The Platform
Most teams juggle a dozen disconnected tools. Alvor replaces the stack with a single system where assets, risks, policies, and evidence are connected by default.
The platform
The modules share one set of data, with named links between them. Select a module to see the links it makes today.
Links the product makes today
Select a module above
Each module lists the records it shares with the others: a compliance finding that escalates into a risk, a design sign-off that raises one, an asset every risk can name. Only links the product makes today are shown.
The modules
Real screens from the product: one data model underneath, a module for each part of the program.
Draw your architecture, run STRIDE threat models on the live diagram, and map the controls that answer each threat. Named people sign the design off, and the record keeps who approved it and when.
A register built for security: systems, data, vendors and the people who own them, connected to the risks they carry and the plans that recover them, and filled automatically from the tools you already run.
A register with owners, treatment, and appetite thresholds. Risks link to the assets they touch and the controls that mitigate them, so posture is an answer, not an argument.
Frameworks that install with their official control text, and crosswalks built from NIST's public informative references. Attach evidence to a control once and reuse it across ISO 27001, NIST, and every framework you run.
Author, approve, and attest in one place. Policies carry version history and link to the controls they govern, with exceptions tracked instead of forgotten.
The program layer: plan the work, track KPIs, and run maturity assessments against the frameworks you care about. What the board asks, this module answers.
One structured assessment, findings with SLAs, contracts and certifications in a single vendor record. Third-party risk handled like your own.
Business impact analysis, continuity plans, and exercises, tied to the same asset register as everything else. When something breaks, the plan knows what it protects.
On screen
Sample data throughout. Every label and state is the product's own, and each card opens a real screen from the same module.
Example: a risk acceptance approved by its named Business Owner, with conditions, a scope, an expiry date and the residual score saved at the decision.
The requester nominates a Business Owner, System Owner or CISO. Only that person can approve, with conditions, a scope and an expiry date, and the residual score is saved at the moment of the decision.
Example: a risk drafted by the AI Assistant and approved by a person, with the approval written to the audit log.
Every write the assistant proposes waits for a person to approve it. The approval is written to the audit log, and the assistant runs on your own model.
Example: an acknowledgement campaign for version 4 of a policy, showing who has acknowledged it and when.
Run an acknowledgement campaign for each published version, with a due date and reminders. Each acknowledgement records the person, the time, the IP address and the session.
Example: one control mapped to ISO 27001 and NIST CSF 2.0, each with its own status, sharing one piece of evidence.
Attach evidence to the control once and reuse it across ISO 27001, NIST CSF 2.0 and any framework you map it to. Each framework keeps its own status, assessed against its own wording.
For your auditor
The method and the output, both from the product.
Which controls apply and why, on screen and as a CSV for the auditor.
ComplianceYour likelihood labels, impact dimensions and matrix travel with the register.
Risk ManagementThe business impact analysis, diagrams, threat tables and sign-off matrix in one branded document.
Secure by DesignGet started
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.