The GRC platform that takes root and weathers the storm.
Manage data protection, cybersecurity, risk and audit in one place: 34 regulatory frameworks, 705 reference controls and verifiable evidence, with chain of custody and trusted timestamps.
For CISOs, DPOs, risk and compliance teams, and the boards of regulated organizations.
Everything you already have activated.
Capabilities ready to use from day one.
Complying is no longer enough. You have to prove it, standard by standard.
Regulated organizations answer to several laws, several regulators and a board that asks for proof, not spreadsheets.
Many standards at once
Law 21.719, Law 21.663, ISO 27001, NIST, PCI DSS… Each framework asks for its own thing, and the same control ends up documented again and again in different spreadsheets.
Several regulators
CMF, MINSAL, ANCI (National Cybersecurity Agency) and the Personal Data Protection Agency: each with its own deadlines and its own way of requesting information. Without a single record, deadlines slip.
The board wants proof
"Are we compliant?" can no longer be answered with a yes. It is answered with complete, dated and traceable evidence that stands up to an audit or a regulatory inspection.
One system to govern risk and compliance.
Modules that share the same catalog, the same controls and the same evidence base.
Multi-framework compliance
Assessments with review and approval, segregation of duties, SoA in PDF, control tasks and certification cycles.
Regulatory library and crosswalks
Chilean and international frameworks, plus mappings between frameworks so you don't repeat work.
Enterprise risk (ERM)
Risk appetite, KRIs, risk↔control linkage and heat map.
Evidence and chain of custody
Evidence chained with HMAC, signed with ECDSA P-256 and timestamped per RFC 3161.
Audit
Immutable audit rooms closed by the auditor's sign-off; internal audit with separate review.
Incidents · Law 21.663
Live regulatory clock by entity type and a downloadable incident report.
Privacy · Law 21.719
Record of processing activities (RAT) with a public portal, data subject rights requests (access, rectification, erasure, objection and portability — ARCOP) tracked in business days, PIA/DPIA and breaches.
Third parties and questionnaires
Vendor inventory and questionnaire campaigns with separate review.
Policies and attestations
Current policies, attestation campaigns and an exceptions register.
Business continuity
BIA, plans, exercises and findings in one place.
Ethics, CMDB and training
Whistleblowing channel, asset inventory and facilitator-led drills.
Executive reporting
PDF reports with integrity proof and a timestamp, plus a notification center.
Chile's laws and the world's standards, in the same catalog.
34 frameworks and 705 reference controls ready to use, with mappings between frameworks and traceability to the legal source.
14 Chilean sector frameworks
275 controls designed for each regulated industry.
16 international frameworks
Security, privacy, continuity and IT governance standards. ISO/IEC 27017, ISO/IEC 27018 and NIST SP 800-61 r2 are in draft.
From the article to the circular
172 Chilean controls with legal citations checked against the National Congress Library (BCN), following the regulatory chain and linking to LeyChile.
Crosswalks and mappings between frameworks
One control, several standards: explore the equivalences with the visual navigator.
- Law 21.663 → NIST CSF 2.0
- ISO 27001 → NIST CSF · NIST SP 800-53 · SOC 2
- NIST CSF → NIST SP 800-53 → PCI DSS
- GDPR → ISO/IEC 27701
AlerceGRC helps you manage and evidence compliance; it does not replace legal advice, nor does it guarantee compliance. The catalogs are reference frameworks and do not replace the official legal text. Standard names indicate supported frameworks, not certifications.
Designed for the day you get audited.
What a CISO or DPO needs when they have to prove —not just state— that they comply.
Chain of custody, not blind trust
- Each custody event is chained to the previous one with HMAC-SHA256: any alteration breaks the chain and becomes visible.
- ECDSA P-256 digital signature on each event, verifiable offline, outside the platform.
- RFC 3161 timestamps from the time-stamping authority (TSA) your organization configures.
- Immutable WORM storage supported (S3 Object Lock in Compliance mode).
Ready for the auditor and the board
- Segregation of duties: whoever assesses does not approve, with full history.
- Auto-generated SoA in PDF from your controls.
- Audit rooms that close with the auditor's sign-off and become immutable.
- Executive reports in PDF with integrity proof and a timestamp.
Laws 21.663 and 21.719, brought into day-to-day operations.
Not just the catalog: workflows with deadlines, owners and a record of every step.
Incidents with a regulatory clock
Cybersecurity incident management from detection to closure.
- Live regulatory clock by entity type (operator of vital importance (OVI), essential service or other): early warning, update report and final report.
- Notifying the National CSIRT is a separate permission: whoever contains the incident does not report it on their own, and every notification is logged.
- Downloadable incident report, timestamped.
- Informative crosswalk Law 21.663 → NIST CSF 2.0.
Deadlines are configured by entity type; validate them with your legal counsel.
Privacy in operation
Ready for the law's entry into force, currently set for 1 December 2026.
- RAT (record of processing activities) with a public transparency portal.
- ARCOP requests from data subjects, with deadline tracking in business days.
- PIA/DPIA with an approval workflow.
- Data breaches with alerts to the DPO and a privacy dashboard.
In the event of a security breach you must report it to the Personal Data Protection Agency without undue delay and, in certain cases, notify data subjects. Fines reach up to 20,000 UTM — Chile's monthly tax unit (≈ CLP 1,434 million, UTM, Sep. 2026) for very serious infringements and, for repeat very serious infringements by companies that are not small or medium-sized, up to 4% of annual revenue.
Law 21.719 catalog with citations checked against the BCN.
Built by cybersecurity people. It connects to your operations.
Alerce was built by practitioners with more than 20 years in cybersecurity: SOC, digital forensics and incident response. We know what a regulatory inspection asks for because we have handled real incidents with regulatory deadlines running.
Security from the ground up
- Customer isolation enforced at the data engine level —not in application code that can be bypassed.
- Deny-by-default RBAC: no explicit permission, no access.
- Segregation of duties in approvals, audit, risk and incidents.
- TOTP MFA, enforceable by organization policy.
Integrations
- SAML / OIDC SSO and user provisioning with SCIM 2.0.
- Audit log export to your SIEM in OCSF and CEF.
- Connectors for Jira, GitHub, Datadog and n8n.
- Signed webhooks to integrate your own workflows.
Hardened cryptography
Cryptographic hardening already in production.
- Two-factor re-authentication for sensitive administrative operations.
- Single-use two-factor codes: a code that has already been used is not accepted again.
- Cryptographic keys separated by purpose (sessions, platform secrets and two-factor), with rotation support.
- Session tokens with a pinned algorithm and a key identifier.
- Cryptographic inventory and automated continuous-integration rules that block insecure uses of cryptography.
One trunk, several branches.
AlerceGRC is the core platform. Around it, products for every stage and size of organization.
End-to-end governance, risk and compliance.
For regulated organizations and their boards: multi-framework compliance, enterprise risk, audit, incidents and privacy on a single base of verifiable evidence.
Law 21.719 Assessment
Diagnostic and full alignment with Law 21.719 for mid-sized companies and SMEs. Score, roadmap, legal documents and an inspection pack. See product
DPO
A data protection officer as a service, assigned to your account and working on your own evidence. Write to us to activate it.
Monitor
Continuous monitoring of your compliance: regulatory alerts and a heads-up when your score starts to slip.
Academy
Privacy culture and training for your team, based on your company's real findings.
Mid-sized company or SME? Start with the free Law 21.719 diagnostic (in Spanish) and grow into the full platform when you need it. See how it works ↓
From "I don't know where to start" to a plan backed by evidence.
1 · Diagnose
Answer 25 highest-risk questions in 15 minutes and get your score, your traffic light and your 3 most critical gaps. Free, no card required.
2 · Align
The full assessment (118 questions) generates your roadmap prioritized by impact and effort, with step-by-step instructions to close each gap.
3 · Demonstrate
Generate your RAT, your DPAs and your policy; upload evidence with a SHA-256 seal; export the inspection pack the day the regulator knocks on the door.
No card required · Instant result · 25 highest-risk questions · Service in Spanish
CISO-grade rigor, a human touch.
The principles we build with —and the ones we bring when we work alongside you.
Let's talk about your governance, risk and compliance.
We'll show you the platform with the frameworks and laws that apply to your organization. Mid-sized company or SME? Start with the free Law 21.719 diagnostic (in Spanish): it takes 15 minutes.
or write to us at [email protected]