OnyxOne is the enterprise GRC operating system — manage risk, controls, policies, obligations, audits, evidence and regulatory workflows from one platform. Built for regulated organisations. Defensible by design.
One platform, end-to-end coverage
The governance, risk and compliance domains the platform is built to cover — capabilities, not partnerships or endorsements.
Not another point tool bolted onto a stack of spreadsheets. A single operating system where risk, controls, policy, obligations, audit, evidence and reporting work together — with a defensible trail behind every decision.
Risk registers, controls, policies, obligations, audits, evidence and reporting run on a single platform — not a patchwork of spreadsheets, shared drives and email chains. One taxonomy, one workflow, one source of truth across every framework and every business unit.
Every obligation maps to a control, every control to the risk it mitigates, and every test to the evidence that proves it worked. When a control fails, the issue, the owner, the remediation and the affected risk are already linked — so exposure is visible, not inferred.
Every assessment, approval, override, policy version and control test is captured in an immutable audit trail. When a regulator, auditor or board committee asks how a decision was made and who owned it, the answer is already recorded — not reconstructed after the fact.
Data sources feed ingestion and screening, the risk, case and monitoring engines, controls and evidence, reporting and analytics — with every action landing in the audit trail.
Every capability a compliance and risk team needs, working together on one platform — turn on what you need, add more as you scale.
A single control room for your compliance programme — work, alerts and obligations in one place.
Sanctions, PEP and adverse-media screening at onboarding and continuously, with configurable match rules.
Structured CDD and KYC/KYB workflows that collect, verify and risk-rate each customer against your policy.
Deeper EDD for higher-risk relationships — source-of-funds, ownership mapping and sign-off trails.
Continuous re-screening and event monitoring that surfaces changes in customer and third-party risk.
Route alerts into cases, gather evidence, record decisions and close with a defensible audit trail.
Configurable risk scoring across customers, entities and jurisdictions, driven by your own risk model.
Author, version and attest policies, and map them to the controls that enforce them across the platform.
Assemble, review and export the reports and returns your obligations require, from a single record.
An immutable record of every action, decision and change — ready for internal and external audit.
Onboard, assess and monitor third parties with due-diligence questionnaires and continuous screening.
Dashboards and metrics across risks, controls, obligations, cases and SLAs — visibility for the whole programme.
Roles, approvals, segregation of duties and oversight so the right people sign off the right decisions.
Screen and diligence who you deal with, investigate what needs a closer look, and report — with every step captured against the record it belongs to.
Maintain enterprise and operational risk registers on one taxonomy, map them to a single control library, and drive policy from authoring through approval, publication and attestation. Obligations and regulatory change flow into the same structure, so nothing lives in isolation.
Test control design and operating effectiveness on a schedule, capture the evidence once and reuse it across audits, frameworks and regulatory examinations. Findings become tracked issues with owners and due dates, driven to closure rather than logged and forgotten.
Establish the backbone: one risk taxonomy and register, a single control library, your policies and the obligations you are subject to — each mapped to the others so ownership and accountability are explicit from the start.
Run the programme against that backbone. Risk assessments, control testing, compliance and due-diligence lifecycles, third-party reviews, cases and approvals execute on defined workflows, with regulatory change feeding straight back into the controls it affects.
Evidence is captured as work happens, not assembled before an audit. Regulatory returns, committee packs and board reporting are generated from that same record, with every decision, override and version preserved in an immutable audit trail.
Ingest and screen, assess risk and investigate, then report — with every result, decision and override captured against the record it belongs to.
Work carries defined ownership — from operational management through risk and compliance to independent internal audit, under board oversight.
OnyxOne turns alerts into structured cases with evidence, entity links and recorded decisions. Investigators work in one place, decisions carry clear ownership and sign-off, and every case closes with an audit trail you can defend.
From alert to closure · one workspace
A representative view of the case metrics a team lead monitors — open cases, SLA adherence, alert volume and overdue reviews. Figures shown are illustrative examples, not real data.
From growing teams to financial institutions. Each edition lists exactly what it includes; add-ons and roadmap items are labelled honestly. Pricing is scoped to your deployment.
Risk registers, controls and policy management for growing compliance teams.
The full GRC operating system for regulated firms scaling their programme.
For financial institutions and large enterprises with complex governance and scale.
Extend any edition with specialist governance and resilience modules.
Built for regulated organisations
Sensitive compliance data, handled the way it should be — encrypted, access-controlled, and audit-logged. Everything we claim, we document.
Customer records, evidence and case data are encrypted in transit and at rest. Hardened HTTP security headers — HSTS, frame-ancestors none, nosniff and strict referrer and permissions policies — guard every request.
Sensitive credentials and service keys live and stay on the server. The browser never receives a secret, so a compromised client cannot leak one.
Granular roles govern who can screen, investigate, approve and report. Segregation-of-duties controls ensure the same person cannot both raise and sign off a decision where your policy forbids it.
Every action, decision, override and policy change is written to an append-only audit record — the evidence base you need for internal review, external audit and regulatory scrutiny.
Data location and retention are configurable to your regulatory obligations, and records are kept only as long as the law and your policy require, then deleted or anonymised.
Access, activity and integrations are logged and monitored, with a documented incident-response process. Capabilities that are not configured refuse safely rather than fail open.
Your teams work in one platform that centralises screening, cases and risk, and connects to the systems of record and data sources your deployment requires.
SSO, granular roles, data residency options and audit-grade logging designed for financial institutions and regulated enterprises.
OnyxOne provides software; it is not a regulated financial institution and is not itself an obliged entity. Your firm remains responsible for its regulatory obligations.
Terms, security controls, data-processing terms and sub-processors are published and versioned in the Trust Center.
Policies, audits, disclosures and system status — published and versioned. Empty sections are marked honestly until content is live.
If we can't say something truthfully yet, we say that too.
OnyxOne is an enterprise governance, risk and compliance (GRC) operating system — a single platform for regulated organisations to manage risk registers, internal controls, policies, regulatory obligations, audits, evidence, compliance cases and regulatory reporting.
Compliance, risk, internal audit, legal and governance teams — and the boards and executives they report to. It is built for banks, EMIs, PSPs and payment institutions, fintechs, insurers, lenders, investment firms, corporate and trust service providers, and large regulated enterprises. It suits a 50-person regulated fintech and a multinational group alike.
No. OnyxOne is a technology vendor. We provide software that helps your organisation govern and evidence its own compliance obligations; we are not a bank, EMI, PSP, payment institution or other regulated financial services provider, and we are not an obliged entity under AML law. Responsibility for meeting regulatory obligations remains with your organisation.
No — and we would rather be explicit about that boundary than blur it. OnyxOne is the governance and compliance control plane: it manages risk, controls, policies, obligations, cases, evidence and reporting. Real-time transaction monitoring, payment-risk scoring and authorisation decisioning are a different operational layer, and OnyxOne integrates with the engines and providers that perform them rather than replacing them.
As governed lifecycle and orchestration, not as the underlying data or decisioning engine. OnyxOne runs KYC/KYB onboarding, verification, risk assessment, approval, periodic review, remediation and audit as structured workflows; it calls your chosen identity, registry and screening providers through integrations; and it stores the results as evidence against the right record, under approval controls and an immutable audit trail. The screening databases and matching engines are your providers' — the programme governing them is ours.
They are one connected structure rather than four separate registers. Obligations map to the controls that satisfy them, controls map to the risks they mitigate, and control tests produce the evidence that proves they operated. When a test fails, the resulting issue, its owner, the remediation plan and the affected risk are already linked — so residual exposure is visible rather than inferred.
Evidence is captured as work happens rather than assembled under deadline. Auditors and examiners can be given scoped access to the control, its test history, the evidence attached to it and the full decision trail — including overrides, approvals and policy versions. Audit management plans engagements, tracks findings and drives remediation to closure on the same record.
Yes. Risk taxonomies and scoring, control libraries and framework mappings, policy hierarchies, due-diligence requirements, workflows, roles and approval thresholds are configurable to your methodology and risk appetite. The platform enforces your model rather than imposing a fixed one.
Data is encrypted in transit and at rest, secrets stay server-side, access is role-based with segregation of duties, and all activity is logged. Data residency and retention are configurable to your regulatory obligations. See the Security page in the Trust Center for the full posture.
Not yet. We build to recognised security standards, and SOC 2 and ISO 27001 are on our roadmap. We will publish attestations in the Trust Center once they are held rather than claim them before they are complete.
OnyxOne is configured to your risk taxonomy, control framework, policies, roles and workflows, and integrated with the systems and data sources your deployment requires. Screening, identity and data providers are contracted and configured per deployment rather than fixed to a single named partner.
Integration options are scoped per deployment. We do not publish a public API surface or endpoints today, and we would rather say that plainly than document a contract that is not stable. Talk to us about the integrations your implementation needs.
Book a demo and we will walk through the platform against your programme, then scope an implementation. For diligence, a DPA or a security review, everything you need to begin is published in the Trust Center.
See the platform against your programme. One place for risk, controls, policy, obligations, audit, evidence and reporting — defensible by design.