Compliance that stands up to a regulatory inspection and a board meeting.
Data protection, cybersecurity and your sector regulations —governed in one place, with sealed evidence that can be verified outside the platform.
Designed for CISOs, DPOs, data governance teams and boards accountable to regulators and shareholders.
Each owner, their own evidence. One system.
What AlerceGRC solves depending on who you are and who you answer to.
Posture, not spreadsheets
Reference controls from ISO 27001, NIST and Chile's Cybersecurity Framework Law (Law 21.663) connected through mappings between frameworks. Incidents with a live regulatory clock by entity type, and notification to the CSIRT as a separate permission.
Demonstrable accountability
Record of processing activities (RAT) with a public portal, data subject rights requests (access, rectification, erasure, objection and portability — ARCOP) with deadlines in business days, PIA/DPIA with approval and breaches with alerts. Ready for Chile's Personal Data Protection Law (Law 21.719).
From data to control
Whoever assesses does not approve: segregation of duties in assessments, audit, risk and incidents. Statement of Applicability (SoA) generated in PDF from your controls.
Decisions with backing
Enterprise risk against the defined appetite, with KRIs and a heat map. Executive reports in PDF with integrity proof and a timestamp.
What's already in the platform.
Counted from the catalog and the product, not estimated.
Controls with legal citations
Chilean controls with references checked against the National Congress Library (BCN).
Mappings between frameworks
7 crosswalks: the same evidence relates to several frameworks.
Languages
Interface in Spanish, English and Portuguese for regional teams.
Audit closure
The audit room is closed with the designated auditor's sign-off and becomes immutable.
The entire GRC cycle, in a single platform.
Compliance, risk, evidence, incidents, privacy and operations share the same controls, owners and evidence.
Compliance
- Multi-framework assessments with review and approval
- Segregation of duties and audited CSV export
- Auto-generated SoA in PDF
- Regulatory library, crosswalks and gaps by obligation
Enterprise risk (ERM)
- Risk register and owners
- Risk appetite by category, with a separate permission
- KRIs with history and heat map
- Risk ↔ control linkage (mitigates, causes, monitors)
Evidence and audit
- Sealed, verifiable chain of custody
- Audit rooms closed by the auditor's sign-off
- Internal audit with execute / review separation
- Verifiable legal exports and audit simulation
Incidents and continuity
- Law 21.663 incidents with a live regulatory clock
- Continuity: BIA, plans, exercises and findings
- Training and facilitator-led drills
Privacy
- RAT with a public transparency portal
- ARCOP requests with deadlines in business days
- PIA/DPIA with an approval workflow
- Data breaches with alerts and a privacy dashboard
Third parties, policies and ethics
- Vendor inventory and their risk
- Questionnaires with respondent / reviewer separation
- Policies with attestation campaigns and exceptions
- Whistleblowing channel and conflicts of interest
Operations
- CMDB: assets, criticality, dependencies and controls
- Control tasks by cadence, with due dates
- Your organization's ISO, SOC 2 and PCI certification cycles
- Notification center: email and bell
Reporting
- Dashboard with incidents, notifications and ERM against appetite
- Executive report in PDF with integrity proof and a timestamp
- History of issued reports
War Room
- Incident coordination with playbooks and controlled remediation
- Unified multi-role timeline with UUID-based tracking
- Enforcement that blocks closure without verifiable proof
- Self-guided tabletops required by Law 21.663 and ISO 22301: crisis drills without affecting production
Legal Review (Vertical 0)
- Regulatory library review queue for attorneys
- Batch approval before publishing to catalog
- Controlled handoff to automation (no autopublish)
34 frameworks and 705 reference controls, ready to activate.
15 Chilean sector frameworks, 16 international ones and 3 Alerce baseline frameworks, on the same evidence engine.
Law 21.719 is pre-loaded in all plans. Additional regulatory packages —ISO 27001, NIST CSF, Law 21.663, CMF, MINSAL, etc.— are contracted separately based on your organization's sector and scope.
Chilean sector frameworks 14 frameworks · 275 controls
| Sector | Framework and base regulations | Controls | Citation checked against BCN |
|---|---|---|---|
| Cross-sector | Law 21.663 · Cybersecurity Framework | 10 | Yes |
| Cross-sector | Law 21.719 · Personal data protection | 8 | Yes |
| Banking and fintech | CMF: RAN 1-13, RAN 20-10, Law 21.521, NCG 502, Law 19.913 | 28 | Yes |
| Health | MINSAL: Law 20.584, DS 41, DS 140 | 21 | Yes |
| Digital government | DS 7, Law 21.180, Law 20.285 | 22 | Yes |
| Regional governments | GORE: Law 19.175, DS 295 | 22 | Yes |
| Municipalities | Law 18.695, Law 18.575 | 23 | Yes |
| Education | Cross-cutting, all levels | 25 | Yes |
| Education | Primary education | 20 | Yes |
| Education | Secondary education | 17 | Yes |
| Education | Higher education: Law 21.091, Law 20.129, Law 21.369 | 21 | Yes |
| Energy | Law 20.936, DS 109 | 20 | Yes |
| Mining | DS 132 | 20 | Yes |
| Retail and commerce | Law 19.496, Law 20.009 | 18 | Yes |
Crosswalks between frameworks 7 · 116 mappings
| Source → target | Mappings |
|---|---|
| Law 21.663 → NIST CSF 2.0 (informative) | 8 |
| GDPR → ISO/IEC 27701 | 8 |
| ISO 27001 → NIST SP 800-53 | 13 |
| ISO 27001 → NIST CSF | 17 |
| ISO 27001 → SOC 2 | 10 |
| NIST SP 800-53 → PCI DSS | 48 |
| NIST CSF → NIST SP 800-53 | 12 |
International frameworks 16
Legal traceability in every Chilean control. Controls cite their regulatory source:
with a link to the official source in LeyChile (BCN). Is your regulation missing? We model it on the same engine, without redoing what you already have.
International frameworks are catalogs of reference controls (subsets), not the full text of each standard. AlerceGRC helps you manage and evidence compliance; it does not replace legal advice, nor does it guarantee compliance. The catalogs are reference frameworks and do not replace the official legal text. Standard names indicate supported frameworks, not certifications.
It speaks your law, not a translated template.
Operational modules for the laws that require evidence in Chile today, plus the frameworks of your sector regulator.
Incidents with a regulatory clock
- Early warning, update report and final report by entity type (operator of vital importance (OVI), essential service or other)
- Live countdown and staggered due-date reminders
- Notification to the National CSIRT as a separate permission: whoever contains the incident does not report it on their own
- Downloadable incident report, timestamped
Deadlines are configured by entity type and validated by your legal team. The platform records and documents the notification; your organization submits it to ANCI (National Cybersecurity Agency).
Privacy in operation
- RAT (record of processing activities) with a public transparency portal
- ARCOP requests with deadline tracking in Chilean business days
- Impact assessments (PIA/DPIA) with approval
- Breach register with immediate alert to the DPO
The law takes effect on 1 December 2026 (a bill in the Senate, Bulletin 18.623-07, proposes extending that date to 1 December 2027). In the event of a security breach you must report it to the Personal Data Protection Agency without undue delay and, in certain cases, notify data subjects. Fines of up to 20,000 UTM — Chile's monthly tax unit (≈ CLP 1,434 million, UTM, Sep. 2026) and, for repeat very serious infringements by companies that are not small or medium-sized, up to 4% of annual revenue. Response deadlines are validated by your legal team.
Your sector, with citations to the source
- CMF: banking and fintech (RAN, Law 21.521, NCG 502)
- MINSAL: Law 20.584, DS 41 and DS 140
- Education: primary, secondary and higher (Law 21.091, 20.129, 21.369)
- Government: digital government (DS 7, Law 21.180), regional governments (GORE) and municipalities
Reference frameworks built by AlerceGRC; they are not products approved by the regulators.
Designed for the day you get audited.
What a CISO or DPO needs when they have to prove —not just state— that they comply.
Chain of custody, not blind trust
- Chained HMAC-SHA256 log: each event includes the hash of the previous one and a sequence number; any alteration breaks the chain
- ECDSA P-256 digital signature on each event, with an embedded public key to verify offline, outside the platform
- RFC 3161 timestamps with a TSA configurable per organization: you can use an accredited TSA
- Support for immutable WORM storage (S3 Object Lock, Compliance mode) and legal holds
Ready for the authority
- Verifiable legal exports: manifest, hashes, timestamp and chain of custody in one package
- Audit rooms with findings and a timeline, closed by the auditor's sign-off and immutable afterwards
- Executive reports in PDF with integrity proof and a timestamp
- Audit simulation before the real one arrives
The ECDSA signature attests to the technical integrity of the records; it does not replace the electronic signature regulated by Law 19.799.
Built the way a CISO would build it.
The platform's own controls, described exactly as they are implemented.
Customer isolation
Isolation enforced at the data engine level, not in application code. No organization's data is accessible from another —by design, not by configuration.
Deny-by-default access
Deny-by-default RBAC: a missing permission means access denied. Segregation of duties in approvals, audit, risk and incidents.
Strong authentication
TOTP MFA with backup codes, enforceable by your organization's policy. New-device alerts and lockout after failed attempts.
Corporate identity
SSO with SAML or OIDC and user provisioning with SCIM 2.0. Short-lived sessions with rotating renewal.
Encrypted secrets
MFA, SSO, email and connector secrets encrypted with AES-256-GCM in the database.
Supply chain and operations
Security CI with static analysis, secret and dependency scanning, SBOM and a signed container image. Runs on AWS with TLS 1.3.
Hardened cryptography
Cryptographic hardening already in production.
- Two-factor re-authentication for sensitive administrative operations.
- Single-use two-factor codes: a code that has already been used is not accepted again.
- Cryptographic keys separated by purpose (sessions, platform secrets and two-factor), with rotation support.
- Session tokens with a pinned algorithm and a key identifier.
- Cryptographic inventory and automated continuous-integration rules that block insecure uses of cryptography.
- Banking-grade credential security: password and backup code protection conforming to OWASP ASVS Level 2 and NIST SP 800-63B.
The platform was built on these standards. We actually comply.
The model that fits your organization.
From shared cloud to your own datacenter. All three flavors run the same platform and the same set of controls.
SaaS multitenant
Cloud managed by Alerce. Immediate onboarding, automatic updates. Data-layer isolation — no organization can see another's data.
For most organizations.
Dedicated single tenant
Exclusive instance on AWS, managed by Alerce. No neighbors, no shared infrastructure. For organizations with strict isolation requirements (banking, health, government).
Quoted by scope.
On-premise / private cloud
Installation in your infrastructure or your cloud account. Full control over data and environment. For entities with data sovereignty or regulatory residency requirements.
Quoted by scope.
All three models include the same GRC engine, the same controls and the same chain of custody. Only who manages the infrastructure changes.
It connects to what your team already uses.
SAML / OIDC SSO
Single sign-on with your identity provider.
SCIM 2.0
User provisioning from your corporate directory.
Jira
Connector to bring compliance actions into your workflow.
GitHub
Connector to your repositories as a source of technical evidence.
Datadog
Connector to your infrastructure monitoring.
n8n
Automations with HMAC-authenticated callbacks.
Signed webhooks
Timestamped, signed outbound events, with a delivery log.
SIEM export
Audit log exportable in OCSF and CEF formats.
Simple to govern, rigorous inside.
Activate your frameworks
Choose your sector's frameworks and the international ones you are required to meet. The crosswalks show where they overlap.
Assess and close gaps
Assessments with review and approval, tasks by cadence and an owner assigned to every action.
Demonstrate
SoA in PDF, board reports and verifiable evidence exports for the regulator or the auditor.
What global platforms don't give you.
It speaks your law
15 Chilean sector frameworks and catalogs for laws 21.719 and 21.663 with citations checked against the BCN —not a template translated from abroad.
Evidence verifiable outside
A chained and signed chain of custody, verifiable offline, with timestamps from the TSA your organization chooses.
Built by defenders
Hands-on cybersecurity experience —SOC, forensics, incident response— built into every control.
The comparison your committee will ask for.
| Capability | AlerceGRC | Global platforms (Vanta / Drata) | Traditional consultancies |
|---|---|---|---|
| Laws 21.719 and 21.663 with legal citations checked (BCN) | Native | Not verifiable | Varies |
| Chilean sector catalog (CMF, MINSAL, education, government…) | 14 frameworks | Not verifiable | Varies |
| Interface in Spanish, English and Portuguese | ES · EN · PT | Varies | Varies |
| Signed chain of custody, verifiable offline, with RFC 3161 timestamps | Yes | Not verifiable | Varies |
Third-party cells have not been verified by AlerceGRC; confirm them with each vendor.
What's active on the platform today.
- +25 frameworks and +567 controls, including Chilean sector frameworks
- Crosswalks with a visual navigator
- Live ANCI clock and incident report
- Approval with segregation of duties and CSV export
- Auto-generated SoA in PDF
- ERM with appetite, KRIs and mitigating controls
- Audit rooms closed by sign-off
- Privacy: breaches, PIA/DPIA and dashboard
- GRC clocks: control tasks and certification cycles
- CMDB and notification center
- SSO / SCIM console
- Account security alerts: new device and lockout
- Hardened cryptography: two-factor re-authentication and keys separated by purpose
Your sector, already modeled.
Chilean frameworks by vertical, activated on the same platform. And if your regulation isn't there, we build it for you.
AlerceGRC helps you manage and evidence compliance; it does not replace legal advice, nor does it guarantee compliance. The catalogs are reference frameworks and do not replace the official legal text. Standard names indicate supported frameworks, not certifications.
Book a demo with our team.
We'll show you your frameworks, your risk and what audit-ready evidence looks like. No smoke and mirrors.
Write to us at [email protected] · +56 9 3882 1702
Book a demo →