For risk · audit · compliance & GRC teams
Governax is a tamper-evident decision ledger for compliance readiness. It records access changes from Slack, GitHub, Okta, Google Workspace, AWS, Microsoft Entra ID and GitLab into an append-only, SHA-256 hash-chained ledger per entity, so you can show an auditor who had access, what changed and when, and who approved requests raised in Slack.
We're building it with risk, audit, compliance and GRC teams who understand these challenges firsthand.
01 · The reality of compliance
Organisations have policies, controls and compliance frameworks.
But when it's time to demonstrate that those controls actually work, teams often have to piece together information from different systems, people and processes.
The difficult questions begin.
Can we demonstrate that the right processes are being followed?
Can we quickly find the information an auditor needs?
Which requirements aren't adequately addressed today?
How do we turn compliance requirements into practical action?
02 · The idea
Every organisation operates differently. We're working directly with practitioners and organisations to understand what they actually need.
Bring us the problem.Let's build the solution together.
Tell Us What You Need03 · A different way to build
Share an audit challenge, compliance gap, risk workflow or process that isn't working well today.
We'll understand your requirements, existing processes and what "good" looks like for your organisation.
Together, we'll explore the workflows, capabilities and tooling that could solve the problem.
Turn those requirements into practical processes and technology that help your organisation become more prepared for audits and compliance requirements.
05 · Seven tools, one record
Slack, GitHub, Okta, Google Workspace, AWS, Microsoft Entra ID and GitLab, each through a read-only connector. Grants and revokes land in one ordered record, alongside approvals for requests raised in Slack, so you can answer who had access and when.
See all seven integrationsWorkspace membership, channel lifecycle, external sharing and /governax approval decisions.
Example ledger entries
Organisation membership, team and repository access, branch protection and code-security alerts.
Example ledger entries
User lifecycle, group membership and application assignments from the System Log.
Example ledger entries
Admin activity: users, groups, admin roles and security settings.
Example ledger entries
IAM users, roles, policies and access keys, read from CloudTrail.
Example ledger entries
Directory roles, group membership, users and app consent from directory audits.
Example ledger entries
Group and project membership, access tokens, deploy keys and visibility changes.
Example ledger entries
06 · Tamper-evident by design
Each entry carries the hash of the one before it. Edit any entry after the fact and every hash that follows stops matching, so tampering is visible the moment anyone with read access verifies the chain.
Illustration: six ledger entries, numbered 1040 to 1045, all verified. When entry 1042 is edited, entries 1042 through 1045 fail verification and an alert reads "Chain broken at #1042". Restoring the original entry makes the chain verify again.
Entries are added, never overwritten. Corrections are new entries that reference the original.
Every entry is sealed with SHA-256 and linked to its predecessor, so order and content are fixed.
Auditors with read access to an entity can re-run verification, which recomputes every hash, rather than taking a screenshot on trust.
Each entry records who acted, what changed, when it happened and which tool it came from, ready for audit requests.
07 · SOC 2 and ISO 27001
Auditors for both ask the same questions about access: who had it, who approved it and when. Governax records access changes from Slack, GitHub, Okta, Google Workspace, AWS, Microsoft Entra ID and GitLab into an append-only, SHA-256 hash-chained ledger for each entity.
When you connect a tool, Governax takes a baseline snapshot of current access. Access requests raised in Slack record who asked, who approved and when. At access-review time the history is a query, not a reconstruction from screenshots, and auditors with read access can re-run verification.
Governax records the evidence. It does not certify you, audit you or map controls.
How the ledger answers the access questions a SOC 2 auditor asks.
Read the SOC 2 guideHow the ledger supports the access control evidence an ISO 27001 assessment asks for.
Read the ISO 27001 guide08 · Who we're looking for
You know where existing processes break down.
Bring us the problems you wish your tools solved.
Tell us where policies and requirements become difficult to operationalize.
Help us build workflows that teams can actually use.
Help us understand how organisations manage risk, controls and evidence at scale.
Shape the platform around real organisational needs.
Working toward stronger compliance readiness?
Let's understand where the gaps are and what could help.
09 · Areas we're exploring
Move from documented controls to processes teams can actually execute.
Make it easier to identify, organize and demonstrate the evidence behind your controls.
Translate requirements and policies into practical workflows.
Structure how teams identify, assess and respond to organisational risk.
Understand where processes may need attention before an audit or assessment.
Have something else in mind?
Tell us your requirement10 · Get early access
We're inviting our first 50 organisations to work closely with us as we build Governax around real-world risk, audit and compliance needs.
WITH EARLY ACCESS, YOU'LL RECEIVE
Preferential pricing reserved for our first 50 organisations.
Work closely with the people building Governax.
Your challenges and requirements can help shape future workflows and capabilities.
Get access to new capabilities as the platform evolves.
Connect your first tool and Governax takes a baseline snapshot of current access, then records every change after it into the ledger.
Whether you're preparing for an audit, addressing a compliance gap or trying to understand where you stand today, Governax works with you to identify what needs to happen next.
Connect your first tool11 · We want to hear from you
Is there a compliance workflow you wish existed?
Tell us what you're trying to solve. Whether you're an auditor, risk professional, compliance leader or an organisation preparing for its next audit, we'd like to understand what you're dealing with. Your requirement could help shape what Governax becomes.
No sales pitch. Just a conversation about the problem.
