Prove your IT is under control — without enterprise GRC.

No. CertPilot produces operational evidence — dated, plain-English records of what was checked, what was tracked, and what was reviewed. That evidence is useful in audit conversations, governance reviews, and cyber-insurance questionnaires, but CertPilot does not certify NIS2, ISO 27001, SOC 2, GDPR, or any other regime, and nothing it produces is legal advice or a legal guarantee.

No — deliberately. Enterprise GRC platforms manage control frameworks, policy libraries, and audit workflows for large compliance teams, and typically take months to implement. CertPilot covers the recurring evidence layer underneath: are the domains healthy, are renewals owned, who has access to what, what assets exist, who holds which accounts — and can you prove all of it with a dated PDF. It is built to be useful in the first afternoon, not after an implementation project.

No. The People & Accounts and Assets registers hold records your own team enters or imports — names, roles, account identifiers, asset assignments. CertPilot never tracks activity, scores productivity, scans email bodies, documents, or chat messages, and never inspects AI prompts or responses. Nothing is installed on anyone's machine. It is governance evidence, not surveillance.

Six report types, generated on demand inside the product: Domain Health (SSL, DNS, domain expiry, and changes), Renewal Risk (overdue, upcoming, and incomplete renewals), Monthly Proof (the combined monthly summary for clients or management), Weekly Governance (a weekly-format operational review), the Access Review Register (quarterly access governance evidence grouped by system), and the Governance Evidence Pack (a cross-module executive summary). All six have public demo samples on the sample reports page, built with fictional data so you can see the exact format before signing up.

No. CertPilot has no Google Workspace or Microsoft 365 integration and does not need one. Checks run against public data; registers are maintained by your team with CSV import and export. Read-only connectors may be considered later — planned, not yet available — but nothing on the platform requires them today.

Yes — manual-first is the design, not a stopgap. Paste or CSV-import your domains, import your renewal spreadsheet into the Renewals & Vendor Register, your people and account records into People & Accounts, your hardware and software lists into the Assets Register, and your existing access-review spreadsheet into Access Reviews. Everything exports back out as CSV, so your records stay portable.

A spreadsheet works while everything fits in one person's head and nobody asks for proof. Once renewals span inboxes, people and assets span tabs, and a quarterly access review needs chasing, the spreadsheet falls behind — and it produces no evidence trail. CertPilot keeps the same records in structured registers with owners, due dates, statuses, and review states, adds daily automated checks a spreadsheet can never run, and turns both into dated PDF reports. Your data stays portable: CSV in, CSV out.

Certificate and domain monitors alert on certificates and domains — and stop there. CertPilot includes that monitoring (SSL, DNS, RDAP, email authentication) but treats it as one module of six: renewals, people and accounts, assets, and access reviews live alongside it, and everything feeds the evidence reports. CertPilot deliberately does not monitor uptime — if you need availability checks, an uptime monitor is the right tool for that job.

Two kinds. First, public check results: TLS certificate data, DNS records, and RDAP registration data — the same public data any browser can see, collected with no credentials, registrar access, or API keys. Second, register records your team enters or imports: renewals, vendors, people, accounts, hardware, software, and access review entries. Register data stays in your workspace and exports back out as CSV. CertPilot stores no email content, no documents, and no full product keys.

By workspace size and evidence volume, not headcount. Starter fits one lean team or a small operator getting the first evidence trail in place. Professional fits MSPs, agencies, and growing IT teams that group evidence per client and want reports with their own branding. Portfolio adds headroom for high-volume workspaces. Pricing is flat per workspace — the limits enforced today are monitored-domain capacity per plan and report branding availability — and every plan starts with a 14-day free trial.