Kanonik connects to the GRC tool you already pay for. We do not replace it. We add an intelligence layer between your AI and the data already in your system, with every change validated by the Verifier and logged in a tamper-evident audit trail.
This page is the canonical list of supported integrations. We update it as new connectors ship.
We support Eramba, the open-source GRC platform. Eramba is the first connector because it has a well-documented REST API, an active community, and we use it ourselves.
Eramba version compatibility: 3.18.0 minimum, 3.21.0 maximum tested. We track new Eramba releases and update the connector as needed.
What the connector does:
| Entity | Read | Draft write | Direct write | Webhook |
|---|---|---|---|---|
| Controls | ✓ | ✓ (via review status) | Roadmap | Not supported by Eramba |
| Control Mappings | ✓ | ✓ | Roadmap | Not supported by Eramba |
| Evidence | ✓ | ✓ | Roadmap | Not supported by Eramba |
| Risks | ✓ | Read-only today | Roadmap | Not supported by Eramba |
| Policies | ✓ | Read-only today | Roadmap | Not supported by Eramba |
| Frameworks | ✓ | Read-only: frameworks are managed in Eramba | n/a | n/a |
| Requirements | ✓ | Read-only: sourced from Eramba | n/a | n/a |
Approval model. Commits land as drafts in Eramba (status review); your reviewer approves in Eramba's UI. For changes Eramba doesn't support as drafts, the change waits behind a signed approval link sent to your CISO over email or Slack; clicking the link commits the change with a cryptographically signed approval token. Direct-write to Eramba is a Business-tier roadmap feature requiring explicit per-entity-type enable.
Connection. During onboarding, you provide your Eramba base URL and a bot-user API token. We provide the setup script to create the bot user with minimum-necessary permissions. We validate the connection by calling Eramba's /api/v1/user/me endpoint. If your Eramba instance is reachable only inside your network, a reverse-tunnel agent ships on the roadmap.
Provenance. Every entity Kanonik reads from or writes to Eramba carries a connector-provenance tag identifying the connector version (eramba/v1). An auditor reading your Eramba data can tell what came from Kanonik and when.
Connector build order is driven by Founding Customer cohort signal. We do not commit to dates we have not started; we do commit to the order.
RSA Archer, OneTrust, and AuditBoard ship as customer demand justifies. Tell us your stack when you request a demo and you change the priority.
Connectors are useful on their own (Kanonik on top of your existing tool). Connector pairs make something more possible: read your compliance program out of one GRC tool, walk it through the canonical model, commit it into the next; the hash-chained evidence spans the transition uninterrupted. No audit-period gap. No "the chain restarted when we moved."
What is shipping when:
The architectural primitive is the canonical model itself. In production code today. Each new connector is mechanical work; the schema decision that makes portability possible is already made. The chain follows the data; the data does not follow the tool.
Connectors are products in their own right, not library code. Each connector ships with:
IDLE -> FETCHING -> TRANSLATING -> RECONCILING -> COMPLETE) with explicit error handling and retry semanticsConnector versions are independent of the canonical model. A connector at v1 may continue working as the canonical model moves to v2 and beyond, within published backward-compatibility windows.
The Verifier still gates every write. Connectors do not bypass the Verifier. The same two-tier validation, three-layer confidence calculation, and signed audit-trail entry apply to every change regardless of which connector ultimately writes to which GRC tool.
We hear this question often. Two options exist:
We do not build one-off integrations that ship outside the connector framework. The framework is what makes the audit-trail and Verifier story work consistently across every GRC tool we touch.
If your GRC tool is not on this list and you would like to discuss a connector, contact [email protected]. Tell us what you use, how you use it, and what you would want Kanonik to do with it.
If you run Eramba, the connector is live today. Everyone else: tell us your stack and we'll prioritise accordingly.