Know which controls are defensible now.
See evidence freshness, residual risk and decision state without launching another evidence chase.
Provided and written by cleared Australian nationals.
Close the evidence gap.
GRiCk lets AI agents, developers and security tools send assurance evidence from where work already happens. MCP supplies the context. Scoped APIs keep control health current, without waiting for screenshots and email.
Available direct, through a trusted MSP, or through Microsoft Azure and AWS hosted marketplace routes.
- Agent context
- MCP
- Evidence ingress
- Scoped API
- Assurance state
- Freshness tracked
Assurance dashboard Live posture
Australian sovereign delivery
Australian ownership your procurement team can verify.
GRiCk is provided and written by cleared Australian nationals.
Built by Yuma IT, a Supply Nation certified business.
For teams that cannot work from stale evidence.
Executives, assurance teams and engineers work from one record. Each role sees the evidence provenance, freshness and control state it needs.
Keep the ATO record moving.
Connect intake, system scope, evidence, assessment notes, approvals and reassessment dates.
Submit proof from the delivery path.
Use MCP for assurance context and scoped APIs for evidence, without leaving engineering tools.
Buy through the partner or cloud route procurement already uses.
Buy GRiCk direct, operate it with an approved MSP, or use a Microsoft Azure or AWS hosted marketplace route. Each option keeps the control boundary explicit.
Give the MSP scoped access, not an open tenant.
Bound partner access with organisation and workspace roles, scoped API keys, MCP context and an audit trail. MSP tooling can send evidence from existing CI/CD, SIEM, SOC and cloud workflows.
Procure through Microsoft and deploy into Azure.
Microsoft commercial marketplace fulfilment, Bicep and ARM packaging, Container Apps, Azure Blob Storage and Azure OpenAI integration support an Azure-aligned operating boundary.
Run an AWS-aligned offering in your AWS estate.
Container deployment, Amazon S3 evidence storage, Amazon Bedrock integration and Australian-region configuration support an AWS-aligned hosted offering.
Marketplace availability, private-offer structure, hosting responsibility and support model are confirmed during the technical review.
Evidence moves with the assessment.
API-delivered evidence joins intake, assessment scope, requests, assessor notes, follow-ups and approvals. It stays linked to the system, control and risk context supplied through MCP.
01 Structured intake
System context enters once and follows the package.
02 Evidence requests
Required artefacts stay attached to the assessment record.
03 Assessor record
Notes, findings and follow-ups retain ownership and provenance.
ATO detail and evidence package Tenant scoped
Automation prepares the case. People make the decision.
GRiCk can assist with evidence handling and operational signals without obscuring accountability. Assessors and authorising officers review the package, record conditions, sign and timestamp the outcome.
- Package readiness visible before approval
- Residual risk and security category in context
- Named approver, typed signature and reassessment date
- Conditions retained with the authorisation record
Run GRiCk inside your operating boundary.
Deploy GRiCk into infrastructure you control. Keep your established identity, storage and cloud patterns. Connect advisory AI through your chosen provider while people retain the decision.
RuntimeCompose, Kubernetes and Helm
InfrastructureTerraform, Bicep and ARM
ImagesMulti-architecture images in GHCR
Supply chainSBOM and build provenance
IdentitySAML/OIDC SSO and SCIM
AI providersBedrock and Azure OpenAI
AI inside the assurance boundary.
MCP
Agents discover the relevant tenant-scoped records and work with current assurance context.
API
Evidence writes require scoped credentials, are idempotent where needed and are recorded in the audit trail.
Models
Use Amazon Bedrock or Azure OpenAI for advisory work. Assessors and authorising officers retain the decision.
Batteries included means the control plane is already there.
Identity, tenancy, audit, integration and deployment ship with the platform. They do not wait behind a professional-services engagement.
Control plane Included capability Operating property
Sovereign delivery Provided and written by cleared Australian nationals Australian delivery boundary
Partner delivery Trusted MSP access through scoped roles, API keys and integrations Tenant-bounded and audit logged
Procurement Direct, partner-led, Azure and AWS hosted marketplace offerings Commercial route matched to the engagement
Identity SAML/OIDC SSO and SCIM provisioning Organisation-scoped configuration and audit
Access control Role and workspace permissions Tenant-scoped enforcement
Auditability Linked actions, evidence and decisions Recorded actor, time and provenance
Integration Scoped API keys, OpenAPI, SDK, MCP and webhooks CI/CD, SIEM and SOC event paths
Deployment Docker Compose, Kubernetes and Helm Self-hosted runtime
Infrastructure Terraform, Bicep and ARM Repeatable environment delivery
Supply chain Multi-architecture images and SBOM Build provenance
AI boundary Amazon Bedrock and Azure OpenAI Advisory output with human decisions retained
Procurement and architecture teams can review deployment boundaries, identity integration, API scope and supply-chain artefacts before committing to a rollout.
Trace your evidence path before you buy.
Bring your assurance model, developer workflow, identity constraints and hosting boundary. We will trace evidence from an agent or pipeline through the API, into control health and the ATO decision record.