# Railbase for GRC

> Risk, compliance, audit and controls as one governed suite of independent products.

_Updated: 2026-08-16_

## One assurance chain

GRC Suite connects risks, obligations, evidence, findings, remediation and assurance
without merging those domains into a single opaque plugin. Risk, Compliance and
Audit remain useful and purchasable independently; they collaborate through declared
Railbase events and retain their own permissions, data ownership and lifecycle.

- **Basic:** Risk and Compliance.
- **Pro:** Basic plus Audit.
- **Max:** Pro plus Controls/SOX after the Controls plugin passes its release gates.

Max is intentionally not sold while Controls is still planned. The suite page says
Planned instead of collecting payment for unavailable capability.

This composition lets a team begin with continuous compliance or an audit workbench,
then add the rest without replacing the installed products or moving data to a new
service.

---

[Compare GRC Suite plans](../suites/grc-suite) or [browse individual plugins](../plugins).