AEGIS by Nexus Void · GRC software for startups
GRC software that gets you compliant, and keeps you compliant.
AEGIS builds your compliance program from a short interview, drafts your policies and collects evidence from the systems you already run. After the audit it keeps watching, so SOC 2, ISO 27001, GDPR, DPDP and seven more frameworks stay current on one shared set of controls.
Every framework on every plan, priced by team size. You choose the accredited auditor who issues your report.
One shared control set: closing a control moves every framework it maps to.
- 01Get compliantA short interview becomes a full, framework-mapped program in an afternoon.
- 02Keep compliantEvidence keeps collecting and checks keep running long after the auditor leaves.
- 03Every framework, every planMost compliance platforms price per framework. Every AEGIS plan includes readiness for all 11.
- 04Your auditor, your choiceTier 1, 2 or 3, US-based or India-based. You pick the firm your buyer will accept.
Get compliant. Stay compliant.
The audit is a milestone, not the finish line.
Most teams scramble for one report and then watch the program decay until the next one. AEGIS does the setup work and then keeps the evidence current, so year two is a walkthrough instead of a rebuild.
Gets you compliant
From zero to audit-ready
- A security interview decides which controls and policies apply, with a reason for each.
- Your controls, policies, evidence backlog, risk register and vendor list are generated in an afternoon.
- AI drafts every policy in your real context; a person approves it.
- The auditor you choose gets a read-only room and a complete evidence package.
Keeps you compliant
Current every day after
- Connected systems keep collecting evidence from your cloud, code, identity and devices.
- Cloud tests keep re-running against the controls that depend on them.
- Access reviews, policy attestations and training come round on schedule, with owners.
- A control that drifts shows up long before next year’s audit, and a check that cannot run never counts as a pass.
Frameworks
Every framework, on every plan.
Most compliance platforms charge for each framework you add. On AEGIS, readiness for all 11 is included on every plan, Startup included. Controls are mapped once, so evidence collected for one framework counts for every framework it maps to.
- SOC 2Type I and Type II: the report most B2B buyers ask for first.SOC 2 guide →
- ISO 27001The international standard for an information security management system.ISO 27001 guide →
- ISO 27002The control guidance behind ISO 27001 Annex A.
- ISO 42001The management-system standard for AI governance.
- NIST CSFA common language for security risk.
- NIST AI RMFThe framework for managing AI risk.
- EU AI ActObligations for providers and deployers of AI systems.
- GDPRData protection for EU and UK personal data.
- DPDP ActIndia's Digital Personal Data Protection Act and Rules.DPDP Act guide →
- HIPAARules for teams handling protected health information.
- PCI DSSThe standard for teams that touch cardholder data.
How it works
From a short interview to a program your auditor can read.
Answer the security assessment
Ten sections of questions decide which control families and policies apply to you, with a reason for each decision, and record where you stand today.
Get a program in an afternoon
AEGIS generates your controls, policies, evidence backlog, risk register and vendor list, scoped and mapped to your frameworks.
Connect your stack
Evidence collects from your cloud, code, identity and devices, and cloud tests check your posture against the controls that depend on it.
Walk into the audit
Your auditor gets a read-only room and a complete evidence package. Audit-ready then depends on how fast your owners close the real gaps.
Auditors
Your auditor, your choice.
The right auditor depends on who is buying from you and what you want to spend. Pick the tier and the country that fit, and we help you choose the firm. AEGIS gets you ready; the accredited firm you pick issues the SOC 2 report or ISO certificate.
Large, widely known firms
For enterprise buyers who name the audit firm they expect to see on the report.
Established mid-size firms
Deep SOC 2 and ISO practices with a balance of recognition and cost.
Specialist boutique firms
Often the most affordable route to a first report your buyers will accept.
- Based in
- United States
- India
GRC platform
Everything a GRC program needs, in one place.
Every module shares the same controls, evidence and audit trail, so nothing gets re-documented for the next framework.
AI-drafted policies
Written around your real cloud, data types and workforce, approved by a person, versioned and signed by employees.
Evidence and tasks
A backlog of proof with owners and cadence, recurring reviews, and optional approval before anything counts.
Risk register
Inherent and residual scoring, a heat map, and AI that maps each risk to the controls that reduce it.
Vendor risk management
A vendor register with a scored, AI-generated risk assessment for each supplier.
Security questionnaires
Upload a customer questionnaire and AEGIS drafts answers from your policies, turning a two-day task into a review.
Trust center
A hosted trust page where you choose what is public and keep sensitive documents behind access requests and NDAs.
Training and attestations
Security training with graded, dated evidence of who completed it.
Access reviews
Regular reviews across your apps, with every approval kept as evidence.
Devices and Shadow AI
A lightweight agent evidences laptop controls and lists the software your team runs, including the AI tools most programs never see.
Honest by default
A green dashboard you can trust.
- AI drafts, people decidePolicies, risk mappings and questionnaire answers are reviewed and approved by an owner before they count or leave the building.
- Not determined is never a passA check that cannot run or cannot reach an answer says so. You never see a green program built on checks that did not succeed.
- Controls need real evidenceAEGIS never marks a control as met on its own. A control with no evidence stays in progress.
Integrations
Connects to the stack you already run.
Connect a system once and its checks keep evidence current against the controls that depend on it.
- Google Workspace
- JumpCloud
- AWS
- Google Cloud
- Microsoft Azure
- GitHub
- Rippling
- Aikido
- PostHog
- Device agent
- Claude and Cursor over MCP
Works with Nexus Void
Security work that turns into compliance evidence.
ARGUS
Code security as evidence
ARGUS findings become risks and evidence in AEGIS, and a Secure Code check fails while a critical finding is open. Your framework scores flow back to ARGUS.
Explore ARGUSVAPT
Pentests that file themselves
Pentest findings flow into AEGIS, any finding can become a risk, and the report files as penetration-test evidence for SOC 2, ISO 27001 and PCI DSS.
Explore VAPTPricing
Priced by the size of your team.
No per-framework fees. Every plan includes readiness for all 11 frameworks, and the price follows your headcount. Book a short call and we send you a straight quote.
Questions
What teams ask before they start.
What is GRC software?
GRC (governance, risk and compliance) software runs your security program in one place: the controls, policies, evidence, risks, vendors and audits that frameworks like SOC 2 and ISO 27001 ask for. AEGIS is GRC software that builds that program for you and keeps it current.
Do we pay per framework?
No. Most compliance platforms price per framework. Every AEGIS plan, Startup included, gets readiness for all 11 frameworks we support. You pay by team size.
Can we choose our own auditor?
Yes. You pick the auditor or certification body that fits your buyer and budget: tier 1, 2 or 3, US-based or India-based. We help you choose, and the auditor you pick gets a read-only room in AEGIS.
What happens after the audit?
AEGIS keeps you compliant. Connected systems keep collecting evidence, cloud tests keep running, reviews come round on schedule with owners, and a control that drifts shows up long before next year's audit.
Does AEGIS get us certified?
AEGIS gets you audit-ready and gives your auditor a clean, read-only room to work in. An accredited auditor still issues the SOC 2 report or ISO certificate.
How fast can we stand up a program?
The interview produces a real, framework-mapped program in an afternoon. Audit-ready then depends on how quickly you assign owners, connect systems and close genuine gaps.
Which frameworks does AEGIS support?
SOC 2, ISO 27001, ISO 27002, ISO 42001, NIST CSF, NIST AI RMF, the EU AI Act, GDPR, India's DPDP Act, HIPAA and PCI DSS, all on one shared control model.
Do we have to do each framework separately?
No. One control can satisfy requirements across many frameworks, so a second framework is mostly the difference over the first.
Are the AI-written policies usable?
They are strong first drafts written in your real context. A person reviews, edits and approves each one before it is published.
Can AEGIS mark a control as met on its own?
No. A control with no evidence stays in progress, and a check that cannot run reports not determined rather than pass.
What does the device agent see?
Endpoint compliance signals and a software inventory, including Shadow AI tools. It is an evidence source for device controls, not a surveillance tool.
Is Nexus Void itself SOC 2 certified?
Not yet. We are early on our own journey and would rather say so. We can walk your security team through our architecture and controls today.
Get compliant, stay compliant
Tell us which framework your buyer asked for.
We will show you what gets automated, which auditors fit, and the path to audit-ready.