SwarmTech
Built for POPIA and Joint Standard 2

Prove compliance in one place.

Collect evidence once, map it to every standard you answer to, and hand your auditor a pack that holds up. ControlsHub turns spreadsheets, shared drives and last-minute scrambles into one living control register.

Start 14-day trial (opens SwarmTech ControlsHub in a new tab)Book a walkthrough
Built and operated by SwarmTech Consulting
SwarmTech ControlsHub · Control registerSample data
POPIA84%
Joint Std 261%
ISO 2700147%
POPIA-13
Information security policyPassed sample test
Verified
JS2-36
Regulator incident reportingEvidence confirmed, test due
Documented
A.8.5
Secure authenticationNeeds confirmed evidence
In progress
Evidence mapped onceAccess Control Policy v3.2 supports 11 controls across POPIA, JS2 and ISO 270019 links confirmed by a person · 2 awaiting review
17
standards ready to adopt
745
controls in plain language
51
connected systems for evidence
$9
a month to start, after a 14-day free trial

What is SwarmTech ControlsHub?

SwarmTech ControlsHub is a compliance controls platform for POPIA, Joint Standard 2, ISO 27001, SOC 2, King IV and 12 other standards. Teams collect evidence once, map it to every standard it supports, and export audit-ready reports. Plans start at $9 (R169) a month after a 14-day free trial.

See pricingCompare all three products

Why audits hurt

The same evidence, collected five times, for five frameworks.

Most organisations don't fail audits because the work wasn't done. They fail because nobody can prove it was done, by whom, and when, in the format the auditor wants.

  • Spreadsheet registers

    Control lists live in a workbook only one person understands. When they leave, so does your compliance position.

  • Duplicated effort

    POPIA, Joint Standard 2 and ISO 27001 ask for overlapping proof, but each gets its own folder, its own owner and its own scramble.

  • "Implemented" on trust

    Controls get marked done with no evidence behind them. The auditor finds out before you do.

  • Regulatory pressure

    Joint Standard 2 puts cyber resilience on the board's agenda for FSPs and insurers. Saying you're compliant is no longer enough.

What you get

A control register that can't overstate itself.

  • Standards, ready to adopt

    POPIA, Joint Standard 2, ISO 27001, SOC 2, King IV, NIST CSF, PCI DSS, GDPR, ISO 22301 and more, written in plain language and revision-tracked.

  • Collect once, map everywhere

    Upload a policy once. AI suggests every control it supports across your standards, and a person confirms each link.

  • Evidence-gated status

    A control reaches Documented only with confirmed evidence, and Verified only after a passed test. Your register can't claim more than you can prove.

  • Maturity you can defend

    Six-level maturity per control with history kept, the weakest controls always in view, and frozen snapshots for your auditor.

  • Agent Ordo, audit specialist

    Drafts audit findings, compliance summaries and formal report drafts from your own records, citing every one. It proposes; a person approves.

  • Findings and testing

    Raise findings with owner, severity and due date. Schedule control tests and see overdue and never-tested controls before the auditor does.

  • 51 connected systems

    Pull evidence from Entra ID, Google Workspace, Okta, AWS, Azure, Jira, ServiceNow, Datadog and more, instead of chasing screenshots.

  • Audit-ready reports

    Freeze a readiness position and export it to PDF, Word or CSV, with sites, scope and exclusions stated.

How it works

From scattered folders to an audit pack in weeks, not quarters.

  1. Step 1: Adopt your standards

    Choose the frameworks you answer to. Controls arrive pre-written, so you start by marking what applies, not by typing.

  2. Step 2: Load evidence once

    Upload documents or connect your systems. AI suggests the controls each item supports; your team confirms the links.

  3. Step 3: Test, close gaps, report

    Record tests, raise findings and watch readiness climb. When the auditor asks, freeze a snapshot and export the pack.

Multi-client and multi-site from day one, for groups, consultancies and assurance teams.

Who it's for

Built for the people who answer to an auditor.

A strong fit for
  • South African businesses getting POPIA in order
  • FSPs and insurers under Joint Standard 2
  • Teams pursuing ISO 27001 or SOC 2
  • Consultants running several client engagements
Not designed as
  • A substitute for legal advice or a certification body
  • Organisations that want a policy template pack and nothing else

ControlsHub supports compliance work. It is not legal advice or certification.

Pricing

Compliance tooling from the price of a coffee a week.

Prices per month, excluding VAT. Pay by card through PayFast in rand, or by invoice in dollars, euros or pounds. Pay annually and get two months free. Every plan starts with a 14-day trial: no card needed.

Included in every plan
  • Control register and evidence vault
  • AI evidence-to-control mapping
  • Agent Ordo report drafts
  • Findings and control testing
  • 51 connected systems
  • PDF, Word and CSV reports
  • Free read-only seats for your auditors

Outgrowing a plan? A custom licence can raise any limit for a single workspace. Talk to us about larger estates. When a trial or licence ends, your existing work stays readable and exportable.

Questions buyers ask

Before you decide

We already track controls in a spreadsheet. Why switch?

A spreadsheet can say a control is done; ControlsHub makes you prove it. Status climbs only as far as confirmed evidence and passed tests carry it, and one piece of evidence counts against every standard it supports, so the second and third framework cost a fraction of the first.

Does the AI decide whether we're compliant?

No. AI suggests which controls a document supports and Agent Ordo drafts reports from your records, citing every one. A person confirms every evidence link and approves every proposed change.

Is ControlsHub suitable for Joint Standard 2?

Yes. Joint Standard 2 of 2024 (cybersecurity and cyber resilience) is in the library as a standard in its own right, and the Regulated plan is built for FSPs and insurers who must answer to it.

Can we use it for several companies or clients?

Yes. Workspaces hold multiple clients with their own sites, scope and team access. The Partner plan covers up to 30 clients across 25 workspaces from one login, and a custom licence can go further.

Can SwarmTech help us get started?

Yes. SwarmTech Consulting builds ControlsHub and runs compliance engagements with it. We can adopt your standards, load your first evidence and run a readiness review with your team.

Works with

Better together, sold separately.

SwarmTech ControlsHub stands on its own. If you also run these, they connect through the same practice.

See your real compliance position in 14 days.

Adopt a standard, load your first evidence, and watch your readiness score reflect what you can actually prove.

Start 14-day trial (opens SwarmTech ControlsHub in a new tab)Book a walkthrough