Platform
A single workspace for the whole compliance programme
NOVA connects frameworks, controls, evidence, policies, risks, assets and reporting so the readiness position is always traceable to the underlying records.
How the platform is organised
The platform is organised around four layers that keep records together, reuse evidence, and expose only what each audience should see.
Frameworks
- SOC 2
- ISO 27001
- Essential Eight
- ISO 42001
Controls
- Mapped expectations
- Owners
- Test cadence
Evidence
- Uploads
- Connectors
- Reviewer validation
Assurance
- Readiness reporting
- Trust Centre
- Auditor Portal
Principles
What the architecture is designed to protect
These principles guide every design decision in the platform.
Governed record
Every control, evidence item, policy version, risk and asset lives in the same workspace with ownership and history.
Reusable evidence
One artefact can support multiple frameworks when it genuinely satisfies the underlying control.
Human decisions
NOVA supports the readiness decision. Final launch and risk decisions remain human decisions.
Architecture
Four layers, one coherent record
Workspace and tenant boundary
Each organisation operates in its own tenant. Evidence, controls, policies and reporting are scoped to that tenant.
Framework layer
Activated frameworks publish their requirements. Requirements map onto controls, not onto evidence directly.
Control and evidence layer
Controls describe operating expectations. Evidence demonstrates implementation and is validated by a reviewer.
Assurance layer
Readiness reports, Trust Centre publication and Auditor Portal access all draw from the same governed records.
NOVA assists with readiness and evidence management. Certification, attestation and regulatory conclusions remain with authorised independent, regulatory or customer-appointed parties.
Capabilities
The capabilities that make the layers work
Each feature area is described in detail on its own page, including availability, operating workflow and what the human team remains responsible for.
Framework management
Activate the frameworks your organisation works towards, record scope, and map requirements once instead of maintaining parallel programmes.
Read moreControls and control testing
Define what each control is expected to do, who owns it, how often it is tested, and whether the last test passed.
Read moreEvidence management
Collect evidence into governed storage, map it to the controls it supports, and have a person validate it before it counts.
Read morePolicy management
Govern policy intent with versioning, approval routing and scheduled review, so the published policy is the approved one.
Read moreRisk management
Record risks with owners, assess them consistently, assign treatment, and capture acceptance as an explicit decision.
Read moreAsset governance
Maintain the register of systems, services and data stores your controls depend on, and relate them to risks and evidence.
Read moreReporting
Readiness and coverage reporting derived from live control and evidence records, not from a separately maintained status sheet.
Read moreTrust Centre
Publish approved assurance information to customers and prospects without exposing the underlying confidential evidence.
Read moreAuditor Portal
Give auditors and assessors scoped access to the evidence for an engagement, with requests and findings tracked in one workflow.
Read moreNOVA AI Assistant
Assistance grounded in your governed workspace content: interpretation, drafting and gap identification, always for human approval.
Read moreEvidence lifecycle
From collection to reviewed assurance
Evidence is collected with context, mapped to controls, reviewed by a person and kept current. Only then does it feed readiness reporting.
- Upload or connect evidence with structured metadata
- Map one artefact to every control it legitimately supports
- Reviewer validates it against the control expectation
- Freshness expectations surface ageing items before assessment
- Readiness reports are derived from the reviewed record
Where evidence is used
Pricing
Plans that scale with the programme
Start free to evaluate the workflow, then move to the plan that matches your frameworks, evidence and assurance requirements. Full feature comparison is on the pricing page.
Free
Evaluate the workflow with a single framework and a small control set.
Free
- One activated framework
- Core control library
- Manual evidence upload
- Single administrator
Launch
A first certification or attestation programme run properly from the start.
$99 AUD / month
$82 AUD / month billed annually
- One activated framework
- Control ownership and review cadence
- Evidence mapping and reviewer validation
- Policy versioning and approval
Growth
Most popularMultiple frameworks on one shared control set, with reuse across requirements.
$249 AUD / month
$207 AUD / month billed annually
- Multiple activated frameworks
- Cross-framework control and evidence reuse
- Risk register with treatment and acceptance
- GitHub evidence connector
Professional
Assurance-grade operation with external review workflows included.
$499 AUD / month
$416 AUD / month billed annually
- Everything in Growth
- Auditor Portal with scoped engagement access
- Trust Centre publication
- Asset register and classification
Business
Broader scope, more users and deeper governance across business units.
$799 AUD / month
$665 AUD / month billed annually
- Everything in Professional
- Extended user and role capacity
- Multiple scopes within one tenant
- AI assistance across policies, evidence and gap identification
Enterprise
Quoted per organisation against scope, users and assurance requirements.
Quote only
- Everything in Business
- Scope defined per organisation
- Commercial terms agreed with Eredox
- Structured onboarding programme
Indicative amounts shown for planning purposes. All published prices require Eredox approval before they are contractually binding.
Talk to us
Discuss NOVA for your organisation
Tell us about your frameworks, team and assurance timeline and we will help you work out where to start. You can also book a demo or start free directly.
NOVA supports the readiness decision. Final launch and risk decisions remain human decisions.
Contact us
We respond within two business days.
See NOVA against your own compliance obligations
Start free to explore the workflow, or walk through your framework, evidence and reporting requirements with us.
NOVA supports the readiness decision. Final launch and risk decisions remain human decisions.