AI-Powered GRC Software for SAP, Oracle and ERP Compliance Teams.

Effective date: 1 April 2026  |  Last updated: 17 April 2026  |  Applies to EU GDPR (2016/679) & UK GDPR (DPA 2018)

1. Who We Are

NextGen GRC Inc. ("NextGen GRC", "we", "us", or "our") operates the NextGen GRC platform. For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR, we act as the Data Controller for personal data collected through this website and the platform. Our registered address is: NextGen GRC Inc., 64 Siddapura Rd, A308 HILIFE RIO, Bengaluru, KA 560035, India.

2. Scope & Applicable Law

This policy applies to all personal data we process about visitors to this website and users of the platform. It is consistent with:

• EU GDPR (2016/679) — applies to processing of EU/EEA residents' personal data regardless of where processing occurs.
• UK GDPR & Data Protection Act 2018 — applies to processing of UK residents' personal data; the ICO (Information Commissioner's Office) is the lead supervisory authority.
• EU–US Data Privacy Framework (DPF, July 2023) — the replacement for Privacy Shield, enabling lawful data transfers from the EU to the US under adequacy decision; relevant for our US-based sub-processors.
• India DPDP Act 2023 — India's Digital Personal Data Protection Act; we comply as a data fiduciary processing data of Indian residents.

3. Personal Data We Collect

We collect personal data you provide directly and data collected automatically:

• Identity & Contact Data: first name, last name, work email address, company name, job title.
• Preference Data: ERP system in use, GRC area of interest, messages submitted through our contact form.
• Account Data: username, hashed password, access role, last login timestamp.
• Technical Data: IP address, browser type and version, time zone, pages visited, session duration — collected via server logs.
• Communications Data: records of correspondence if you contact us by email or contact form.

We do not process special categories of personal data (Art. 9 GDPR) or personal data of children under 16.

4. Lawful Basis for Processing (Art. 6 GDPR)

• Contract (Art. 6(1)(b)): Processing necessary to deliver the NextGen GRC platform under your subscription agreement or free trial.
• Legitimate Interests (Art. 6(1)(f)): Improving the platform, security monitoring, fraud prevention, direct marketing to existing customers. We have conducted a Legitimate Interests Assessment (LIA); you may request a copy.
• Legal Obligation (Art. 6(1)(c)): Retaining records as required by applicable tax, accounting, and regulatory law.
• Consent (Art. 6(1)(a)): Where we rely on consent (e.g., marketing emails to prospects), you have the right to withdraw at any time without affecting prior processing.

5. How We Use Your Personal Data

• To create and manage your account and deliver the platform features you have subscribed to.
• To respond to enquiries, provide product demos, and deliver technical support.
• To send product update notifications and relevant compliance content (opt-out available at any time).
• To monitor platform security, detect abuse, and prevent unauthorised access.
• To comply with legal and regulatory obligations and enforce our Terms of Service.
• To conduct internal analytics and improve product features (using pseudonymised or aggregated data where possible).

6. Your Rights Under GDPR (Arts. 15–22)

You have the following rights regarding your personal data. We will respond to verified requests within one calendar month (extendable by two months for complex requests, with notice):

• Right of Access (Art. 15): Obtain confirmation of whether we process your data and receive a copy.
• Right to Rectification (Art. 16): Have inaccurate personal data corrected without undue delay.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data where it is no longer necessary, you withdraw consent, or there is no legitimate overriding interest.
• Right to Restriction of Processing (Art. 18): Restrict processing while accuracy is contested or an objection is pending.
• Right to Data Portability (Art. 20): Receive personal data you provided in a structured, machine-readable format (JSON/CSV) and transmit it to another controller.
• Right to Object (Art. 21): Object at any time to processing based on legitimate interests or for direct marketing purposes; we will cease unless we demonstrate compelling legitimate grounds.
• Rights Related to Automated Decision-Making (Art. 22): We do not make solely automated decisions with legal or similarly significant effects on individuals.

To exercise any of these rights, email vikashrio308@gmail.com with the subject line "GDPR Data Subject Request — [Right]".

7. International Data Transfers

Our platform is hosted on cloud infrastructure that may involve transfers of personal data outside the EEA/UK. We ensure appropriate safeguards for all transfers:

• Transfers to the US: sub-processors participating in the EU–US Data Privacy Framework (DPF) or covered by Standard Contractual Clauses (SCCs) (EU Commission Decision 2021/914).
• Transfers to India: covered by SCCs until an adequacy decision is issued; we conduct Transfer Impact Assessments (TIAs) for high-risk transfers.
• UK transfers: governed by the UK's International Data Transfer Agreement (IDTA) or Addendum to EU SCCs.

8. Data Retention

• Account data: retained for the duration of your subscription plus 12 months after termination for legal/contractual purposes, then deleted.
• Contact form submissions and marketing enquiries: 24 months from last contact.
• Financial and billing records: 7 years as required by applicable tax law.
• Security logs (IP, access timestamps): 90 days for operational security, up to 12 months where required by law.

9. Security Measures (Art. 32 GDPR)

We implement appropriate technical and organisational measures including: TLS 1.2+ encryption in transit; bcrypt-hashed credentials at rest; role-based access controls; regular vulnerability assessments; and access logs reviewed periodically. Our controls are aligned with ISO/IEC 27001:2022 Annex A.

10. Data Breach Notification (Art. 33–34 GDPR)

In the event of a personal data breach, we will notify the relevant supervisory authority (EDPB / ICO) within 72 hours of becoming aware where the breach is likely to result in a risk to individuals' rights and freedoms. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

11. Privacy by Design & by Default (Art. 25 GDPR)

We embed data protection principles into our product from the design stage. Default settings are privacy-protective: data minimisation is applied to all features; access to personal data within the platform is restricted to the minimum necessary for each role; and new features undergo a DPIA screening before launch.

12. Cookies & Tracking

We use only strictly necessary session cookies required for platform authentication. We do not use third-party advertising, analytics, or social tracking cookies. You can disable cookies in your browser settings, though this will affect platform login functionality. Our landing page does not set any cookies; cookies are only set upon platform login.

13. Third-Party Sub-Processors

We use a limited number of vetted sub-processors (cloud hosting, transactional email delivery). Each is bound by a Data Processing Agreement (DPA) under Art. 28 GDPR. A list of current sub-processors is available on request.

14. Data Protection Officer

We have appointed a Data Protection contact responsible for overseeing GDPR compliance. Contact: vikashrio308@gmail.com (subject: "DPO Enquiry"). We aim to respond to all DPO enquiries within 5 business days.

15. Supervisory Authority & Right to Complain (Art. 77 GDPR)

If you are an EU resident and believe we have infringed your GDPR rights, you have the right to lodge a complaint with your local supervisory authority (e.g., the CNIL in France, BfDI in Germany, or the EDPB). UK residents may contact the ICO at ico.org.uk. We encourage you to contact us first so we can resolve your concern directly.

16. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email to registered users and by posting the updated policy with a revised effective date. Continued use of the platform after the effective date constitutes acceptance.

17. Contact Us

For privacy enquiries, data subject requests, or to exercise your GDPR rights:
Email: vikashrio308@gmail.com
Address: NextGen GRC Inc., 64 Siddapura Rd, A308 HILIFE RIO, Bengaluru, KA 560035, India.

Effective date: 1 April 2026  |  Last updated: 6 April 2026

1. Acceptance of Terms

By accessing or using the NextGen GRC platform ("Service") you agree to be bound by these Terms of Service ("Terms"). If you do not agree, please do not use the Service.

2. Description of Service

NextGen GRC provides a cloud-based Governance, Risk and Compliance (GRC) platform, including SOD analysis, risk management, audit trail, workflow automation, and compliance reporting features. The Service is provided on a subscription basis.

3. Accounts & Access

• You must provide accurate registration information and keep your credentials confidential.
• You are responsible for all activity that occurs under your account.
• You must be at least 18 years old and authorised to enter into this agreement on behalf of your organisation.
• We reserve the right to suspend or terminate accounts that violate these Terms.

4. Acceptable Use

You agree not to:

• Use the Service for any unlawful, fraudulent, or malicious purpose.
• Attempt to gain unauthorised access to any part of the Service or its underlying infrastructure.
• Upload or transmit malicious code, viruses, or disruptive data.
• Reverse engineer, decompile, or create derivative works from the Service.
• Resell or sublicense access to the Service without our written consent.

5. Subscription & Payment

Subscriptions are billed monthly or annually as selected at sign-up. All fees are stated in USD and are non-refundable except as required by law or stated in our refund policy. We may modify pricing with 30 days' notice.

6. Free Trial

We offer a 14-day free trial with full Professional features. No credit card is required. At the end of the trial, access will be suspended unless you choose a paid plan.

7. Intellectual Property

All intellectual property rights in the Service, including software, design, and content, remain with NextGen GRC Inc. You retain ownership of data you upload to the Service. You grant us a limited licence to host and process your data to deliver the Service.

8. Data & Privacy

Our collection and use of personal data is governed by our Privacy Policy, which is incorporated into these Terms by reference.

9. Limitation of Liability

To the fullest extent permitted by law, NextGen GRC Inc. shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising out of or related to your use of the Service. Our total aggregate liability shall not exceed the fees paid by you in the 12 months preceding the claim.

10. Disclaimer of Warranties

The Service is provided "as is" and "as available" without warranties of any kind, express or implied. We do not warrant that the Service will be uninterrupted, error-free, or free of harmful components.

11. Indemnification

You agree to indemnify and hold harmless NextGen GRC Inc. and its officers, directors, and employees from any claims, damages, or expenses (including legal fees) arising from your use of the Service or violation of these Terms.

12. Governing Law

These Terms are governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of the courts of Bengaluru, Karnataka.

13. Changes to Terms

We may update these Terms at any time. Continued use of the Service after changes are posted constitutes acceptance of the new Terms.

14. Contact

For any questions about these Terms, contact us at vikashrio308@gmail.com
NextGen GRC Inc., 64 Siddapura Rd, A308 HILIFE RIO, Bengaluru, KA 560035, India.

Sarbanes-Oxley Act of 2002  |  US Public Law 107-204  |  PCAOB AS 2201

Overview

The Sarbanes-Oxley Act (SOX) was enacted in response to major corporate accounting scandals (Enron, WorldCom). It applies to all US public companies and foreign private issuers listed on US exchanges. SOX establishes requirements for financial reporting accuracy, auditor independence, and internal control over financial reporting (ICFR).

Key Sections Relevant to IT Controls

• Section 302 — CEO and CFO must personally certify the accuracy of financial statements and disclose any significant internal control deficiencies or material weaknesses each quarter.
• Section 404(a) — Management must assess and report on the effectiveness of ICFR annually. This drives the need for documented and tested IT General Controls (ITGCs).
• Section 404(b) — External auditors must attest to management's ICFR assessment (applies to accelerated filers). Governed by PCAOB Auditing Standard AS 2201.
• Section 906 — Criminal penalties (up to $5M and 20 years imprisonment) for knowingly certifying false financial statements.

IT General Controls (ITGCs)

PCAOB AS 2201 and the COSO framework define the ITGC areas auditors focus on. These include:

• Logical Access Controls — Restricting system access to authorised personnel; preventing programmers from having production access; enforcing segregation of duties.
• User Access Reviews — Periodic (typically quarterly) certification that active user access is appropriate and business-justified.
• Change Management — Ensuring application and infrastructure changes are authorised, tested, and documented before moving to production.
• Computer Operations — Job scheduling, backup and recovery, incident handling with appropriate segregation.

Segregation of Duties (SOD) Under SOX

SOD is a primary SOX ITGC objective. A single individual must not be able to initiate, approve, record, and reconcile financial transactions. Common high-risk SOD conflicts include: AP clerk also having payment run authority; system administrator also having financial posting access; user who creates vendors also able to process payments. Unresolved SOD conflicts discovered during a §404 audit can constitute a significant deficiency or material weakness.

How NextGen GRC Helps

• Automated SOD analysis across SAP ECC, S/4HANA, Oracle EBS, and AD against 67+ rulesets — identifies conflicts before auditors do.
• Campaign-driven quarterly access reviews with complete reviewer accountability trail satisfying ITGC user access review requirements.
• Immutable SM20-synced audit logs provide §404 evidence for logical access and monitoring controls.
• Controls testing module with evidence capture, deficiency classification (control deficiency / significant deficiency / material weakness), and management response workflows.
• AI post-review summary identifies access control failures with SOX-relevant impact statements.

Contact

For SOX compliance questions or to schedule a controls mapping session: vikashrio308@gmail.com

ISO/IEC 27001:2022  |  Published October 2022  |  Supersedes ISO/IEC 27001:2013  |  Transition deadline: October 2025

Overview

ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS). It specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS — providing a systematic approach to managing sensitive information and ensuring confidentiality, integrity, and availability.

Key Changes in the 2022 Edition

• Annex A reduced from 114 controls (2013) to 93 controls across 4 themes: Organisational (37), People (8), Physical (14), and Technological (34).
• 11 new controls introduced: Threat intelligence (5.7), Information security for cloud services (5.23), ICT readiness for business continuity (5.30), Physical security monitoring (7.4), Configuration management (8.9), Information deletion (8.10), Data masking (8.11), Data leakage prevention (8.12), Monitoring activities (8.16), Web filtering (8.23), Secure coding (8.28).
• Organisations certified to ISO 27001:2013 must transition to 2022 by 31 October 2025.

Annex A Controls Most Relevant to GRC

• A.5.15 Access Control — Rules for managing access based on business and security requirements; least privilege.
• A.5.16 Identity Management — Full lifecycle management of digital identities including provisioning and de-provisioning.
• A.5.18 Access Rights — Provisioning, review, modification, and removal of access rights with management authorisation.
• A.8.2 Privileged Access Rights — Allocation and use of privileged access rights must be restricted and managed; periodic review.
• A.8.5 Secure Authentication — Secure authentication technologies and procedures based on access restriction.
• A.8.15 Logging — Logs recording user activities, exceptions, faults, and information security events produced, stored, and protected.
• A.5.28 Collection of Evidence — Procedures for identifying, collecting, and preserving evidence for information security incidents.
• A.5.33 Protection of Records — Records protected from loss, destruction, falsification, unauthorised access and release.
• A.5.36 Compliance with Policies — Regular reviews of information processing procedures for compliance with policies, standards, and rules.

How NextGen GRC Helps

• SOD analysis and quarterly access review campaigns directly address A.5.15, A.5.16, A.5.18, A.8.2 (access control lifecycle).
• SM20 real-time log pull and immutable audit trail satisfy A.8.15 (logging) and A.5.28 (evidence collection).
• Policy lifecycle management with version control and compliance tracking addresses A.5.33 and A.5.36.
• Risk register with likelihood/impact scoring supports the ISMS risk assessment process (Clause 6.1).
• Controls testing provides ongoing monitoring required by Clause 9.1 (performance evaluation).

Contact

For ISO 27001 alignment questions: vikashrio308@gmail.com

COBIT 2019  |  Published by ISACA  |  Current Edition  |  Companion: COBIT 2019 Design Guide, Implementation Guide

Overview

COBIT 2019 (Control Objectives for Information and Related Technologies) is ISACA's comprehensive framework for IT governance and management. It defines 40 governance and management objectives across 5 domains, provides a performance management system using a capability maturity scale of 0–5, and introduces 11 design factors that allow organisations to tailor their governance system to their specific context.

The Five Domains

• EDM — Evaluate, Direct & Monitor (6 objectives): Governance objectives covering strategy, benefits realisation, risk optimisation, resource optimisation, stakeholder transparency, and compliance.
• APO — Align, Plan & Organise (14 objectives): Management of enterprise architecture, innovation, portfolio, budget, workforce, relationships, service agreements, suppliers, quality, risk, security, and data.
• BAI — Build, Acquire & Implement (10 objectives): Managing programs, requirements, solutions, availability, change enablement, IT changes, and knowledge.
• DSS — Deliver, Service & Support (6 objectives): Managing service operations, incidents, problems, continuity, security services, and business process controls.
• MEA — Monitor, Evaluate & Assess (4 objectives): Performance monitoring, system of internal control, compliance with external requirements, and assurance.

Key Objectives for GRC Alignment

• EDM03 — Ensured Risk Optimisation: Board-level risk appetite, tolerance, and risk management strategy.
• APO12 — Managed Risk: Identifies, analyses, and manages IT-related risk including threat landscape, risk register, risk response, and monitoring.
• APO13 — Managed Security: Defines, operates, and monitors the information security management system.
• DSS05 — Managed Security Services: Protects enterprise information, processes, and systems; manages identity and access.
• DSS06 — Managed Business Process Controls: Defines and maintains business process controls and validates proper handling of transactions.
• MEA01 — Managed Performance & Conformance Monitoring: Collects, validates, and evaluates IT goals, metrics, and KPIs.
• MEA02 — Managed System of Internal Control: Monitors and evaluates the system of internal control including self-assessments and independent reviews.
• MEA03 — Managed Compliance with External Requirements: Identifies and monitors compliance with external legal, regulatory, and contractual requirements.

How NextGen GRC Helps

• Risk Register with scoring, treatment, and owner assignment directly implements APO12 and EDM03 objectives.
• SOD analysis and access reviews address DSS05 (identity and access management) and DSS06 (business process segregation).
• Controls testing, KPI dashboards, and AI post-review summaries fulfil MEA01 and MEA02 requirements.
• Policy compliance tracking supports MEA03 external compliance monitoring.
• Workflow automation for access requests and exceptions satisfies APO13 security management process requirements.

Contact

For COBIT 2019 mapping and governance design: vikashrio308@gmail.com

COSO IC 2013 · COSO ERM 2017  |  Committee of Sponsoring Organizations of the Treadway Commission  |  PCAOB-Referenced

Overview

COSO publishes two closely related frameworks widely adopted for internal control and enterprise risk management. Both are referenced by PCAOB AS 2201 as acceptable frameworks for evaluating ICFR under SOX §404.

COSO Internal Control — Integrated Framework (2013)

The IC framework defines five interrelated components and 17 principles that must all be present and functioning for internal control to be effective:

• Control Environment (Principles 1–5): Tone at the top, Board oversight, organisational structure, commitment to competence, accountability. Foundational to all other components.
• Risk Assessment (Principles 6–9): Specifies objectives, identifies and analyses risks, considers fraud risk, identifies and assesses changes that could significantly impact internal control.
• Control Activities (Principles 10–12): Selects and deploys control activities (preventive/detective), deploys general controls over technology, deploys through policies and procedures.
• Information & Communication (Principles 13–15): Uses relevant, quality information; internally communicates objectives and responsibilities; communicates with external parties.
• Monitoring Activities (Principles 16–17): Conducts ongoing and/or separate evaluations; evaluates and communicates deficiencies (control deficiency, significant deficiency, material weakness).

COSO ERM — Integrating with Strategy and Performance (2017)

The ERM framework extends internal control to enterprise-wide risk management integrated with strategy-setting. Its five components are:

• Governance & Culture: Board risk oversight, operating structure, desired culture, commitment to core values, attracting/retaining talent.
• Strategy & Objective-Setting: Business context analysis, risk appetite definition, strategy evaluation, business objectives formulation.
• Performance: Risk identification, risk assessment (likelihood × severity), risk prioritisation, risk response selection, portfolio view of risk.
• Review & Revision: Assessing substantial change, reviewing risk and performance, pursuing improvement in ERM.
• Information, Communication & Reporting: Leveraging information systems, communicating risk, reporting on risk, culture, and performance.

How NextGen GRC Helps

• Control Environment: Policy management with accountability assignments documents tone-at-the-top commitments; role-based access enforces organisational structure.
• Risk Assessment: Risk Register with likelihood × impact matrix, fraud risk identification via SOD analysis, and change-aware re-assessment workflows.
• Control Activities: SOD rules as preventive controls; access reviews as detective controls; controls testing with evidence capture for technology general controls.
• Monitoring: Real-time SOD dashboards (ongoing monitoring) plus quarterly review campaigns and AI post-cycle summaries (separate evaluations); deficiency classification workflow.
• ERM Performance: Risk treatment strategies (mitigate/transfer/accept/avoid) with owner, due date, progress tracking, and AI predictive analysis for next-period risk forecasting.

Contact

For COSO controls mapping or internal control framework workshops: vikashrio308@gmail.com