risk management your team
will actually use

NotaGRC is a lightweight risk register for small teams. Score risks, scan vendors, map to BAU and BIA, generate board-ready reports — without the enterprise GRC theatre.

No setup fees No per-user pricing Cancel anytime GDPR compliant Deployable in minutes

GRC tools were built for enterprise consultants, not your team

Most risk management software is either a bloated enterprise platform costing tens of thousands, or a shared spreadsheet that nobody updates.

  • NOT US Six-figure licences and six-week onboarding
  • NOT US Tools so complex they need dedicated GRC consultants
  • NOT US Spreadsheets that go stale the moment they're saved
  • NOT US Reports nobody reads because they're 80 pages of boilerplate

Lean, practical risk management — done in minutes

NotaGRC gives small teams everything they need to take risk seriously, without the overhead that makes teams avoid it.

  • YES Live risk register with scoring, owners, and review tracking
  • YES Automatic vendor OSINT scans from public threat sources
  • YES Board-ready PDF reports generated in one click
  • YES Flat pricing — your whole team, one price

Every view, built for clarity

Click through the screens to explore the full product — no demo call required.

notagrc · Dashboard
Dashboard

Company risk score gauge, distribution by level, overdue review counters, top 5 risks, and riskiest vendors — all in one live view.

notagrc · Risk Register
Risk Register

Full risk register with likelihood, impact, score, level badge, owner, status, and review dates. Sortable, always up to date.

notagrc · Risk Detail
Risk Detail

Deep-dive into any risk: plain-language narrative, 4×4 scoring matrix, mitigation notes, and a full audit history showing who changed what and when.

notagrc · BAU
BAU

Link risks directly to business-as-usual activities to understand which day-to-day operations carry the most exposure.

notagrc · BIA
BIA

Map critical business functions with RTO/RPO targets and linked risks — know what threatens your most important operations.

notagrc · Vendors
Vendors

Third-party vendor list with automatic weekly OSINT scans. Each vendor shows a blended NotaGRC score, criticality, and scan freshness.

notagrc · Vendor Detail
Vendor Detail

Per-vendor score breakdown combining your internal risk data with live OSINT findings: certificates, DNS security, and threat intel.

notagrc · Reviews
Reviews

Overdue and upcoming review tracker. Never lose track of a cycle — see everything due in the next 30 days and action it directly.

notagrc · Reports
Reports

Seven one-click PDF reports: executive summary, full register, high risks, overdue, upcoming reviews, BAU exposure, and BIA impact analysis.

Everything you need. Nothing you don't.

A complete risk management toolkit designed to be picked up in an afternoon and used for years.

🎯
Risk register with 4×4 scoring
Log risks with likelihood, impact, owner, mitigation, and review dates. Visual scoring matrix shows exactly where each risk sits. Full audit history on every change.
📊
Live dashboard
Company risk score gauge, distribution chart, overdue and upcoming review counters, and top riskiest vendors — updated live from your register.
🔍
Vendor OSINT scanning
Automatic weekly scans of your vendors using crt.sh, Google DNS, and URLScan. Each vendor gets a blended NotaGRC risk score combining your own risk data with OSINT findings.
🏢
BAU & BIA mapping
Link risks directly to business-as-usual activities and critical functions. Know exactly which operations are exposed and what your recovery time targets are.
📄
Board-ready PDF reports
Seven report types including executive summary, overdue reviews, high-risk register, vendor OSINT, BAU and BIA — all generated fresh from your live data in one click.
🔔
Email review alerts
Automated daily digest emails flagging overdue and upcoming risk reviews. Never miss a review cycle again. Toggle per user, no extra configuration needed.

Simple, transparent pricing

One flat price for your whole team. No per-user fees, no feature gating, no surprises.

Ready to take risk seriously?

Set up your risk register in minutes. No consultants required.