360inControl is a governance, risk and compliance (GRC) SaaS platform from CISS (Comprehensive Information SEcurity Switzerland) in Biel-Benken, Switzerland. It brings together, in one environment, an internal control system and compliance management, risk management, policy and instruction management, audit and assessment management, asset and contract management, an information security (ISMS) solution, data protection, action item management and third-party risk management, where partners can complete assessments directly in the platform. According to the vendor it supports several frameworks, such as ISO, NIST, COBIT and the GDPR. It is delivered as SaaS, with a separate tenant for each licensee.
CISS is headquartered in Switzerland, which is not in the EU but is an EFTA country with an EU adequacy decision; no foreign parent company is stated. The vendor does not say where the data is hosted, so ask about the data centre and subprocessors. The privacy policy is governed by Swiss law, with the courts of Basel as the place of jurisdiction. For European organisations it is a non-US alternative among GRC platforms.