AI-first GRC platform
Your controls already exist. Gwenda finds them.
Gwenda connects to the applications you already run and works out which controls you already have, then measures them against the gold standard for your industry: financial services, cyber security, GDPR, SOC 2, child care and aged care.
Read-only connections. Your data stays in your tenancy.
Your risk overview
Risk dashboard
Risks monitored
48
Across the sample portfolio
Need attention
8
High or extreme rated risks
Open actions
12
2 overdue · 10 on track
Controls effective
86%
Based on sample assessments
Risk heatmap
Where likelihood meets impact
| Likelihood / impact | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 | 0 risks, medium rating | 0 risks, high rating | 0 risks, high rating | 1 risks, extreme rating | 1 risks, extreme rating |
| 4 | 0 risks, low rating | 1 risks, medium rating | 2 risks, high rating | 2 risks, high rating | 0 risks, extreme rating |
| 3 | 1 risks, low rating | 3 risks, medium rating | 4 risks, medium rating | 2 risks, high rating | 0 risks, high rating |
| 2 | 2 risks, low rating | 5 risks, low rating | 6 risks, medium rating | 2 risks, medium rating | 0 risks, high rating |
| 1 | 5 risks, low rating | 6 risks, low rating | 4 risks, low rating | 1 risks, low rating | 0 risks, medium rating |
- Low
- Medium
- High
- Extreme
Risks by rating
A balanced view of your exposure
All figures and names are illustrative sample data.
Explore the full dashboardBuilt around the standards Australian regulators actually enforce, and the international ones your customers ask for.
- ASIC: AFS licence obligations
- AUSTRAC: AML/CTF
- APRA CPS 230 & CPS 234
- ASD Essential Eight
- ISO/IEC 27001
- SOC 2
- OAIC: Privacy Act 1988
- ACECQA: NQF & NQS
- Aged Care Quality Standards
- GDPR
Most organisations aren't non-compliant. They just can't prove it.
The evidence is already there: in your identity provider, your cloud console, your HR system, your rostering platform, and a spreadsheet somebody updated in March. What's left is finding what you've got and working out what's missing. That's the part Gwenda does.
How Gwenda works
From connected to confident, in four moves.
No control library to fill in. No 300-row questionnaire. Gwenda starts by reading what you already have.
- 01
Connect
Point Gwenda at the systems you already run: identity, cloud, endpoints, code, HR, rostering, ticketing.
- 02
Discover
Gwenda reads those applications and works out which controls you already have in place.
- 03
Benchmark
Your posture is scored against Gwenda's gold standard for your industry.
- 04
Remediate
Every gap arrives already owned, with the specific action that closes it and the evidence that will prove it is done.
Modules
One platform. Five regulated worlds.
Turn on the modules you need. Each one runs on the same discovery engine and evidence store, with the same board-ready reporting on top, so a control you prove once counts everywhere it applies.
Run a fund ASIC could look at tomorrow
Built for fund managers and non-bank lenders. Gwenda reads your registry, loan systems, screening tools and identity stack to evidence your licence obligations, your reformed AML/CTF program and the security posture investors diligence.
- Who can authorise a payment, and whether it takes two (from your fund administrator, Allvue, banking portals)
- Whether screening is actually running (from World-Check, ComplyAdvantage, FrankieOne)
- CDD files that are complete, and the ones that are not (from First AML, FrankieOne, greenID)
The Gwenda gold standard for financial services
Illustrative. Your figures come from your own systems.
Prove your Essential Eight maturity from real configuration
Gwenda reads your identity provider, cloud accounts, endpoint management and patch state, then scores your maturity against the target you are aiming for, from what is actually configured, not from what someone ticked.
- Who actually has administrative access (from Microsoft Entra ID, Okta, Google Workspace)
- Whether MFA is enforced or merely available (from Entra ID Conditional Access, Okta policies)
- Real patch state across your fleet (from Intune, Jamf, Kandji, AWS Systems Manager)
The Gwenda gold standard for cyber security
Illustrative. Your figures come from your own systems.
Know where personal data lives before someone asks
Gwenda maps the systems processing personal data and tests the controls around them, then keeps your records of processing, retention rules and breach readiness aligned with what your infrastructure is actually doing.
- Which systems hold personal data (from AWS, Azure, Google Cloud, Google Workspace, Microsoft 365)
- Who can reach it (from Entra ID, Okta, Google Workspace)
- Where data leaves the organisation (from OAuth grants, SaaS admin consoles)
The Gwenda gold standard for privacy
Illustrative. Your figures come from your own systems.
Get audit-ready without an evidence scramble
Gwenda maps your existing controls to the Trust Services Criteria and collects evidence continuously through the observation window, then shows you which criteria are still short, months before the auditor does.
- Joiner, mover and leaver events (from HR system, Entra ID, Okta)
- Whether change management held for every change (from GitHub, GitLab, CI/CD)
- Access reviews, and whether they were completed (from Identity provider, ticketing)
The Gwenda gold standard for SOC 2
Illustrative. Your figures come from your own systems.
Meet the National Quality Standard with the evidence to back it
For approved providers and services under the National Quality Framework. Gwenda tracks the seven quality areas, working with children checks, ratios, policy currency and incident records.
- Clearances and qualifications about to expire (from HR system, staff records)
- Ratio breaches across sessions (from Rostering and attendance systems)
- Policies past their review date (from Policy library, intranet)
The Gwenda gold standard for education and care
Illustrative. Your figures come from your own systems.
Stay ready for the Commission every week of the year
Built around the strengthened Aged Care Quality Standards, in force since 1 November 2025. Gwenda reads rostering, care management, training and incident systems to show your standing against each of the seven standards.
- Worker screening and training that is about to lapse (from HR and learning management systems)
- Rostered hours against care minutes (from Rostering and workforce management)
- Incidents against SIRS timeframes (from Incident management, care management systems)
The Gwenda gold standard for aged care
Illustrative. Your figures come from your own systems.
The benchmark
What does "good" actually look like?
Every compliance tool can tell you whether you ticked a box. Gwenda tells you how far you are from the standard your industry is really held to. For each module we maintain a gold standard: the control set a well-run organisation in that sector is expected to have, drawn from the legislation, the regulator's own guidance, and the practice of organisations that pass assessment. Your score is the distance between what Gwenda found and that.
- Defined per industry.
- A childcare service and a payments platform are not measured against the same thing, so they aren't.
- Kept current.
- When ASIC reissues its conflicts guidance, when the reformed AML/CTF Rules commence, when APRA revises CPS 230 or ACECQA updates the NQS, the gold standard moves and your score changes with it.
- It shows its working.
- Every score traces back to a specific control, the system it was read from, and the clause it maps to. No black box, no unexplained number.
Illustrative figures. Yours are measured from your own systems.
Under the bonnet
There's an engine under here, and it does the reading.
Reads the systems themselves
Findings come from live configuration and activity in your applications. What someone typed into a form last quarter doesn't get a vote.
Mapped once, counted everywhere
One control can satisfy the Essential Eight, ISO 27001 and SOC 2 at once. Gwenda knows which, so you evidence it once.
Configurable to how you actually operate
Multi-site, multi-entity, franchised or federated: scope, ownership and thresholds bend to your structure.
Continuous by default
Posture is recalculated as your environment changes. Drift shows up within days, well before the next audit would have found it.
Evidence that assembles itself
Every finding carries its source, timestamp and artefact, ready to hand to an auditor, an investor's due diligence team or the board.
Australian obligations, first-class
AU frameworks are the reason Gwenda exists. A bolt-on region pack was never the plan.
Discovery
Stop starting from a blank control register
Most compliance projects begin by asking people what controls exist. That takes weeks and produces an optimistic answer. Gwenda begins by looking. Within a day of connecting, you have an inventory of the controls you really have, with the evidence attached and the gaps already visible.
Posture
A single number you can actually defend
Your posture score is the measured distance between your discovered controls and the gold standard for your industry, broken down by standard, by site and by owner. "We're at 68%" comes with "and here's the 32%" attached.
Remediation
Every gap arrives with the thing that closes it
A finding that just says "non-compliant" creates work. Gwenda gives you the specific action, the owner, and the evidence that will prove it's done, tied to the control and clause that raised the finding. The next scan picks up the change, so nothing has to be marked complete by hand.
Integrations
Connect what you already run. Change nothing.
Gwenda reads your existing stack: identity, cloud, endpoints, code, HR, rostering, service desk. Connections are read-only by default, and there's nothing to install on staff devices. No migration, and no new system of record for anyone to learn.
Apex Group
Unit registry: investor register, holder identification numbers, unit holdings, application and redemption
Allvue Systems
Deal pipeline and credit approval workflow records
Salesforce Financial Services Cloud
Investor and prospect records including wholesale/sophisticated investor classification flags and certificate
FrankieOne
Per-customer KYC verification results with the data sources used and match confidence
OWNA
Enrolment and waitlist records
AlayaCare
Visit schedules and clock-in/clock-out records showing which visits were actually delivered
Diligent
Board and committee papers, agendas, minutes and resolutions with version history
RiskMan
Incident records with type, severity, date/time of occurrence and date notified
Deputy
Rostered hours against required coverage
Ausmed
Mandatory training requirements set per role, team, facility or provider
Microsoft Entra ID
Privileged role assignments
Amazon Web Services
IAM roles, policies and root account MFA
The size of the problem
This is what you're being measured against.
These figures describe the standards, not our results.
Trust
Read-only by default. Your data stays yours.
Least privilege, always
Gwenda asks for the narrowest read scope that answers the question, and nothing more.
Hosted in Australia
Your data is stored and processed in Australian regions.
Yours to take back
Export everything, revoke every connection, and Gwenda goes quiet. No lock-in on your own evidence.
Auditable to the source
Anything on your posture report can be followed back to the system that produced it, timestamp and artefact attached.
Questions we get asked
Do we need to have our controls documented before we start?
No, that is rather the point. Gwenda starts by discovering what you already have, so a blank control register is a perfectly normal starting position. Most organisations find they have more controls than they thought and less evidence than they hoped.
We're a wholesale-only fund. Doesn't that reduce what applies?
Less than most managers expect. Wholesale status narrows disclosure and takes you outside internal dispute resolution, but the s912A general obligations apply in full and the AML/CTF Act has no wholesale exemption at all. Your institutional investors' operational due diligence sits on top of both.
What access does Gwenda need?
Read-only, and scoped to the systems you choose. You can revoke it at any time. Gwenda never needs write access to run a discovery scan, and it asks for the narrowest scope that answers the question.
How long until we see a posture score?
Most organisations have their first scored posture within a day of connecting their first systems. You do not need every integration in place to get a useful picture: connect your identity provider and your cloud accounts and the shape of it appears immediately.
Can we run one module and add others later?
Yes. Modules are independent but share the same discovery engine and evidence store, so a control proven in one counts in the others automatically. Multi-factor authentication evidenced for the Essential Eight also satisfies ISO 27001 and SOC 2 without being re-evidenced.
Does Gwenda replace our auditor or assessor?
No, and nothing can. A SOC 2 report has to be issued by an independent CPA firm, and an assessment and rating visit is conducted by a regulatory authority. Gwenda gets you ready for them and keeps you ready in between, with the evidence already assembled.
Can we audit what Gwenda tells us?
All of it. Everything Gwenda reports carries the system it was read from, when it was read, and the clause it answers. If a number looks wrong, you can follow it back to its source and see for yourself.
We operate outside Australia as well. Is that a problem?
No. GDPR and SOC 2 are first-class modules, not a region pack. Australia is simply where Gwenda goes deepest.
See Gwenda read your actual environment.
Thirty minutes, your systems or ours. We'll show you what it finds and where you sit against the gold standard for your industry. No procurement conversation required.