What does the Compliance module cover?

Requires Pro

Quick answer

The Compliance module bundles two building blocks: Policies and Risks (risk assessments). With policies, you document requirements and controls from a framework — Notory supports ISO 27001, BSI C5, and a free-form Custom framework. With risks, you assess individual assets by likelihood and impact and record countermeasures. You’ll find both under Compliance in the left-hand navigation.

Prerequisites

Required role Read: any signed-in user · Create/edit: Administrator or Manager

— any signed-in user may view policies and risks. The Administrator or Manager role is required to create and edit them, and Administrator to delete them. Programmatically, the API token needs valid access to the tenant.

The Compliance module is a Pro feature. In the Basic and Community tiers, it is locked; calls are then rejected with HTTP 403 and a note about the required upgrade. An administrator can additionally enable the module under Show/hide categories.

Overview

GUI (web interface)

1. Open the “Compliance” module. Select Compliance in the left-hand navigation. The page has two tabs: Policies and Risks.

   Screenshot pending compliance-uebersicht-01 Compliance module with the 'Policies' and 'Risks' tabs

   The Compliance module with the Policies and Risks tabs.

2. Choose a tab. Under Policies, you maintain requirements and controls per framework (ISO 27001, BSI C5, Custom). Under Risks, you assess assets.

You’ll find the actual step-by-step instructions in the linked guides under Related topics.

API (curl)

The module lives under the /api/v1/compliance prefix. A quick overview of your data: list all policies and all risks.

List policies

curl -H "Authorization: Bearer inv_dein_token" \
  https://demo.notory.io/api/v1/compliance/policies

List risks

curl -H "Authorization: Bearer inv_dein_token" \
  https://demo.notory.io/api/v1/compliance/risks

Both endpoints return a list sorted by title or creation date, respectively. If the module isn’t included in the tier, the API responds with 403 (Compliance module is not included in the '…' plan).

What happens behind the scenes?

• License gate (Pro): Every call to /api/v1/compliance/* checks the compliance feature. If it’s missing from the tenant’s tier, you get 403 instead of data.
• Tenant isolation: Policies and risks are strictly bound to your tenant (tenant_id). Other tenants never see them.
• Audit trail: When creating and editing, Notory records the creator and editor (created_by/updated_by) along with timestamps.
• Two separate objects: Policies and risks are independent. A risk references a specific asset via the asset ID; a policy stands on its own and carries a framework plus an optional reference ID (e.g. the control number).

Related topics

• Add and assess a policy
• Assess and treat a risk
• Keep track of compliance status
• Assets — Overview — risks are attached to assets
• API introduction — authentication, base URL, error codes