01
Controls live in five places
Every framework gets its own spreadsheet. The same control is answered three times, differently, by three people.
The compliance workspace
Audit-ready is a state, not a season.
Lex maps every control, keeps the evidence current, and holds ISO 27001, SOC 2, NIST, CMMC and FAIM in one workspace your auditors can follow.
Free plan available. No card required to start.
app.runlex.ai/dashboard
Compliance overview
All frameworks
78%
72%
6
48
Control status
143 controls
Implemented 112
In progress 18
To do 9
N/A 4
Frameworks in scope
4 enabled
ISO
ISO 27001:202293 controls
81%
SOC
SOC 2 Type IITrust services criteria
76%
CMMC
CMMC Level 2NIST SP 800-171
69%
FAIM
FAIM 3.473 controls, 17 domains
84%
Evidence verified
Access control policy
Reviewed 2 days ago. Expires in 10 months.
Product view with illustrative data.
One control set, mapped across
ISO 27001
SOC 2
NIST SP 800-171
CMMC L2
FAIM 3.4
8framework versions supported
73FAIM 3.4 controls, structured
1audit trail, always on
The gap
Most compliance work happens in the last two weeks.
The other fifty weeks live in spreadsheets, shared drives and someone's inbox. Lex closes that gap.
02
Evidence expires quietly
A policy review lapses, a screenshot goes stale, and nobody notices until the auditor asks for it.
03
Owners chase, not work
Progress depends on reminders. Readiness depends on who remembered to upload what, and when.
The workspace
Everything the auditor asks for, already in one place.
Lex is the system of record for controls, evidence, risks and the decisions behind them. Not another folder.
Framework mapping
Enable ISO 27001, SOC 2, NIST SP 800-171, CMMC L1-L2 or FAIM 3.4. Lex loads the controls and keeps one answer across every framework.
Evidence library
Attach files and links to controls. Track ownership, review dates and expiry so nothing goes stale between audits.
Risk register
Score likelihood and impact, assign treatment plans, and watch residual exposure change over time.
Policies and documents
Version policies, record approvals and schedule reviews without leaving the workspace or losing the history.
Vendor reviews
Tier your third parties, track review status and keep supply-chain risk visible next to the controls it affects.
Audit plans
Plan the audit, follow the calendar and export an auditor-ready report when the evidence is in place.
Shared inbox
Bring compliance conversations into a shared inbox, linked to the control, vendor or audit they belong to.
Enzo, in context
Ask Enzo about the record on screen, draft a reply, or raise a support ticket when a question needs a human.
Audit trail
Every change is recorded with who, what and when. Show control effectiveness without reconstructing the year.
Frameworks
Pick the standard. Keep the evidence.
Lex turns each framework into a working control set, then keeps the overlap between them in sync. Add a second standard without starting over.
ISO
ISO 27001:2022
Information security management system
Live in Lex
SOC
SOC 2 Type II
Trust services criteria
Live in Lex
NIST
NIST SP 800-171
Controlled unclassified information
Live in Lex
CMMC
CMMC Level 1-2
Defense supply chain
Live in Lex
FAIM
FAIM 3.4
FIDI moving and mobility standard
Live in Lex
Lex+ for FIDI
Built for movers, not just software teams.
FAIM 3.4 is a first-class framework in Lex: 17 domains, 73 controls and a risk register shaped around the standard. Lex+ adds the network view FIDI auditors and affiliates need.
17FAIM domains
73controls, structured
1network record
Affiliate registryKeep network members, status and contacts in one place.
Financial assessmentsRun cycles, invite reporters and track submissions.
ISO 9001 approvalsRecord exemptions and approvals against the network record.
Audit calendarSee what is due, overdue or at risk across the network.
Missing documentsKnow which affiliates are short before the auditor does.
Auditor viewA dedicated Lex+ view for FIDI auditors and reviewers.
How it works
From first login to audit day.
01
Choose your frameworks
Enable the standards you carry. Lex loads the controls, domains and evidence expectations.
02
Assign owners
Give every control an owner and a status. See progress by framework, team or control area.
03
Collect evidence
Upload files and links as work happens. Track expiry and review dates before they become findings.
04
Walk into the audit
Export the report, open the record and answer the question with the evidence already attached.
Security
We keep the same records we ask you to keep.
Lex runs on infrastructure in Helsinki, signs users in through Dumont Auth, and records changes in an audit log. Your evidence stays yours.
Lex supports your ISO 27001, SOC 2, NIST and CMMC programs. Lex is a workspace, not a certification body.
SSO and passkeys
Google, Microsoft, passkeys or your own SSO through Dumont Auth.
EU hosting
Application and database run on Hetzner in Helsinki, Finland.
Audit trail
Changes are recorded with who, what and when.
TLS everywhere
Every page and API call is served over HTTPS.
Pricing
Start free. Scale when the audit gets real.
One price for the workspace. No setup fee, no per-evidence meter, no surprise at renewal.
Free
$0 / month
For a first framework and a small team finding its footing.
- 1 active framework
- 5 team members
- 10 evidence files
- Risk register and audit log
Most popular
Pro
$149 / month
For teams actively working toward certification.
- Unlimited frameworks
- Unlimited members and evidence
- PDF compliance reports
- Email digests and notifications
- 14-day free trial
Enterprise
Custom
For multi-entity programs, auditor networks and dedicated support.
- Everything in Pro
- SSO and SAML
- Custom integrations
- Dedicated customer success
- SLA and security review
Prices in USD, billed monthly. Cancel anytime. See full pricing
Your next audit is already on the calendar.
Start with one framework today, or talk to us about FAIM, Lex+ and multi-framework rollouts.