ORCA Opti Core
Know where your business stands. At any time. Without the scramble.
Your risks, incidents, policies and controls. One system. Always current. Always yours.
Right now that information is scattered across drives, inboxes, spreadsheets and people's heads. Opti Core brings it into one structured, living system of record, inside your Safe Zone. Your data stays sovereign, in the region you choose, and is never used to train external AI models.
The system of record
The backbone everything else connects to.
Opti Core is the living system of record underneath your entire compliance operation. Everything connects to it. Everything writes back to it. Every change logged. Every relationship mapped. When the auditor asks, you'll be pointing, not scrambling.
Risks
Risks
Identified, rated, linked to controls
Controls
Controls
Mapped to frameworks automatically
Incidents
Incidents
Logged, tracked, connected to assets
Policies
Policies
Tied to teams and obligations
Assets
Assets
Systems, data and people, all visible
Suppliers
Suppliers
Dependencies captured in business impact assessments
Actions
Actions
Owned, due-dated, escalation-ready
Frameworks built in
The standards that matter for your industry. Already mapped.
You shouldn't have to build your compliance framework from scratch. Opti Core comes with the most important frameworks pre-mapped and ready to use.
Privacy (ISO/IEC 27701)
Privacy (ISO/IEC 27701)
Privacy impact assessments over your data processing activities, with risk level, sensitivity and approval recorded, and privacy controls managed against ISO/IEC 27701.
Incident management
Incident management
Incidents recorded with an owner, priority, and regulatory and contractual impact, so the record behind a notification is in one place.
AI system inventory
AI system inventory
Register your AI systems with risk classification aligned to the EU AI Act tiers (unacceptable, high, limited, minimal), and run AI impact assessments with an approval step.
Risk and business continuity
Risk and business continuity
A risk register with appetite and review dates, and business impact assessments that capture technology, personnel and supplier dependencies.
Internal audit and CAPA
Internal audit and CAPA
Plan audits, record findings and close them through corrective and preventive action, with the evidence attached.
ISO 27001 and ISO 42001
ISO 27001 and ISO 42001
Information security and AI management systems, pre-mapped to your controls, so one body of evidence serves both alignments.
Knowledge Packs
Months of work. Done in days. Or in minutes.
You know what the standard is: ISO 27001, SOC 2 and the frameworks your industry is held to. You just don't know how to get there without hiring a consultant and spending months building from scratch. Each Knowledge Pack is a pre-built compliance program structured for a specific standard and ready to install into Core.
- Policies and procedures written for your framework
- Controls already mapped to the standard
- Assessment questions structured around your obligations
- Evidence guidance so your team knows what to collect
Automation
Your processes run whether you're watching or not.
The things that fall through the cracks aren't the big things, they're the follow-up that didn't happen, the review nobody scheduled, the vendor assessment sitting in an inbox for three weeks.
Before
Incidents managed through email threads
With ORCA
Every step assigned, tracked, documented
Before
Risk reviews missed or done late
With ORCA
Owners notified, responses collected automatically
Before
Policies approved by whoever's available
With ORCA
Draft, review, approve, publish, without chasing
Before
Vendor onboarding inconsistent every time
With ORCA
Structured due diligence process, every time
Before
Access reviews nobody remembers to run
With ORCA
Reviews sent, responses collected, removals actioned
Live reporting
Generated from data that already exists. Not assembled the night before.
Real-time dashboards give leadership live visibility, and when a report is needed for the board, an auditor or a regulator, it's generated from the data already in Core.
How it all connects
From incident to board report
What happens when a ransomware incident is detected in an organisation running Opti Core? The entire lifecycle is managed in one platform. Complete audit trail. Nothing missed. Nothing manual.
- 1
An incident entity is created
Linked automatically to the affected asset, the relevant risk and the applicable controls.
- 2
Incident response workflow triggers
Tasks assigned to security, IT and management, with escalation timers running.
- 3
Opti Assist leads the response
Guiding the response, suggesting containment steps, drafting stakeholder communications.
- 4
Flagged against relevant controls
ISO 27001 and relevant control gaps highlighted automatically.
- 5
Status monitored and updated
An Agent monitors status and sends daily updates to the CISO until the incident is closed.
- 6
Full incident report generated
Timeline, impact assessment and lessons learned, ready for the board and any regulatory notification.
Privacy first. Always.
Documents you connect are referenced where they live, not uploaded or copied into ORCA. Your data is never used to train AI models. It's encrypted at rest and in transit. Access is controlled at the entity and field level, people only see what they're authorised to see. Data residency is enforced. Sovereign by design.
Works with what you already have.
ORCA Opti lives inside your secure Microsoft ecosystem. It integrates with your existing SharePoint, Teams, Defender, Sentinel, HR and operational systems, reducing duplication, improving accountability and keeping all data inside your sovereign tenant.
Opti Core Plans
The full AI-powered GRC platform, for organisations of every size.
Opti Core Starter
€299.95/per month
Core GRC for small teams getting compliance-ready.
- Everything in Opti Assist
- Risk Management
- Incident Tracking
- Action Items
- Real-time Dashboards
- 5 Navigators + 10 Standard Users
- 2M Monthly AI Credits
- Standard Support
Sign up to the ORCA Opti Portal with a Microsoft work or school account, or a Google Workspace account, to order this plan.
Opti Core Professional
€549.95/per month
Full GRC for small to medium organisations.
- Everything in Opti Core Starter
- Advanced AI Tooling
- Compliance Frameworks
- 10 Navigators + 20 Standard Users
- 4M Monthly AI Credits
- Priority Support
Sign up to the ORCA Opti Portal with a Microsoft work or school account, or a Google Workspace account, to order this plan.
Opti Core Enterprise
€1599.95/per month
Complete platform for large organisations.
- Everything in Opti Core Professional
- Advanced Analytics
- Logistics
- Custom Integrations
- 30 Navigators + 60 Standard Users
- 12M Monthly AI Credits
- Dedicated Support
Sign up to the ORCA Opti Portal with a Microsoft work or school account, or a Google Workspace account, to order this plan.
Clarity in minutes. Confidence ongoing.
Work through a guided check with Opti Assist and receive an immediate view of alignment, visibility and improvement areas now.
Join our mailing list
News and updates from ORCA Opti.