01 — Unify
Everything in one register set
Findings, controls, assets and evidence live once and are reused across risk, compliance, audit and continuity.
Governance · Risk · Compliance
Every risk, every regulator, every board — on one platform.
NexusLine unifies risk, compliance, governance, audit, continuity and third-party management into a single connected system — deployable as managed cloud or entirely inside your own data centre. Aligned to ISO 27001, NIST CSF, PCI DSS and Basel.
17 frameworks, preloaded
- ISO 27001:2022
- NIST CSF 2.0
- NIST SP 800-53
- PCI DSS 4.0
- SOC 2
- Basel Operational Risk
- Shariah governance
The problem
GRC in spreadsheets doesn't survive an audit.
- 01
Obligations tracked in Excel
No obligation register, no owner, no evidence trail.
- 02
Findings scattered everywhere
Audit, compliance and RCSA findings in six different sheets.
- 03
Every discipline is a silo
ICFR, BIA, fraud, model risk — separate tools, or none at all.
- 04
Global suites don't fit
Priced, hosted and built for a different scale.
The result: a compliance function that spends its time assembling evidence instead of managing risk.
The solution
One platform. Every discipline. Your infrastructure.
02 — Comply
Comply once, report many
Map one control to many requirements, accept suggested crosswalks, and export a Statement of Applicability.
03 — Own your data
SaaS or fully on-premise
Run it as managed cloud, or deploy the entire stack inside your data centre — air-gapped and offline-licensed.
64Functional modules
17Preloaded frameworks
1,333Framework clauses
96Granular permissions
The dashboard
Five questions, in the order a board asks them.
Numbers that explain themselves. The health score is built from the evidence underneath it — and every count opens the list behind it.
72/100
Governance health
Elevated
Within tolerance 35%81
38 of 47 risks at or under tolerance
Control assurance 30%64
112 of 175 operating controls effective or partially effective
Compliance assured 20%70
421 of 601 applicable clauses backed by a working control
Nothing overdue 15%72
70 of 250 tracked deadlines past due
Example data · every count opens the list behind it
- 1
Are we inside the boundary we set?
The health score, and one queue of what needs a decision or is overdue.
- 2
Where are we outside appetite?
The risk matrix on your own scale, and top exposures with owner, appetite position and control count.
- 3
Are the controls actually working?
Effective, partial, ineffective or never tested — with tests overdue and failed.
- 4
Are we compliant, and can we prove it?
Per framework: assured, mapped but not tested, failing, no control — beside the percentage somebody marked compliant.
- 5
What happened?
Incidents with the regulator-reportable count, KRIs as RAG, and what moved in the period.
A control that is mapped but never tested earns nothing. A measure with no data is left out and says so — never scored as 100%.
Platform at a glance
Browse the full catalogue →
64 modules across 11 domains.
- My Work
- Dashboard & Health Score
- Reports & KPIs
- Report Builder
- Strategy & Goals
- Projects
- Approvals
- AI Assist
- Risk Register & Appetite
- Risk Candidates
- Operational Risk (RCSA, KRI)
- Scenario & Capital
- Model Risk
- Risk Quantification
- Threat Library
- Risk Exceptions
- Compliance Management
- Framework Library
- Regulatory Change
- ICFR
- Declarations
- ESG / Green Banking
- Business Units
- Processes
- Legal Register
- Board & Committees
- Policy Management
- Delegation of Authority
- Users & Roles
- Incidents
- Vulnerabilities
- Business Continuity
- Business Impact Analysis
- Access Reviews
- Issues & Actions
- Control Catalogue
- Evidence
- Awareness Training
- Internal Audit
- Information Assets
- IT Assets
- Data Privacy (RoPA)
- Data Protection
- Third Parties
- Outsourcing & Cloud
- Vendor Assessments
- Questionnaires
- AML / CFT
- Fraud Risk
- Whistleblowing
- Shariah Governance
- General Settings
- Organisation Settings
- Integrations & CCM
- Custom Fields
- Lookups & Dropdowns
- Status Rules
- Turnaround Time (TAT)
- Approval Workflows
- Saved Filters
- Import / Export
- Webhooks
- Single Sign-On
- Activity Log
- Connected
- Shared issue & action register
- Evidence collected once, reused
- Crosswalks across frameworks
- Every count drills to its list
- Append-only audit trail
Document intelligence
Turn a regulation into obligations in seconds.
Paste a circular, a policy or an incident note. NexusLine extracts the obligations, summarises, suggests risks, or maps the text to a framework — and files a structured result straight into Regulatory Change.
1
Paste the source
A regulatory circular, internal policy, or incident note — any prose your team would otherwise read line by line.
2
Choose the action
Extract obligations, summarise, suggest risks, or map to ISO 27001 — whatever the moment needs.
3
File the result
Get a structured output, saved and ready to file into the obligation register with owners and deadlines.
Runs offline, too. With no API key configured, a deterministic on-device engine does the extraction — so an air-gapped bank gets the feature with zero data leaving the building.
Built for regulated institutions
Security & audit in detail →
Passes the IT audit on day one.
Tenant isolation
Enforced at the database
RBAC
96 permissions, 6 roles
Four-eyes
The maker never checks
Identity
MFA · SSO · LDAP
Audit trail
Everything, logged
Licensing
Offline, no phone-home
Deployment
Compare deployment options →
Managed cloud, or entirely your own.
Speed & low ops overhead
- We operate it — fastest to launch
- Segregated per-tenant data
- Continuous, managed updates
- Subscription licensing
Data-sovereignty mandates
- Inside your data centre, air-gapped capable
- Data never leaves the bank
- Versioned images, migrations and an offline bundle
- Offline Ed25519 licence, no phone-home
Same capability set and database-level tenant isolation in both.
Why NexusLine
Enterprise capability, right-sized.
Breadth
One connected suite
More modules, more lifecycle depth and a real unified issue register — the connective tissue point tools never build.
Depth
Regulation, not templates
Basel capital, model-risk validation, ICFR, continuity and local-regulator specifics — the details, not a generic checklist.
Class
Archer-grade, adoptable
The capability set of the enterprise suites, delivered at a scale and price a growing institution can actually adopt.
Sovereignty
On your terms
SaaS when speed matters, fully on-premise and air-gapped when the mandate says data cannot leave the building.
FAQ
Frequently asked questions.
Can NexusLine run entirely on-premise or air-gapped?
Yes. The same platform runs as managed cloud or entirely inside your own data centre, including air-gapped networks, and the capability set is identical. On-premise installs are updated with versioned images, migrations and an offline bundle, and use offline Ed25519-signed licences with no phone-home. Compare deployment options.
Which frameworks come preloaded?
Seventeen frameworks with 1,333 clauses, including ISO 27001:2022, NIST CSF 2.0, NIST SP 800-53, PCI DSS 4.0, SOC 2, Basel operational risk, Shariah governance and four SBP packs. Control frameworks bring their controls with them, and crosswalks let one control satisfy requirements across frameworks. Browse the module catalogue.
Does document intelligence send our documents to a third party?
Not unless you configure an external AI API key. Without one, a deterministic on-device engine does the extraction, so no data leaves the building — which is how air-gapped installations use the feature. How document intelligence works.
How is our data isolated in the managed cloud?
Each organisation’s data is segregated per tenant and isolated in the database with PostgreSQL row-level security (FORCE RLS), so even a compromised query cannot cross organisational boundaries — it fails closed. Data is encrypted in transit and at rest, and access is governed by SSO, MFA and 96 granular permissions. Security & audit.
How long does it take to get started?
Onboarding is five steps: choose your locale, frameworks and modules — pre-selected for your institution type — then invite your team. Managed cloud is the fastest way to launch. For a demo, tell us which frameworks you run and we will load them into a live environment.
How is NexusLine priced?
Pricing depends on the editions you choose — each organisation picks which modules its teams see. Managed cloud is a subscription; on-premise uses an offline, signed licence that lists your editions. Email info@nexusline.io or request a demo for a quote.
Request a demo
One platform for every regulator, every risk, every board.
Book a walkthrough with your own frameworks loaded — and see how NexusLine unifies your risk and compliance function in a single system, on the infrastructure you choose.
nexusline.io · info@nexusline.io · SaaS & on-premise