The only compliance platform with built-in AI assistant, automated cloud evidence collection, and continuous monitoring — deployable on your own infrastructure. 12 frameworks. Self-hosted or cloud.
✓ AI risk assessment • Cloud auto-discovery • Continuous monitoring • Self-hosted • From $199/mo
20 pre-built SOC 2 risks with L×I scoring, severity badges, bulk actions, CSV/JSON export, and remediation tracking.
Cross-framework controls mapped across all 12 frameworks. One control satisfies multiple standards simultaneously.
14 core templates + 7 CCPA/CPRA policies. Inline editor, digital signatures, signed document viewer, PDF export.
Live dashboard: collected vs missing. Screenshot uploads, document attachments, S3 storage. Per-org filtering.
CISO-ready summary with SVG donut charts, sparklines, risk scores, framework coverage. Click-through to source data.
Auto-generated roadmap with auto-assigned owners. Export to Jira, Azure DevOps, Asana, Monday, Trello, CSV, JSON.
Scope by business unit. Audit segments link orgs, assets, tools, and frameworks. Per-org dashboards and filtering.
Exception register with email-based approval. Submit, approve, reject with audit trail and expiry countdown.
Prowler, Wiz, Snyk, CrowdStrike, KnowBe4, Jira, Moodle, Cornerstone, and 60+ more. Auto-sync findings.
41 endpoints. JWT auth with auto-refresh. RBAC (4 roles). Rate limiting. SSO (Okta, Ping, ADFS). OpenAPI docs.
200+ translated strings: English, Chinese, Hindi, Spanish, French, Arabic, Bengali, Portuguese, Russian, Urdu.
Ctrl+K to search everything. Keyboard shortcuts for all tabs. Bulk actions. CSV/JSON/PDF export from any view.
A single-screen compliance posture overview. Every number is clickable — drill into any metric instantly.
20 pre-built SOC 2 risks with full detail panels. Expandable rows with remediation actions, evidence uploads, and assignee tracking.
25 shared controls mapped to 12 frameworks simultaneously. When you activate a control for SOC 2, it also satisfies NIST, ISO 27001, HIPAA, and others.
14 policy templates ready to customise. Each has an inline editor with auto-filling fields, digital signature canvas, and DocuSign workflow.
Real-time view of evidence collection progress across all controls and policies. See exactly what's collected and what's missing before audit day.
Generate a one-page compliance posture summary for your board, auditor, or executive sponsor. Print-ready with all the right data.
Full system administration from within the app. Manage users, track licenses, view activity, and monitor system health — all without leaving the browser.
Define the exact scope of each audit engagement by linking organisations, assets, tools, and frameworks into named segments. Each segment is a self-contained audit boundary.
Move data in and out of Citadel with the built-in import wizard and multi-format export system. No data lock-in — your compliance data is always portable.
One command. Four containers. PostgreSQL, Redis, FastAPI, and nginx — all wired together with automatic database migrations.
Production-grade Helm chart with configurable replicas, ingress, secrets management, and horizontal pod autoscaling.
Fully managed cloud instance. We handle infrastructure, backups, updates, and scaling. You focus on compliance.
Run docker compose up or use our cloud instance. Database migrations run automatically. Superadmin account created on first boot.
Create organisations, select frameworks, add your team. Import existing data via CSV/JSON wizard. 20 risks and 14 policies pre-loaded for SOC 2.
Work through the prioritised action list. Assign owners, upload evidence, sign policies. Export your project plan to Jira and hand your auditor a complete evidence package.
One-page compliance posture summary designed for CISOs, board presentations, and auditor handoffs. Every number is live — click any metric to drill into the source data.
Claude analyzes your org profile — industry, frameworks, size — and suggests risks ranked by likelihood and impact. One click to add to your register.
Connect your AWS account and Citadel auto-discovers EC2, RDS, S3, Lambda, ELB, and ECS resources. Assets populate automatically with classification and metadata.
Background scans run on schedule. When a control drifts or a new finding appears, Citadel generates an AI-explained alert with remediation steps and code.
Paste your policy text and Claude reviews it against framework requirements. Get a gap score, specific suggestions, and missing sections identified instantly.
Incoming security questionnaire? Claude auto-fills answers using your policies, controls, and compliance posture. Review, edit, approve — done in minutes, not days.
For every finding, Claude generates step-by-step remediation with Terraform, AWS CLI, and Python code snippets. Copy, paste, fix — no Googling required.
| Citadel | Vanta | Drata | Sprinto | Spreadsheets | |
|---|---|---|---|---|---|
| AI compliance assistant (Claude) | ✓ | ✗ | ✓ | ✓ | ✗ |
| AI risk assessment + remediation | ✓ | ✗ | ✓ | ✓ | ✗ |
| Cloud auto-evidence (AWS/Azure/GCP) | ✓ | ✓ | ✓ | ✓ | ✗ |
| Continuous monitoring + smart alerts | ✓ | ✓ | ✓ | ✓ | ✗ |
| Asset auto-discovery (cloud + CMDB) | ✓ | ✓ | ✓ | ✓ | ✗ |
| Self-hosted / Docker / Kubernetes | ✓ | ✗ | ✗ | ✗ | ✓ |
| Multi-framework (12+) | ✓ | ✓ | ✓ | ✓ | ✗ |
| No per-user pricing | ✓ | ✗ | ✗ | ✗ | ✓ |
| Multi-org + audit segments | ✓ | ✗ | ✓ | ✗ | ✗ |
| CISO boardroom executive reports | ✓ | ✓ | ✓ | ✓ | ✗ |
| Project plan export (Jira, ADO, Asana...) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Security questionnaire auto-fill (AI) | ✓ | ✗ | ✓ | ✗ | ✗ |
| CISO approval workflows + email | ✓ | ✗ | ✗ | ✗ | ✗ |
Citadel supports 12 frameworks: SOC 2 Type 1 & 2, NIST CSF 2.0, ISO 27001:2022, HIPAA, PCI-DSS v4.0, GDPR, CCPA, FedRAMP Moderate, CMMC 2.0, DORA, and CIS Controls v8. Controls are mapped across frameworks so activating one control can satisfy multiple standards simultaneously.
Yes. Citadel ships as a Docker container. Run docker-compose up -d and you have a production instance on your own infrastructure. Your data never leaves your environment. We also offer a cloud-hosted option if you prefer.
Citadel offers three tiers. Starter ($199.99/mo or $999/yr) covers 1 organisation, 1 framework, and up to 5 users. Professional ($499.99/mo or $5,799/yr) supports up to 3 organisations, 3 frameworks, and 25 users. Enterprise (custom pricing) is unlimited across organisations, frameworks, and users, with self-hosted deployment and SSO. All plans include the full REST API, command palette, and evidence tracking.
Most teams reach SOC 2 Type 1 readiness within 4-8 weeks using Citadel's pre-built risks, controls, and policy templates. The platform auto-generates a prioritised project plan that you can export directly to Jira or Azure DevOps for immediate sprint planning.
77+ integrations across security scanning (Prowler, Wiz, Snyk, Trivy), SIEM/EDR (CrowdStrike, Splunk, Datadog), IAM (Okta, Azure AD), project management (Jira, Azure DevOps, Asana, Monday.com, Trello), and LMS (KnowBe4, Moodle, Cornerstone, SAP Litmos, Docebo, Absorb). Findings auto-create risks and update control status.
Citadel can be fully self-hosted — your data stays on your infrastructure. For the cloud version, data syncs via encrypted GitHub Gist (private, scoped to your token). Microsoft 365 integration uses OAuth 2.0 PKCE flow with no stored credentials. We practice what we preach.
Get monthly insights on framework updates, audit tips, and compliance automation strategies. No spam.
See Citadel in action. Request a personalised demo with your frameworks, your org structure, your tools.