Skip to main content

Platform Overview

Openlane is an open-source compliance automation platform. It gives you a system of record for your compliance program (the people, systems, and vendors in scope; the policies and controls that govern them; the evidence that proves it) and the automation to keep all of it current.

The platform (and this documentation) is organized into a handful of areas that build on each other.

Organization Settings​

Everything in Openlane lives inside an organization: your tenant, your team, your data. The Settings section covers the administrative side: profile, members and roles, billing, and the custom data (enums and tags) that shapes how objects are classified to match how your team operates. Getting this foundation right pays off through the whole program: when every control, risk, and policy has a clear owner and audit trail, evidence collection takes less time and auditor questions have a named person to answer them.

Registry​

The Registry is your source of truth for who and what is in scope, the single place to answer the questions every audit starts with: who works in the environment, which third parties are involved, and which assets matter. It holds personnel (employees and contractors), entities (vendors and third parties), assets (systems, services, devices), platforms (the system boundaries that define your compliance scope), and contacts. These records feed everything downstream: they scope your Exposure work, anchor vendor due diligence, and give controls and evidence something concrete to point at.

Compliance Management​

Compliance Management is where your program takes shape, and its objects form a chain: policies and procedures document what you intend to do, controls operationalize those policies and map to the standards you're pursuing, evidence attaches to controls to prove they operate, and programs bundle all of it for a given audit period (say, System and Organization Controls 2 (SOC 2) Type 2 for this year). That chain (policy → control → evidence → program) is the outcome the rest of the platform exists to support, with questionnaires and audit preparation rounding out assessment and audit readiness.

Frameworks & Standards​

The standards catalog covers the frameworks you're likely working toward (SOC 2, ISO 27001, NIST CSF, GDPR, HIPAA, and more) with reference documentation and importable control sets, so you seed your controls from the catalog rather than authoring them from scratch. One control can satisfy requirements across multiple frameworks, which means adding a second standard doesn't mean duplicating your program.

Exposure​

Exposure connects risk management to real security work, in a pipeline that starts from Registry scope: your assets and entities define what gets scanned, scans surface vulnerabilities and findings, remediations document and verify the fixes, and closing them out updates the risks that capture what could go wrong: a repeatable risk-to-remediation trail auditors can follow.

Automation​

Automation keeps recurring governance work (access reviews, policy acceptance, evidence refresh) running on cadence, with approvals and audit trails built in: workflows and approvals gate changes and route reviews, campaigns run bulk outreach (annual attestations, vendor questionnaires), assessments define reusable questionnaire content, and tasks track the resulting work, each one owned, dated, and linked to the objects it concerns.

Trust Center​

The Trust Center is the public face of the program: a branded portal on your own domain where prospects and customers find your certifications, security documents (public or NDA-gated), subprocessors, and updates, instead of sending you another questionnaire. It publishes what the rest of the platform produces; completed frameworks, approved policies, and subprocessor records flow straight through.

Integrations & Security​

Integrations connect Openlane to the systems you already run (cloud providers and security tooling for posture collection, Slack and Teams for notifications, identity providers for single sign-on (SSO)), so Registry and Exposure data stays current without manual entry. How access to Openlane itself works (authentication methods, the permissions model, and groups) lives in Settings.

Where to Go Next​