The first thing to fail was not a firewall or a regulation. It was retrieval. At American Transmission Company, the operator responsible for moving electricity to more than five million people across four Midwestern states, audit and compliance information lived in spreadsheets, Word files, PowerPoints and assorted software. When leaders asked for a current view of risk, the team first had to find the pieces. By the time a report was assembled, the facts were already moving.
ATC spent three years evaluating more than 13 governance, risk and compliance systems. The rejects were too expensive, too slow to implement, short on essential functions, or some unhelpful combination of all three. A proof of concept with Onspring changed the argument. The utility started with internal audit, realized within a month that the same platform could connect other functions, and kept going. What began with roughly 150 licenses became an enterprise agreement used by 82% of departments.
That expansion explains Onspring better than a page of software jargon. The Overland Park, Kansas company sells a cloud platform for governance, risk and compliance, usually abbreviated to the chewy acronym GRC. Its applications cover risk registers, controls, audits, policies, incidents, business continuity, privacy, vendors and federal remediation plans. But the main product is the connective tissue: records that relate to one another, workflows that move work to the right person, and dashboards that update without a monthly scavenger hunt.
The spreadsheet won on flexibility
Chris Pantaenius and Chad Kreimendahl founded Onspring in 2010 around a stubborn observation. The people who know a business process often cannot change the software that runs it. They file a ticket, wait for a developer or bend the process around whatever the purchased system permits. A spreadsheet survives because its owner can alter it before lunch. Its weakness appears later, when permissions, version history, evidence and accountability matter.
Onspring tries to keep the first quality and repair the second. A trained administrator can create applications, fields, forms, surveys, formulas, permissions, notifications and multi-step workflows without writing code. Reports drill from a chart into its underlying records. A policy can connect to a control, which connects to a regulation, an audit finding, an owner and a remediation date. Change the control once and the effect becomes visible across the map.
This is where Onspring separates itself from a point solution. A vendor-risk product can run a questionnaire. An audit product can manage workpapers. Onspring's case is that the questionnaire response, the failed control, the policy exception and the audit finding should not become four versions of the same problem. Customers can buy products individually, then connect them on the shared platform as their program expands.
What changed the buyer's mind
For ATC, the proof was not a prettier risk matrix. It was reuse. The company extended Onspring into third- and fourth-party risk, corrective actions, enterprise risk, ticketing, supplier onboarding, contracts and incidents. When another team considered a separate tool, it found that Onspring could handle the job. ATC says avoiding that purchase saved hundreds of thousands of dollars. The exact subscription price remains private - Onspring sells quote-based annual and multi-year licenses shaped by users and selected products - so the honest cost story is comparative: subscription and administration on one side, additional software, integration and manual labor on the other.
“If you can get it down on paper, you can develop Onspring to be that solution and start scaling it to support all your business needs.”Benny Akowuah · ATC
Other customers tell variations of the same story. Signature Performance used ready-made applications to begin managing audits and evidence, then customized dashboards and workflows rather than rebuilding the underlying process. Express Employment International combined out-of-the-box structure with its own operational cybersecurity work. Tennessee Valley Authority moved NERC compliance out of spreadsheets and reported saving hours each day while reducing the chance of human error.
The copyable playbook is modest. Start with one workflow whose pain is visible. Keep the process owner close to configuration. Connect the evidence before adding more modules. Expand when a neighboring team can reuse records, controls or reports - not because a platform brochure says it can run everything. Train administrators as product owners, not merely form builders. Onspring reinforces that model with live training, certifications, a client community and recurring tutorial sessions.
Government is the trust test
GRC software stores the material companies least want scattered: weaknesses, failed controls, vulnerable vendors and unfinished fixes. Onspring maintains a SOC 2 Type II attestation and says its standard cloud delivered 99.99% uptime over the previous 12 months. In 2024, its GovCloud service earned FedRAMP Moderate authorization, now labeled FedRAMP Class C. That opened a demanding public-sector lane for OMB A-123 controls, NIST frameworks, CMMC work and Plans of Action and Milestones.
The authorization also sharpened Onspring's market position. It is not trying to outgeneralize ServiceNow or SAP across the whole enterprise. It competes more directly with GRC platforms such as Archer, LogicGate, MetricStream, AuditBoard, Diligent and Workiva, while arguing that configurability, speed and support matter more than sheer sprawl. Four Points Technology, Integration Technologies Group, iLAB and Carahsoft help federal buyers purchase GovCloud. Integrations with Microsoft 365, Slack, DocuSign and Jira meet users where the work already happens; Black Kite, BitSight, Mastercard, RapidRatings and SecurityScorecard add outside signals to vendor risk.
Those rankings come from user-review data, not a neutral laboratory trial, but the pattern is relevant. Onspring says it serves 250,000 users and renews 99.8% of customers annually. Capital IP noticed the economics. The technology-focused investor supplied strategic capital in 2023, citing profitable growth and efficient unit economics, then made an additional investment in 2025. Neither amount was disclosed. The company remains private and founder-led.
AI enters the room with a hall pass
Onspring's newest move is both fashionable and carefully fenced. Its AI began by helping users search records, summarize documents, draft policy language, detect duplicates and populate assessment fields. In July 2026, the company announced agentic functions that can take actions across the platform. The consequential detail is the boundary: administrators define the rules, choose where automation belongs and retain an auditable record of what happened.
That caution fits the buyer. A marketing agent can draft a clumsy post and annoy someone. A GRC agent can misclassify evidence, close the wrong finding or create a false impression of compliance. Onspring is selling governed action, not autonomy for its own sake. Its own survey of 126 GRC practitioners found enthusiasm for removing repetitive administration alongside concerns about trust, fragmented workflows and proof of value.
There are limits to the no-code idea, too. Flexibility rewards organizations with clear process owners and disciplined administrators. It is less persuasive when a team wants a rigid, prescriptive methodology, has no one to govern configuration, or needs deep functionality that only a specialist system provides. A platform can eliminate silos and still create a beautifully connected mess if nobody agrees on definitions, ownership or acceptable risk. Onspring does not make those decisions. It gives the people who must make them a better control surface.
That is the company's real place in the market. It sits between the spreadsheet's improvisation and the giant suite's gravity. The founders' bet is that risk work changes too quickly for hard-coded processes, but matters too much for loose files and inbox memory. ATC's expansion suggests the bet works when a first application earns trust, shared data makes the next use case cheaper, and the customer keeps enough governance to prevent freedom from becoming sprawl.
Follow the working product
Explore the platform, product updates and the public developer kit directly from Onspring.