Proven, not performed
Map every control to the frameworks and laws you must satisfy, prove each one with evidence an auditor cannot dispute, and carry the same rigor into security, data, and sustainability.
Control · network segmentation
Attack-simulation technique T1190, fails closed, last proven 4h ago.
A checkbox says you are compliant. An attacker does not read your policies.
The claim
A policy exists
Most tools mark a control green because a document was uploaded and a box was ticked. The control was never tested against a real attack.
The proof
The attack just failed
A control passes because continuous validation proved the attack fails right now. The verdict flips the control's status with an audit-grade trail.
Compliance is only the beginning. Verdiq is built to cover four enterprise domains from one control-truth graph, so governance, security, data, and sustainability are proven together instead of bought as four disconnected tools.
One graph carries the framework mapping, the risk register, policy and audit, and privacy from RoPA to DSAR — so every risk points at the control behind it, and a trust center publishes what holds without a second spreadsheet.
Find what is exposed, then prove what holds — security validation stands co-equal with data, not behind it. Vulnerability scanning and threat intelligence surface real, active risk; attack-simulation pentests and AI red teaming keep your controls, and your AI systems, under continuous fire.
Discover, classify, and catalog the data your controls depend on, run privacy from consent to breach, and protect it with posture management, leak prevention, and encryption.
Carry ESG disclosure on the same evidence engine you already trust, then extend it to carbon-market compliance and the integrity of every credit you retire.
The governance core is what we build first. Security, data, and sustainability land in turn on a published roadmap, each on the same graph and proven with the same evidence. See when each domain arrives
Map · Prove · Quantify · Protect
Everything that proves your posture lives in one connected model we call the control-truth graph: your controls, the frameworks they satisfy, the evidence behind them, your risks, and your findings. Every capability reads and writes that same graph, so the platform grows in breadth without scattering into disconnected tools.
Map your controls to ISO 27001, SOC 2, NIST, and Southeast-Asian law, right down to the individual requirement. Prove a control once, and it counts for every framework that asks for it.
Bounded, consented attack-simulation runs against your in-scope assets. A confirmed finding flips the control's truth and recomputes your framework posture.
Finding → Control. The seam no checkbox tool spans: validation becomes control-truth, with the audit trail to back it.
A risk register where every risk is tied to the control or finding behind it, and carries a defensible range for what it could cost, with the uncertainty stated openly instead of hidden in a single number.
Records of processing, consent, data-subject requests, and breach clocks, with each jurisdiction's deadline counted from its own legal starting point instead of one flattened due date.
Global frameworks
These are the ones teams ask for first. Dozens more ship in the catalogue, and new frameworks are added every release.
Southeast Asia local law
Singapore, Vietnam, and Malaysia are the first three jurisdictions, counsel-gated; more Southeast-Asian jurisdictions follow on the roadmap.
If evidence can be quietly edited, the whole posture is theatre. Every record is written once and proven, so an auditor can bank a chain the vendor alone cannot recompute.
Append-only
A correction is a new version. Nothing is edited or deleted in place, and not even a superadmin is exempt.
Content-addressed
Each record is addressed by the hash of its content, so any change to the bytes changes the address.
Tamper-evident
Records are chained and provenance-stamped, so a missing or altered link is detectable, not silent.
Notarized externally
The chain's periodic root is anchored to an RFC 3161 timestamp authority, so the proof does not rest on our word alone.
Verifiable offline
An open-source verifier validates any export's hash-chain and root membership without access to the platform.
The chain itself — append-only, content-addressed, tamper-evident — is built. External notarization and the offline verifier are specified and on the build plan; they are not running yet.
sha256:1b7e2c91…a4d09c
anchored RFC 3161 · 2026-06-24
Most teams are stuck between a compliance binder no attacker respects and a drawer of point tools that never share a source of truth. Verdiq is designed to be neither, so one platform carries the work the two old approaches leave half-done.
Verdiq
One platform
Checkbox GRC suites
Stitched point tools
VALO TECH runs a wallet pursuing a MAS licence, an ad network with a fraud and privacy surface, and two 16+/18+ products carrying minor-safety obligations. Verdiq is the first to dogfood against that posture, which is the proof an external buyer's vendor review wants to see, not a roster of paying logos.
We hold the same product to our own crown-jewel posture before we ask any business to trust it with theirs.
Where we observe a sibling product, we read control and evidence metadata across a privacy firewall, never the consumer data behind it.
Each posture signal crosses a signed, scoped, versioned contract, so the boundary is a structural firewall, not a promise.
Proven on the VALO ecosystem first
Verdiq ships a complete GRC core from day one, then deepens it on a steady cadence. The first three releases are specified and on the build plan; the last two are the committed direction. Select a release to see what it brings.
In build since early 2026
Target GA Q3 2026
Compliance, risk, and governance, proven.
The core platform maps your controls to every framework and SEA law you answer to, runs the risk register, and proves each control with tamper-evident evidence. AI assists from day one — rule-based by default for every tenant, with an opt-in, region-verified third-party model (Claude / GPT via AWS Bedrock) as an upgrade where available — and nothing sensitive leaves your perimeter unless you allow it.
A self-serve path to audit-ready: guided onboarding, the control library, evidence, and one readiness number.
PDPA Singapore, PDPL Vietnam, and PDPA Malaysia at counsel-gated depth.
À la carte · Full suite · Early-adopter ladder
Buy only the modules you need, or take the full suite for less than the sum of its parts. Join while we are early and you lock in a fixed, predictable price ladder that holds as the platform grows — the sooner you start, the less you pay for everything that follows.
Toggle the modules you need; your annual estimate updates as you go. Threat intelligence is included at no cost.
Governance & compliance
Security validation
Data governance & protection
Sustainability
GRC Core is the foundation, AI-assisted — rule-based by default, with an opt-in governed third-party model where available; Specialized AI upgrades that to VALO's own self-hosted models. Every other module layers onto the same control-truth graph.
Your annual estimate
2 modules selected
Or take the full suite at $150K/yr — every module, where buying each separately runs $195K.
Figures are illustrative annual USD for early access and exclude local taxes. Comparable market figures are a typical basket of separate tools, not any named vendor. Your quote is confirmed during your evaluation.
Join at the v1, v2, or v3 stage and your first years ride a fixed ladder before settling at the mature price. Join later and you pay the current tier price from day one.
Year 1
$15K
Locked-in
Year 2
$25K
Locked-in
Year 3
$40K
Locked-in
Year 4
$150K
Year 5
$150K
5-year total: $380K
Save $370K vs joining at maturity ($750K)
The v3 stage is the last that opens the ladder; after it, each renewal is simply the current tier price. An early partner runs the full platform years before paying the full price for it.
Capability tiers
Each tier bundles every capability up to its level — below the à la carte sum — and opens as those capabilities ship. The early-adopter ladder above stays well under these list prices.
Verdiq is opening early access to design partners across Singapore, Vietnam, and Malaysia. Tell us what you are certifying and we will set up your evaluation.
Built in Singapore by VALO TECH. Rooted in SEA law, evidenced to a global bar.
