Unicis Platform CE: open-source GRC for a medical device team

Cybersecurity is no longer optional for medical device software: IEC 81001-5-1, FDA §524B and requirement 17 of Annex I of the MDR have made it mandatory. As a result, teams that never ran an ISMS suddenly have to track controls, a risk register and audit evidence. An open-source GRC platform like Unicis Platform CE promises to do that in-house, without a SaaS subscription. Here is what it actually covers for a medical software vendor — and the line where it stops.

What is an open-source GRC platform like Unicis Platform CE?

Definition: a GRC (Governance, Risk, Compliance) platform centralises how you run information security — control inventory, risk register, evidence collected for the audit — in a single tool instead of a stack of spreadsheets. Unicis Platform CE is an open-source, self-hostable edition released under the Apache 2.0 license; per its repository, the project positions itself as an alternative to proprietary SaaS such as Vanta or Drata.

Technically, it is a Next.js app on PostgreSQL, deployable via Docker, multi-tenant, with SAML SSO and a REST API. Nothing exotic for a team that can run a web service. The point is not technical prowess: it is keeping control of the tool and the data, with no per-seat license and no vendor lock-in.

What does it actually cover for a medical software vendor?

For a SaMD (Software as a Medical Device) vendor, the value concentrates on information security and data protection. Per its repository, Unicis references several frameworks — ISO/IEC 27001 (2013 and 2022 editions), SOC 2 Type II, GDPR, NIST CSF 2.0, EU NIS 2, PCI DSS — and ships the modules to instrument them.

It is a fair foundation for running an ISMS and a GDPR posture. For a medical vendor pursuing SOC 2 or ISO 27001 to reassure hospital customers, the tool saves real time on evidence upkeep. But everything it handles is information security — not patient safety.

Information-security risk register or ISO 14971 risk management: the trap in the word “risk”

This is the confusion I see most often, and it is expensive. A GRC platform’s risk register follows ISO/IEC 27001 logic: it assesses risks to the confidentiality, integrity and availability of information. A medical device’s risk management follows ISO 14971:2019: it assesses risks of harm to the patient from using the device — a false negative shown to the clinician, a miscalculated dose, a missed alarm.

These are two distinct disciplines, with two methods and two deliverables. Weak encryption is an ISO 27001 risk; an algorithm that underestimates a measurement is an ISO 14971 risk. A GRC platform manages the first register. It will never produce your ISO 14971 risk management file — and if you tick “risk: handled” on the strength of your GRC tool, the notified body’s auditor will see through it in thirty seconds.

An information-security risk register and an ISO 14971 file share the same word and name different dangers: one protects the data, the other protects the patient.

Self-hosting and sovereignty: what it changes for health data

The strong argument for a self-hosted, Apache-2.0 solution when you handle health data is control: you decide where the app and its database run, without handing your compliance map to a third party. No proprietary lock-in, no data exfiltrated to a SaaS whose region you do not choose.

My field experience: that control is real, but it must not turn into a regulatory illusion. Self-hosting Unicis does not make your hosting HDS-compliant (France’s Hébergeur de Données de Santé certification) — HDS certifies the hosting infrastructure and its operator, not the software you install on it. Self-hosting gives you control; the compliance of the hosting itself is a separate matter, to settle with your provider.

Where the tool stops: the MDR technical file no GRC platform fills

Here is the boundary to keep in mind. A GRC platform covers the information-security and personal-data perimeter. CE marking a medical software rests on an entirely different foundation, which no GRC tool generates:

• the IEC 62304:2006+A1:2015 software life cycle — architecture, requirements, traceability down to code and tests;
• the ISO 14971:2019 risk management file, tied to the product’s real functions;
• the MDR technical documentation (Annexes II and III);
• clinical evaluation and post-market surveillance.

The only overlap is cybersecurity — and it is real: a GRC platform helps structure the evidence expected by IEC 81001-5-1 and by FDA §524B. But your software’s class is decided upstream under MDR Rule 11, and the file that follows is not filled in a security-compliance tool. If your need leans toward continuous evidence automation rather than governance, see also compliance-as-code meets the medical device.

Should you adopt it, and for whom?

Unicis Platform CE makes sense if you want to own your ISMS, avoid a SaaS’s per-seat costs, keep control of your data, and have the capacity to run a self-hosted service. It makes less sense if you want turnkey compliance with support and a built-in auditor — there, a managed SaaS earns its price. Either way, remember the same thing: it is a tool for the information-security side of your compliance, the cybersecurity brick of a larger whole. The medical device itself is proven elsewhere.

FAQ

Does Unicis Platform CE replace an MDR technical file?

No. It manages information security (ISO/IEC 27001) and data protection (GDPR). The MDR technical file — IEC 62304, ISO 14971, clinical evaluation — belongs to a different corpus that no GRC platform produces. Both are necessary; they do not substitute for each other.

Is the open-source edition enough, or do you need the cloud one?

The Community edition, under Apache 2.0, is functional and self-hostable. The choice between self-hosting and a managed offering is the classic trade-off: control and zero license cost on one side, support and delegated operations on the other. It depends on your operational capacity, not on a missing feature.

Does self-hosting Unicis make my hosting HDS-compliant?

No. HDS certification covers the host and its infrastructure, not the software installed on it. Self-hosting gives you control of the data; HDS compliance of the hosting is handled separately, with a certified provider.

An ISMS to structure, an MDR file to scope? Book a call — we separate what belongs to the tool from what belongs to the regulatory file.