TraxrGRC

User Manual

October 2026 · build 244823a

A self-hosted governance, risk and compliance platform.

About this manual

This manual describes TraxrGRC from the user's point of view: what each screen is for, what its fields mean, and how to complete each workflow. It reflects the product as shipped.

Who this manual is for

New users who want the fast path should start with the Quick Start Guide. Installation, operations, single sign-on and administration in depth are in the Administrator's Guide.

Developers integrating with TraxrGRC should read the REST API chapter together with the machine-readable OpenAPI document. Engineering conventions for people working on the product itself are in docs/CONTRACTS.md.

How this manual is organized

The chapters follow the sidebar of the application:

ChapterWhat it covers
Getting StartedSigning in, the layout, the Dashboard and the conventions shared by every module
Administration & SettingsUsers, groups, roles, labels, custom fields, integrations, notifications, the audit log, API tokens and backups
Risk ManagementThe risk register, treatments, reviews, exceptions, controls, assets, business units and risk settings
Compliance ManagementCompliance packages, analyses, the gap view, the POA&M register, exceptions and the compliance report
Policy ManagementPolicies, versions, approval, reviews, the Policy Portal and acknowledgements
Third-Party ManagementVendors and partners, contacts, linked risks and data protection details
Incident ManagementIncidents, classifications and personal data breaches
Internal AuditsAudit plans and findings
ProjectsRemediation and improvement projects
Security AwarenessTraining programs, tests and results
Data PrivacyRecords of processing, transfers, the Article 30 register, DPIAs, reviews and data mapping questionnaires
Account ReviewsPeriodic reviews of user accounts
EvidenceInternal evidence and third parties' assurance reports, linked to what they support
Online AssessmentsQuestionnaire templates and requests answered by outside contacts
Report CenterCross-module reports, CSV downloads and scheduled email delivery
REST APIProgrammatic access with API tokens

Each module chapter opens with what the module is for and who uses it, then describes the list page, the record detail page and its tabs, and the procedures for the module's workflows. Read Getting Started first; the other chapters can be read in any order.

Conventions

ConventionMeaning
BoldA label you see on screen: a menu entry, page title, tab, button, field or status, written exactly as it appears.
Settings → API TokensA navigation path: open Settings in the sidebar, then API Tokens.
monospaceText you type or read literally: addresses, file names, permission names, codes and API values.
module:rightA permission, for example risks:read (Read on the Risks module) or reports:create. Roles grant rights per module; see Administration & Settings.
own and allThe two levels at which a role can hold a right. At own you work only with records that you or one of your groups own; at all you work with every record in the module.
Numbered stepsA procedure to follow in order.

Permission notes. What you see depends on your role. A sidebar entry, button, tab or report appears only when your role grants the right it needs, so your screens may show fewer options than the screenshots here. Where a feature depends on a specific right, the text names the module and the right. Administrators have every right in every module.

Screenshots. The figures show a demonstration installation populated with fictional data for an invented company, Quillmont Systems. Names, dates and counts on your installation will differ, and the product name and logo follow your organization's branding.

Dates and times are shown in your own time zone, which you set on your profile (My profile → Time zone).

Contents

  1. 1Getting Started
    1. 1.1What you can manage
    2. 1.2Signing in
    3. 1.3The app layout
    4. 1.4The Dashboard
    5. 1.5My Tasks
    6. 1.6My profile
    7. 1.7The Policy Portal
    8. 1.8Shared UI conventions
  2. 2Administration & Settings
    1. 2.1Finding the Settings screens
    2. 2.2Users
    3. 2.3Groups
    4. 2.4Roles
    5. 2.5Labels
    6. 2.6Custom Fields
    7. 2.7Integrations
    8. 2.8Provisioning (SCIM)
    9. 2.9Sessions
    10. 2.10Branding
    11. 2.11Policies
    12. 2.12Privacy
    13. 2.13AI assistants
    14. 2.14Notifications
    15. 2.15Audit Log
    16. 2.16API Tokens
    17. 2.17Backups
  3. 3Risk Management
    1. 3.1The risk register and its tabs
    2. 3.2The Risks list
    3. 3.3Creating a risk
    4. 3.4How scoring works
    5. 3.5The risk detail page
    6. 3.6Treatments
    7. 3.7Reviews
    8. 3.8Exceptions
    9. 3.9Comments, attachments and history
    10. 3.10Controls
    11. 3.11Assets
    12. 3.12Business Units
    13. 3.13Risk Settings
    14. 3.14Who can do what (Risk Management)
  4. 4Compliance Management
    1. 4.1Packages
    2. 4.2Importing a package
    3. 4.3Exporting a package
    4. 4.4Common controls and inheritance
    5. 4.5The NIST SP 800-53 catalog
    6. 4.6Crosswalks between frameworks
    7. 4.7The analysis workspace
    8. 4.8Analysis statuses
    9. 4.9Working on an item
    10. 4.10The gap view (POA&M)
    11. 4.11The POA&M register
    12. 4.12Exceptions on a clause
    13. 4.13The compliance report (PDF)
    14. 4.14Deleting packages and items
    15. 4.15Who can do what (Compliance Management)
  5. 5Policy Management
    1. 5.1The policies list
    2. 5.2Creating a policy
    3. 5.3The policy detail page
    4. 5.4Writing content (Content tab)
    5. 5.5The draft → approval → publish workflow
    6. 5.6Versions tab
    7. 5.7Reviews tab
    8. 5.8Exceptions
    9. 5.9Archive and reactivate
    10. 5.10Comments, Attachments, History and Custom Fields
    11. 5.11Policy portal and acknowledgements
    12. 5.12Deleting a policy
    13. 5.13Who can do what
  6. 6Third-Party Management
    1. 6.1The register
    2. 6.2Creating a third party
    3. 6.3The detail page
    4. 6.4Data protection
    5. 6.5Deleting a third party
    6. 6.6Who can do what
  7. 7Incident Management
    1. 7.1Who can do what
    2. 7.2Managing the classification catalog
    3. 7.3The incidents list
    4. 7.4Creating an incident
    5. 7.5The incident detail page
    6. 7.6Closing and reopening an incident
    7. 7.7Personal data breaches
    8. 7.8Editing and deleting
    9. 7.9Comments, attachments and history
  8. 8Internal Audits
    1. 8.1Who can do what
    2. 8.2The audit plans list
    3. 8.3Creating an audit plan
    4. 8.4The plan detail page
    5. 8.5Working with findings
    6. 8.6Open findings
    7. 8.7Comments, attachments and history
  9. 9Projects
    1. 9.1Who can do what
    2. 9.2The projects list
    3. 9.3Creating a project
    4. 9.4The project detail page
  10. 10Security Awareness
    1. 10.1The programs list
    2. 10.2Creating a program
    3. 10.3Program status: draft, active, archived
    4. 10.4The program detail page
    5. 10.5Content tab: the training material
    6. 10.6Test tab: building the question set
    7. 10.7Tracking tab: who has completed the program
    8. 10.8Taking a test
    9. 10.9Comments, attachments, history and custom fields
    10. 10.10Deleting a program
    11. 10.11Awareness permissions
  11. 11Data Privacy
    1. 11.1The records list
    2. 11.2Creating a record
    3. 11.3The record detail page
    4. 11.4Documenting the record
    5. 11.5Article 30 completeness
    6. 11.6Transfers
    7. 11.7Linked assets, risks and controls
    8. 11.8The Article 30 register
    9. 11.9DPIAs
    10. 11.10The Reviews tab
    11. 11.11Review notifications
    12. 11.12Record status: draft, active, archived
    13. 11.13Comments, attachments, history and custom fields
    14. 11.14Deleting a record
    15. 11.15Data mapping questionnaires
    16. 11.16The data map
    17. 11.17Data privacy permissions
  12. 12Account Reviews
    1. 12.1The programs list
    2. 12.2Creating a program
    3. 12.3The program page
    4. 12.4Adding items to a program
    5. 12.5Reviewing items: keep or disable
    6. 12.6Comments, attachments and history
    7. 12.7Archiving, reactivating and deleting
    8. 12.8Who can do what
  13. 13Evidence
    1. 13.1The Evidence page
    2. 13.2Adding evidence
    3. 13.3An evidence record
    4. 13.4Evidence on other records
    5. 13.5Replacing earlier evidence
    6. 13.6Locked evidence and file fingerprints
    7. 13.7Expiry and reminders
    8. 13.8Evidence packages for auditors
    9. 13.9Who can do what with evidence
  14. 14Online Assessments
    1. 14.1The Assessments page
    2. 14.2Templates and the question editor
    3. 14.3Requests
    4. 14.4Reviewing answers
    5. 14.5Repeating assessments
    6. 14.6The public assessment page (for external contacts)
    7. 14.7Notifications and audit trail
    8. 14.8Who can do what
  15. 15Report Center
    1. 15.1The landing page
    2. 15.2Anatomy of a report
    3. 15.3Risk Register
    4. 15.4Compliance Status
    5. 15.5Exceptions
    6. 15.6Reviews Due
    7. 15.7Awareness Completion
    8. 15.8Incidents
    9. 15.9Policy Acknowledgements
    10. 15.10Scheduled reports
    11. 15.11Who can see reports
  16. 16REST API
    1. 16.1Authentication
    2. 16.2Conventions
    3. 16.3What is available
    4. 16.4Related access paths
  17. Index