Connect Claude to your compliance data with MCP

Your compliance data is only useful if you can get answers out of it. Most of the time that means clicking through screens, filtering registers, and copying numbers into a report. The Model Context Protocol (MCP) changes that: it is an open standard that lets an AI assistant like Claude talk directly to an application's data through a small, well-defined set of tools. Compliance One ships an MCP server with every account, so your assistant can read your programme and answer questions about it in plain language.

Ask 'which controls are still not implemented for SOC 2?', 'show me every risk owned by the platform team', or 'summarise our open audit findings and their due dates', and the answer comes from your live data, not a stale export.

Compliance tools make you go to the data. MCP brings the data to the place you are already thinking: a conversation. The register you never open becomes a question you can just ask.

What you can do with it

The server exposes a focused set of tools that cover the whole platform, so there is nothing per-module to wire up:

• Read across everything: risks, controls, your Statement of Applicability, evidence, audits, suppliers, assets, personnel, incidents and more.
• Search and summarise: free-text search across your compliance domains, plus a one-call posture snapshot of counts per area.
• Make audited changes: create or update a safe, limited set of records (like risks, incidents and nonconformities), with every change written to your audit log.
• Work in any MCP client: Claude on the web and desktop, Claude Code, or any tool that speaks MCP.

Safe by design

Connecting an assistant to your compliance data should make you more secure, not less, so the server is built to strict boundaries:

• Org-scoped: every request is confined to your organisation. Cross-tenant access is impossible.
• Secrets never leave: credential-bearing data is excluded and secret-looking fields are stripped from every response.
• Per-user consent: connect with OAuth 2.1 (you sign in and approve, one click) so access follows the person, or use a scoped API key for automation.
• Least privilege: read access is separate from write, and writes are limited to an allow-list and always audited.
• Guardrailed: rate limiting, short-lived tokens and strict validation protect the endpoint from abuse.

Connect in a minute

In Claude, add Compliance One as a custom connector using your environment's MCP URL (you will find it in Settings, Integrations). Claude walks you through signing in and approving access, then the tools appear, ready to use. Prefer automation or the command line? Create a scoped API key under Settings, Integrations and pass it as a header from Claude Code.

It is included in every plan at no extra cost. Compliance you can simply ask about is compliance people will actually keep on top of.