Central Hub unifies vulnerability management, application security, cloud posture, policy governance, and audit evidence — mapped automatically to the standards your business actually answers to, from SOC 2 and ISO 27001 to regional frameworks in the markets where you operate.
Central Hub adapts its control mapping and reporting to what actually applies to you — heavily regulated financial services, or a growing technology company proving trust to its first enterprise customer.
Core banking, digital payments, and treasury operations mapped to central-bank and payments-network security frameworks.
Policyholder data protection and cyber-security guidelines specific to the insurance sector, evidenced continuously.
PCI DSS technical controls and payments-network operating rules, kept current as your processing volume scales.
HIPAA-aligned safeguards for organisations handling protected health information, alongside general security baselines.
SOC 2 and ISO 27001 evidence collection built for engineering teams shipping fast, not slowing down for audits.
A common security baseline for any organisation that needs to prove its posture to customers, partners, or regulators.
Every module writes into the same evidence layer, so a finding in vulnerability scanning shows up automatically in the control it supports — no manual reconciliation before an audit.
Governance, risk, and control management across every framework you activate.
An auditable kill switch for AI systems under RBI's FREE-AI framework, plus model risk register, AIBOM (CycloneDX 1.6), and shadow-AI discovery.
Active network scanning plus authenticated, SSH-based checks against real installed software and configuration — not just a Nessus report viewer.
Crawler-driven active testing across your web applications and APIs.
Continuous configuration checks across your cloud accounts and services.
Advisory tracking and enrichment mapped to your actual technology footprint.
Version-controlled policy authoring, approval, and attestation workflows.
Data-protection checklists for the privacy regulations your customers care about.
A single, auditor-ready archive of every artifact your controls depend on.
Framework mappings are generated from your organisation's own compliance profile — not applied blindly. Frameworks without full control-catalogue coverage yet are shown honestly, not padded.
| Framework | Jurisdiction | Applies to | Coverage |
|---|---|---|---|
| SOC 2 | Global | Any SaaS or service organisation | Catalog in progress |
| ISO/IEC 27001:2022 | Global | General-purpose security baseline | 93 controls mapped |
| PCI DSS v4.0.1 | Global | Card payment handling | 41 controls mapped |
| GDPR | European Union | Processing EU personal data | Catalog in progress |
| HIPAA | United States | US healthcare / health data | Catalog in progress |
| RBI Cyber Security Framework | India | India-regulated financial institutions | 24 controls mapped |
| RBI Digital Payment Security | India | Digital payment providers | 12 controls mapped |
| NPCI Operating Circular | India | UPI / IMPS / RuPay / NACH / AePS | 14 controls mapped |
| IRDAI Cyber Security Guidelines | India | Insurance sector organisations | 15 controls mapped |
| DPDP 2025 | India | Processing India-based personal data | Handled via Data Governance |
| RBI FREE-AI / Model Risk Mgmt 2026 | India | Regulated entities deploying AI/ML systems | Catalog in progress |
Most compliance platforms only import someone else's scanner output. Central Hub's VAS module runs its own authenticated checks over SSH — installed package versions matched against a locally-synced CVE database, plus baseline hardening checks — on a schedule you control.
Under RBI's FREE-AI framework, regulated entities must be able to immediately halt an AI system that malfunctions, drifts, produces harmful output, or is compromised. Central Hub's AI Governance module implements that control end to end — not just a policy document.
Your instance, your data, isolated from every other customer by default.
Credentials used for authenticated scanning are encrypted, never exposed via the API, and audit-logged on every use.
Scheduled scanning and evidence collection, so your posture is current the day an auditor asks — not the day you last remembered to check.
Talk to us about your industry, your regulators, and where you operate — we'll show you exactly what Central Hub maps for your organisation.