Adamantware OÜ has signed a distribution and exclusivity agreement with HealthTech Portugal — please contact them for any further information.
Contact HealthTech Portugal ↗Turn a compliance engagement into the deliverable. Assess a control once and score it against every framework at the same time — then walk away with the report, the policy documents that close its findings, and the client's data, all in one folder. No cloud. No agents. One offline binary.
Built for the person running the engagement, not filling a marketing deck. Every feature maps to a step in a real audit — find the gap, then hand over the thing that closes it.
Twenty-three frameworks across two assessment lists — security & compliance and management & governance — 930 requirements behind one unified control set. Assess a control once and it scores against every framework it touches at the same time. Coverage is a measured number, not a datasheet claim: every published requirement is mapped, and a mapping that points at a requirement the standard doesn't contain is flagged as an error.
One self-contained folder per client engagement: the report, every document generated to close its findings, a portable bundle and a standalone database. Hand it over, archive it, or re-open it a year later without the tool. Filled-in documents are never overwritten when you re-issue — your work is the deliverable, not a rebuildable artefact.
28 OpenDocument policy and procedure templates — incident response plan & playbook, risk register, access control, BC/DR, cryptographic controls, RoPA, DPIA, Business Associate Agreement, cardholder-data handling and more — pre-filled with the client and linked from the report as evidence. Find "no documented policy for this" and hand over the document that closes it, in the same click.
Each control carries a goal date and a reassessment date. The tool judges it against today and reports on time or delayed — a control that reached compliance a month after its promised date is a slip, and it is coloured like one. A year-long engagement tracked like the project it is, with a delivery roll-up the steering committee can read.
A spider chart across frameworks, gap-analysis bars per domain, and a prioritised remediation roadmap ranked by criticality × gap × framework-leverage. Follow-up reports show progress since the baseline — what improved, what regressed — and know whether they are the initial, an intermediate or the final report.
GUI for engagements you run in the room, headless CLI for scripted pipelines and jump boxes. No cloud, no agents, no subscription, no telemetry. Evidence auto-ingests from the rest of the No Hat Hacker sidekick family. The client's data never leaves the machine it was assessed on.
Not "we touch these standards." Every published requirement of every framework below is mapped to a control — measured on each build, so the number cannot quietly drift. Run an engagement against the security list, the management list, or both.
One assessment, twenty-three scorecards. 241 unified controls, 930 requirements — 100% mapped.
A GUI for the assessment room — assessment grid, live posture, per-control timelines and one-click documents. A headless CLI for pipelines and reporting: cas grc deliver writes the whole engagement pack; cas grc coverage proves the mapping; cas grc plan shows what has slipped.
Customers, engagements and per-control evidence keyed per client. Scope a report to one standard or run the full audit. Export a customer's whole database to a portable bundle and import it on another machine — hand an engagement to a colleague without shipping the tool.
Feed in results from the rest of the sidekick family and the matching controls attest automatically, each guarded so a tool can only speak for the controls it owns. Everything else is manual attestation with a dated, authored, append-only note trail — an audit record that cannot be quietly rewritten.
The SaaS platforms monitor your own company, forever, from the cloud. This is for the consultant who shows up, audits the client, and leaves with the deliverable.
| Capability | CAPS v0.4.0 |
Vanta ~$20k+/yr |
Drata ~$15k+/yr |
Eramba OSS |
Spreadsheet Free |
|---|---|---|---|---|---|
| Offline single binary — no SaaS, no agents | ✓ | ✗ | ✗ | ~ | ✓ |
| One control mapped to every framework at once | ✓ | ~ | ~ | ~ | ✗ |
| Generates the auditor's report | ✓ | ~ | ~ | ~ | ✗ |
| Generates filled, editable policy documents | ✓ | ✗ | ✗ | ✗ | ✗ |
| Per-client, per-engagement deliverable pack | ✓ | ✗ | ✗ | ~ | ~ |
| Delivery timeline — goal date vs on-time/delayed | ✓ | ~ | ~ | ✗ | ✗ |
| Progress-since-baseline follow-up reports | ✓ | ✓ | ✓ | ~ | ✗ |
| No subscription, no per-seat cloud | ✓ | ✗ | ✗ | ✓ | ✓ |
| Client data never leaves your machine | ✓ | ✗ | ✗ | ✓ | ✓ |
✓ Full · ~ Partial · ✗ Not available · Comparison from public sources, 2026. Vanta/Drata are cloud continuous-compliance platforms for an organisation's own posture; CAPS is an engagement tool for auditors and pentesters.
Online validation on every launch. Machine-fingerprint locked. No seat sharing.
Prices in EUR excluding VAT. Invoice available via portal. Authorised assessment use only.
No credit card. Instant key. All 23 frameworks unlocked.