Wizard-based. Most firms finish onboarding in a day. Then your governance program runs in the background, and you only step in when there's a decision to make.
No compliance expertise needed. Every step explains what you're doing and why it matters.
Starting at $99/mo · Billed annually
A guided wizard collects your firm details in 3 minutes. Everything you generate will be tailored to this info.
⏱ Average setup time: 3 minutes
FTC requires you to know exactly where client data lives. Kompflow auto-generates your data inventory from the software you listed in Step 1.
⚡ Auto-populated, just review and confirm
A structured 7-module risk assessment built on a vCISO framework. Assign modules to different team members such as your MSP, office manager, or yourself.
👥 Delegate modules across your team, with no bottlenecks
Your risk assessment doesn't just score you. It identifies exactly where your compliance program falls short and creates an AI-guided remediation plan to close every gap.
🎯 Don't just know your risks. Close them.
Your risk profile, software stack, and state laws are analyzed to generate a Written Information Security Program (WISP) unique to your firm, not a generic template. Professional and Premium plans also generate Incident Response Plans (IRPs) with scenario-specific playbooks.
Personalized overview + 10 FTC-compliant security policies built from your firm's risk profile, software stack, and team structure.
Covers access controls, data retention, encryption, vendor management, employee training, physical security, and more.
Scenario-specific playbooks for ransomware, data breaches, wire fraud, lost devices, email compromise, and system outages.
Each plan includes your contact tree, state breach laws, and step-by-step response procedures.
Your risk assessment automatically maps to 58 FTC and IRS controls. Create testing cycles, assign evidence collection to your team or MSP, and track effectiveness over time.
🛡️ Prove compliance, don't just document it
Compliance isn't a one-time event. Kompflow keeps your program current between insurance renewals, client reviews, and regulator checks.
Assign compliance tasks to team members, your office manager, or your MSP. Track due dates, approvals, and progress, all in one place. Tasks are linked directly to risk assessment findings, remediation items, and policy reviews.
FTC & IRS require employee security training. Modules are short and assigned automatically by role and firm size, so your staff learns phishing awareness, data handling, and breach response. Tracked completion gives you the records insurers, regulators, and clients ask for.
FTC requires annual reviews of your security program. Automatic reminders, one-click version creation, and a complete audit trail of every change.
Evaluate the security posture of your third-party vendors, including SOC 2 compliance, contractual safeguards, and data handling practices.
Create quarterly or annual testing cycles. Evidence collection with AI evaluation that reads screenshots for tax systems that aren't API-connected. Track control effectiveness over time with full audit trail.
Cross-module event tracking monitors data inventory changes, assessment approvals, remediation completions, and more. Severity levels with recommended actions and direct links to resolve.
Admin, IT, and User roles. Admins manage the program. Team members see only their assigned tasks. Everyone stays in their lane.
FTC and IRS auditors want to see documented evidence of your entire security program. Here's what Kompflow produces:
Setup takes a day. After that, you step in only when there's a decision to make.
You can send your Security Package to your carrier, your client, or your IRS liaison the afternoon you finish onboarding.
Your data inventory stays accurate without manual checks. Staff modules show up in each person's queue: short, role-matched, tracked to completion.
Screenshots, attestations, and documents uploaded by the people who own each control. AI scores them, your QI reviews and approves. Audit trail builds itself.
When something drifts (an expired policy, a stale risk decision, a vendor review past due), it shows up as an event with a recommended action. You decide; we document.
The Insurance Gap Assistant pulls from your actual firm data. You see what you have, what you're missing, and what to fix first: grounded in evidence, not generic copy.
Everyone sees only what they need. Nobody scrambles.
You see the program at a glance: what's approved, what's pending your signature, what's drifting. The decisions that need you show up in one queue. Everything else runs on its own.
Risk decisions, remediation approvals, control testing reviews: all in one workflow with audit trail. You review what matters, approve with a signature, and move on. No chasing PDFs across email.
Training modules show up in your queue, matched to your role. Evidence uploads are one click. You see only your tasks. Nothing else. Completion is tracked so nobody has to ask how far along you are.
Partners work from a cross-client dashboard with a 5-role RBAC, named report types, and the Agent Decision Queue for AI oversight across every client at once. You collaborate with your firm in their workspace. They keep ownership of the governance decisions.
1–25 employees. Need FTC compliance but don't have time to build a program from scratch.
Electronic Return Originators subject to IRS Publication 4557 requirements.
Your MSP handles security. Kompflow handles the governance documentation they can't.
Your vCISO sets strategy. Kompflow automates the documentation and tracking.
From setup to compliant in less than a day, guided every step of the way
Starting at $99/mo · Billed annually
We use cookies to measure site performance and improve your experience. No data is sold to third parties. Privacy Policy