Risk, obligations and controls,
in one register.

Spreadsheets and ad-hoc registers — risks, obligations, controls, assessments, HAZOP studies, evidence, and the audit trail behind them. AI drafts obligations, bowties, briefing packs and regulatory change suggestions to cut the cross-referencing work that usually sits with one GRC lead. Nothing the AI drafts counts until a person accepts it.

Yes. The application, a dedicated database for each workspace, and document storage all run in Azure Australia East; production databases are zone-redundant with 35-day point-in-time restore. AI requests are processed by our AI provider — Anthropic by default, which processes them outside Australia. If that matters for your data, a workspace can instead run its AI on Azure OpenAI or on your own provider keys; talk to us when you set it up.

Full text for the TCFD Final Report (2017), ASX Corporate Governance Principles 4th Edition, and the NGER Act 2007. The framework library also lists key requirements for standards such as GRI, ISO 14001, ISO 45001, ISO 31000, ICMM, the EPBC Act, the Safeguard Mechanism and WHS legislation — without redistributing paywalled standard text. AI drafts obligations from a framework, or from your own licences and permits, each with a citation, for you to accept or reject.

Risks and opportunities follow an ISO 31000 workflow: your own risk criteria and matrix, inherent and residual ratings, an ESG taxonomy, treatment actions with evidence, KRIs with review thresholds, and quantitative analysis where you need it. Each risk has a bowtie with critical controls and control verifications. Obligations link to the controls and risks they relate to, every field change is kept in history, and the audit log is hash-chained and append-only.

Not by default. Ask Vigil and connected AI apps propose changes as drafts that a person reviews. An admin can loosen that per workspace, but approval decisions, sign-offs, admin settings, billing and deletions are never available to the AI at any setting.

Yes. VigilRisk runs a Model Context Protocol (MCP) server, so assistants that support MCP can connect over OAuth after a user signs in and approves the access. They read the register and can propose changes within the same workspace limits as Ask Vigil. Admins can switch connected apps off.

Each plan includes a monthly AI token allowance (2M on Operator, 10M on Operator+); an annual plan gets twelve months of allowance for its year. Tokens cover document analysis, Ask Vigil chat and AI drafting. Usage shows in-app. When the allowance is used up, AI features pause until the next period; the rest of the register keeps working.

Each legal entity should run as its own workspace for clean data and audit boundaries. Operator+ adds a group view: a consolidated, read-only picture across related workspaces with drill-down into each one.

Microsoft Entra ID SSO is included on every plan. Each workspace can limit sign-in to its email domains; new users are created as Viewer on first sign-in and an admin assigns Admin, Risk Manager or Analyst. SAML and non-Microsoft identity providers are on the roadmap.

Contact us to cancel at any time. When the subscription ends the workspace becomes read-only for 90 days, so you can export every register as CSV and your signed-off report packs as PDF or Word; re-subscribing in that window restores it. After that the workspace is permanently deleted, and backup copies expire within a further 35 days.