Don’t trust us. Check.Try to break a sealed record
Coriqo
Evidence Connect

Your teams keep working in Jira, GitHub and SharePoint. Their work becomes sealed evidence, every day.

Nobody re-keys tickets into a governance tool or chases screenshots the week before an exam. A named person on your team approves how each field maps. Coriqo then collects the records from the systems your teams already use. Every record becomes sealed evidence that an examiner can verify.

Connect a system Book a demo Request a GRC connector
Connect today Jira GitHub SharePoint ServiceNow: coming soon GRC platforms: request early access
0source-system passwords or access tokens in Coriqo's application database
1approved, versioned mapping per stream. Nothing syncs before a person signs it off.
Never editedA changed source record becomes a new sealed record. The old one stays as collected.
KeptEvidence stays, read-only, if you disconnect a source or downgrade your plan.
GRC platforms

Already run Archer, OpenPages or AuditBoard? Keep it. Coriqo seals what it says.

A GRC platform already holds structured controls, issues and obligations, so its records map onto Coriqo's findings and evidence almost field for field. Coriqo doesn't replace the platform. It keeps a sealed, independent copy of what the platform says. An examiner can verify that copy without trusting either system.

Ten platforms, in the order we're evaluating them

Order follows how many banks run each one
ServiceNow GRC / IRMGRC / IRMEvaluating first
RSA ArcherGRC / IRMEvaluating first
IBM OpenPagesGRC / IRMEvaluating first
MetricStreamGRC / IRMEvaluating first
OneTrustPrivacy / third-party riskEvaluating first
AuditBoardAudit / SOXEvaluating first
DiligentBoard / governanceEvaluating first
WorkivaReporting / controlsPlanned
LogicGateGRC / IRMPlanned
SAI360GRC / IRMPlanned

None of these can be connected yet. Some vendors limit API access to certain licence tiers, so each platform gets an access check before we commit to a date. If you run one of them, tell us below. Requests decide the order.

Which systems would you connect?

Need one sooner? On Enterprise and customer-hosted plans, we build a custom connector for a one-off fee. Talk to us.

How it works

From a ticket in Jira to a record an examiner can check.

Five steps. The connector reads, a person decides the mapping, and fixed rules do the rest. No AI model decides what counts as evidence.

  1. Connect

    Enter credentials once. They go to the connector runtime, and Coriqo keeps only reference IDs.

  2. Pick streams

    Choose which streams to read, such as Jira issues. Coriqo reads nothing you didn't pick.

  3. Approve the mapping

    Start from a ready-made template, review each field, and approve. The approval is named and timestamped.

  4. Sync

    Run it by hand, or daily on Pro and above. Every run reports what it read, sealed and skipped.

  5. Review

    Records land in the same evidence log as the rest of Coriqo. Changes to watched fields raise findings.

How a record becomes evidence

One status change, start to finish.

A status field changes in a tool your team already runs. Coriqo applies the mapping a person already approved. The result is a sealed record and, where the change matters, a finding.

MRM-114 · Model validation review
Status: In Progress → Done
Frame 1
The source system changes

A Jira issue's status moves. Your team makes this update anyway; nobody does anything extra for Coriqo.

Mapping v3 · status → risk_level
Approved by J. Okafor · Sep 12
Frame 2
The approved mapping applies

Coriqo applies the field mapping a person reviewed and approved, with its version and approver attached.

Evidence sealed · sha256:8f2a…
Finding: status changed to Done
Frame 3
Evidence, sealed

The record joins the sealed evidence log. The status change also raises a finding, in the same findings workflow every other control uses.

These frames are labelled mockups with sample data, not screenshots.

Mapping review

What you approve, what we never decide.

Coriqo proposes a field mapping. A named person reviews it, and the version they approved is the one that runs. A changed mapping needs a new approval. When a second-line reviewer asks who decided that Jira's priority means risk level, the answer is on the record.

StreamJira · issues
TargetFinding / status
Anchored toCredit-scoring model · v4.2
Versionv3 (replaces v2)
Approved byJ. Okafor · Sep 12
StatusApproved
Where AI helps, and where it stops

A model can suggest a field pair. It can't make a call.

Jira, GitHub and SharePoint come with ready-made mapping templates, so you don't pay an AI model to work out what Jira's "summary" field means. For other streams, Coriqo can suggest mappings on Pro and above.

What the model does

  • Proposes source-field to target-field pairs, each with a confidence score
  • Records its model name and prompt version on the draft mapping
  • Runs only for streams that have no ready-made template
  • On Air-gapped, runs on your own model

What the model never does

  • Decide whether a record counts as evidence
  • Set a finding's status or severity
  • Approve its own suggestion
  • Change a mapping that is already approved
Change detection

A change is new evidence, not an edit.

If someone changes a ticket after the fact, the version Coriqo first collected stays on the record next to the new one. Each sync compares a fingerprint (a hash) of every source record with the last one Coriqo sealed. If the record changed, Coriqo seals a new version and leaves the old one exactly as it was collected. If one of the fields your mapping watches changed, a finding opens with both versions linked.

MRM-114 · collected Sep 3
status: In Progresssha256:41c0…
MRM-114 · collected Sep 12
status: Donesha256:8f2a…
Finding · observation
watched field: statuslinks both records

Illustrative sample data.

Sync runs

Every run accounts for every row.

Rows don't disappear silently. Each sync run keeps five counters. When your second line asks whether anything went missing, you can compare what the source sent with what Coriqo sealed.

records_read

Rows the connector delivered for the streams you picked.

records_materialised

Rows sealed as evidence or raised as findings.

records_skipped_filter

Rows your mapping's filter excluded. Counted, never sealed.

records_changed

Rows whose content changed since the last sealed version.

findings_created

Findings opened because a watched field changed.

Freshness

Show when evidence was collected, not when the PDF was exported.

Every connector record carries the time it was pulled from the source, sealed with the record. A binder can only tell an examiner when it was assembled. We are still building a freshness line for the examiner package, such as the share of evidence collected in the last seven days.

Connectors

What you can connect, and what's next.

We don't boast about connector counts. What matters is whether a system's records turn into evidence you can defend, so every system is listed here with its real status. GRC platforms are listed above.

Available now, with ready-made mapping templates

Free plan: one source
JiraIssue tracking · AtlassianAvailable
GitHubSource controlAvailable
SharePointDocument management · MicrosoftAvailable
ServiceNowIT service managementComing soon

Next in the catalogue

No ready-made template yet
GitLabSource controlNext
ConfluenceKnowledge baseNext
Microsoft 365Productivity suiteNext
SalesforceCRMNext
SnowflakeData warehouseNext
DatabricksData lakehouseNext
PostgreSQLDatabaseNext
Azure Blob StorageObject storageNext
Security

Where your credentials live, and where they don't.

The short version. Full detail is on the trust page and in the security questionnaire.

Credentials

Source-system credentials live in the connector runtime, never in Coriqo's application database.

Raw records

Raw records land in a separate store set aside for your account, read-only to the application.

Retention

Raw records are kept for your plan's window: 30 days on Free, 90 on Pro, configurable on Institution. Sealed evidence is kept separately and isn't removed when raw records expire.

Audit trail

Every connect, mapping approval, sync and disconnect is written to the audit log with who did it.

Disconnect and downgrade

Disconnecting stops future syncs. Downgrading pauses them. In both cases, evidence already collected stays and becomes read-only.

Data plane

A customer-hosted data plane is on the Institution roadmap. Ask us for its current status.

Pricing

You pay for scale. Every plan can connect.

Free connects one source and seals your first records today. Higher plans raise how much Coriqo collects. You don't need one to try it.

 FreeProInstitutionAir-gapped
Sources15UnlimitedUnlimited
Streams per source1, template streams onlyAllAllAll
ScheduleManualManual + dailyManual + dailyManual + daily
Records500 lifetime25,000 / month, then creditsUnlimitedUnlimited
Raw retention30 days90 daysConfigurable, up to 7 yearsConfigurable, up to 7 years
AI mapping suggestions—Credits per suggestionCreditsYour own model
Change → findingYesYesYesYes
Custom connector on request——Yes, one-off feeYes, one-off fee
Customer-hosted data plane——On roadmapOn roadmap

Credits are charged for results only: AI mapping suggestions, and records above your plan's allowance. Rows read and sync jobs are never billed. Evidence stays read-only if you downgrade. Full comparison on the pricing page.

Questions

Before you connect a system.

Which systems can I connect today?

Jira, GitHub and SharePoint, each with a ready-made mapping template. ServiceNow appears in the catalogue as coming soon and can't be connected yet. The GRC platforms listed above are on the roadmap. Ask for a system that isn't listed. Requests set the order.

Does this replace our GRC platform?

No. Your GRC platform keeps running your program. Coriqo keeps a sealed, independent record of what the platform and your other systems showed, and when. An examiner can verify that record without having to trust either system.

What does Coriqo collect, and what doesn't it?

Only the streams you pick, and within them the fields your approved mapping names, such as issue status, pull-request state and document metadata. This version doesn't collect message bodies or file attachments.

How does field mapping work?

Template connectors start from a ready-made mapping. On Pro and above, Coriqo can suggest mappings for other streams. Either way, a named person reviews and approves the mapping before anything syncs, and every change creates a new version.

Which model does a record belong to?

Each mapping is tied to one model version when it's approved, with an optional filter such as "project equals MRM". Rows that fail the filter are counted and skipped. Routing individual rows to different models isn't supported yet.

What if a source record changes after it's sealed?

Coriqo seals the new version as a separate record. The earlier record is never edited. If the change touched a field your mapping watches, a finding opens with both versions linked.

What happens if I disconnect a source or downgrade?

Syncing stops, or drops to your new plan's limits. Evidence already collected stays in place, read-only, with its source and mapping version intact. Nothing sealed is deleted to fit a smaller plan.

How often does it sync?

Manually on every plan, and daily on Pro and above. Hourly schedules and webhook triggers aren't available yet.

Can you build a connector for a system you don't list?

On Institution and Air-gapped, yes, for a one-off fee. On other plans, request it and we'll let you know where it sits on the roadmap.

How does this fit ongoing monitoring under SR 26-2?

SR 26-2 calls for ongoing monitoring and evidence of control operation, not a point-in-time review. Collecting continuously from the systems that produce that evidence helps show that monitoring happened when it happened. You don't have to rebuild it before an exam.

Connect one system on the free plan and seal your first records.

Or walk through the whole flow with us on a call.

Connect a system Book a demo