The Trousse globale de vérification (TGV) is the certification framework administered by the Bureau de certification et d'homologation of Quebec's Ministère de la Santé et des Services sociaux. It attests the conformity of technological products and services used in the health and social services network across four domains: security, personal information protection, performance and technology. It does not cover all Quebec government procurement.

What do OSFI guidelines B-10 and B-13 require?

The Office of the Superintendent of Financial Institutions regulates federally regulated financial institutions. Guideline B-10 requires an outsourcing risk management program covering due diligence, contract provisions, ongoing monitoring and concentration risk. Guideline B-13 sets expectations for technology and cyber risk management: governance, risk identification, protection, detection, response and recovery.

What are the CPCSC levels?

Level 1 of the Canadian Program for Cyber Security Certification is an annual self-assessment against 13 controls, confirmed in the supplier profile on CanadaBuys. Level 2 covers 98 controls and is verified by a third-party assessment organization accredited by the Standards Council of Canada. Level 3 covers 200 controls and is assessed directly by the Department of National Defence.

Compare · Enterprise GRC

Sentrix vs enterprise GRC platforms

Sentrix against ServiceNow GRC and Archer: a platform purpose-built for compliance versus enterprise platforms configured for compliance, as of July 2026.

Sentrix vs ServiceNow GRC and Archer: purpose-built for compliance vs configured for compliance.

ServiceNow GRC and Archer are two highly configurable enterprise platforms. ServiceNow was built as an IT service management system first; its GRC capabilities are genuine and deeply integrated with ITSM workflows. Archer is the GRC platform of record for large regulated institutions; its audit trail, workflow engine and third-party risk module are mature and battle-tested. Sentrix is built for compliance automation with frameworks that ship preconfigured; the difference lies in what each platform requires before it produces its first result.

What differs, as of July 2026

The table is limited to differences a buyer can verify. It reflects public information from July 2026; verify current capabilities with each vendor.

Criterion	Sentrix	ServiceNow GRC	Archer
Category	Compliance and risk platform, frameworks shipped preconfigured	Enterprise IT service management platform, GRC module integrated with ITSM workflows	Configurable enterprise GRC platform, on-premises heritage
Subscription scope	Compliance, third-party risk, policy management and license optimization in one subscription	Vendor Risk Management module; IT Asset Management as a separate module; see the public documentation	Dedicated third-party risk module; see the public documentation for module composition
SOC 2 and ISO 27001	Yes	Yes	Yes
Frameworks for Canada	Law 25, PIPEDA, CPCSC, TGV, OSFI B-10 and B-13, CAN/DGSI 104	See the public content library	See the public content library
Frameworks for the United States and Europe	SOC 2, HIPAA, PCI DSS, CMMC, NIST; GDPR, NIS2, DORA, TISAX	See the public content library	See the public content library
Interface languages	English and French	See the public documentation	See the public documentation
Data hosting	Compliance data hosted in Canada	See the public documentation	On-premises or air-gapped deployment possible; see the public documentation

The fundamental difference

A configurable enterprise platform can technically accommodate almost any framework. That is its strength, and also its cost: before it can support a compliance program, it requires a configuration phase, control mapping, and usually a certified implementation partner. Every framework update then becomes an internal maintenance obligation. For a large organization already equipped, with a dedicated GRC team and highly specific workflows, that investment is justified.

Sentrix takes the opposite path. Canadian frameworks (Law 25, CPCSC, TGV, OSFI guidelines), US frameworks (SOC 2, HIPAA, CMMC, NIST) and European frameworks (GDPR, NIS2, DORA) ship as frameworks maintained by our compliance team, mapped to controls and connected to automated evidence collection. Setup consists of connecting the tech stack and selecting frameworks; there is no framework development to run and no mandatory implementation partner. Customer success is included in the subscription.

Who each platform is built for

Choose Sentrix if…

You need compliance automation (SOC 2, ISO 27001, Law 25, GDPR, CPCSC) without a configuration phase or framework development
You are not already on the ServiceNow or Archer platform and do not plan to be
You need Canadian, US and European frameworks shipped preconfigured, with crosswalks between them
You want a self-guided implementation without a mandatory consulting engagement
You are a mid-market organization, or a large organization modernizing a legacy GRC program

Choose ServiceNow GRC if…

Your organization is already a large ServiceNow customer and wants GRC in the same platform
You have complex ITSM-to-GRC workflow integration requirements
You are a large enterprise with dedicated GRC staff and a ServiceNow implementation partner
Your primary use case is IT risk management integrated with change management and CMDB

Choose Archer if…

You are a large financial institution or regulated enterprise already operating Archer
You require on-premises or air-gapped deployment for classified-environment GRC
Your GRC program has highly specific custom workflow requirements that need deep platform configurability
You have an existing Archer investment and your use case is expanding within that ecosystem

Go further

Disclaimer: This comparison is based on publicly available information as of July 2026. Product features, pricing, and data residency options change - we recommend verifying current capabilities directly with each vendor. All product names, logos, and trademarks mentioned are the property of their respective owners. Use of competitor names is for descriptive comparison purposes only under nominative fair use.

See Sentrix on your real infrastructure.

30-minute demo. No slides. Your actual compliance posture.

Contact us

Frequently asked questions

What is TGV?: The Trousse globale de vérification (TGV) is the certification framework administered by the Bureau de certification et d'homologation of Quebec's Ministère de la Santé et des Services sociaux. It attests the conformity of technological products and services used in the health and social services network across four domains: security, personal information protection, performance and technology. It does not cover all Quebec government procurement.
What do OSFI guidelines B-10 and B-13 require?: The Office of the Superintendent of Financial Institutions regulates federally regulated financial institutions. Guideline B-10 requires an outsourcing risk management program covering due diligence, contract provisions, ongoing monitoring and concentration risk. Guideline B-13 sets expectations for technology and cyber risk management: governance, risk identification, protection, detection, response and recovery.
What are the CPCSC levels?: Level 1 of the Canadian Program for Cyber Security Certification is an annual self-assessment against 13 controls, confirmed in the supplier profile on CanadaBuys. Level 2 covers 98 controls and is verified by a third-party assessment organization accredited by the Standards Council of Canada. Level 3 covers 200 controls and is assessed directly by the Department of National Defence.

Related pages

Let's talk about your compliance program.

Contact us