Skip to main content

​
1. Create your account

Sign up at app.matproof.com. You can start with a free trial — no credit card required. After signing up, you’ll be guided through the initial setup wizard.

​
2. Select your frameworks

Choose the compliance frameworks your organization needs to address:
  • DORA — Digital Operational Resilience Act (EU financial services)
  • ISO 27001 — Information security management
  • SOC 2 — US/international trust service criteria
  • NIS2 — Network and Information Security Directive
  • GDPR — General Data Protection Regulation
  • CSRD — Corporate Sustainability Reporting Directive
Start with the framework tied to your nearest audit deadline. You can add more frameworks at any time.

​
3. Generate your policies

Matproof uses AI to generate a complete policy set pre-mapped to your selected frameworks.
  1. Navigate to Policies in the sidebar
  2. Click Generate policies
  3. Review and customize each policy
  4. Publish when ready
Policies are bilingual (German and English) by default.

​
4. Connect your tools

Link your existing tech stack for automated evidence collection:

GitHub

Code security, access controls

Google Workspace

User management, access logs

Jira

Incident tracking, change management
Don’t have integrations set up yet? You can upload evidence manually using the evidence upload feature while you configure integrations.

​
5. Set up vendor risk management

If you have third-party vendors or suppliers:
  1. Go to Vendor Risk → Add vendors
  2. Import from CSV or add manually
  3. Assign risk categories and questionnaire templates
  4. Send questionnaires — vendors respond via a secure portal

​
6. Run your first risk assessment

Navigate to Risk Management and run a gap assessment against your selected framework. Matproof will show you:
  • Controls that are fully met
  • Controls with evidence gaps
  • Recommended remediation steps

​
What’s next?

CSRD Module

Setting up supplier ESG data collection for CSRD/ESRS reporting.

Vendor Risk

Managing your supplier base and Art. 28 register.