Archer-Type GRC Platform

Overview

Architected and built a multi-tenant GRC platform for Rislix comparable in scope to enterprise tools like RSA Archer — a Vite + React (TypeScript) frontend with shadcn/ui, backed by an AdonisJS v6 (TypeScript) API over MySQL via the Lucid ORM. The platform supports multiple isolated tenant organizations under a 14-role RBAC model, with JWT authentication and an OTP-based password reset flow (6-digit code, 5-minute expiry, delivered by email). At its core is a full compliance framework library — ISO 27001 (41 clauses, 93 Annex A controls) and PCI DSS (200+ controls across all 12 requirements, presented in a two-level collapsible sidebar hierarchy) — with per-clause and per-control evidence upload, and an approve/reject review workflow driving each framework's live completion percentage. The risk register uses a 6-tab layout (People, Process, Technology, AI Risks, Opportunities, Legends) with 1–3 severity scoring and a risk heat map, alongside a dedicated Asset Inventory module that auto-calculates a C×I×A asset score per item and supports bulk creation via Excel template upload with per-row validation. Rounding out the platform: gap assessments, policy management, audit tracking, a task tracker, Excel/CSV reporting, and a full activity-log audit trail. The contact/notification email service was ported directly from the Rislix marketing site's Microsoft Graph API integration, and the app deploys to AWS EC2 behind Nginx (reverse-proxied at rislix.com/trax) under PM2.

Highlights

• check_circleMulti-tenant architecture with 14-role RBAC, JWT auth, and OTP-based (6-digit, 5-minute expiry) password reset.
• check_circleFull compliance framework library — ISO 27001 (41 clauses / 93 controls) and PCI DSS (200+ controls across 12 requirements) — with per-control evidence upload and an approve/reject review workflow driving live completion percentages.
• check_circle6-category risk register with severity scoring and a heat map, plus an Asset Inventory module with auto-calculated C×I×A scoring and bulk Excel upload.