6clicks Due Diligence

Run due diligence on 6clicks: check compliance and get alerts when suppliers or ownership change.

Australia · owned by Independent (Australia) · 6clicks.com · 15 vendors

6clicks is a sovereign, AI-powered Governance, Risk, and Compliance (GRC) platform trusted by governments, defense agencies, regulators, and complex enterprises across 40+ countries. The platform delivers risk and compliance capabilities across restricted environments, regulated jurisdictions, and demanding operational conditions, with flexible deployment options including SaaS, sovereign cloud, and on-premises. It features an AI engine called Hailey AI and a Hub & Spoke architecture designed for federated agencies and multi-entity organizations.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-29 · revision 3

15 direct vendors, 239 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

6clicks exhibits very high migration readiness. Their tech stack is highly adaptable and modern, built on Microsoft Azure with capabilities for Sovereign Cloud, Self-Hosted, and GRC Appliance deployments, including air-gapped environments. This inherent flexibility and portability suggest a modular architecture conducive to migration, although explicit mention of containerization or microservices is not provided. The company's strong regulatory compliance (ISO 27001, SOC 2 Type 2) and proactive assessment of new regulations like NIS2 indicate a well-managed compliance posture that would facilitate migration efforts. Excellent data residency flexibility, allowing hosting in multiple countries and on request, significantly reduces migration complexity related to data sovereignty. Financially, their history of successful funding rounds suggests ample resources to fund and execute any necessary migrations. Furthermore, the low vendor lock-in risk, stemming from a diverse base of 16 vendors across 5 countries, minimizes potential dependencies and contractual hurdles during a migration. Overall, 6clicks' architectural flexibility, robust compliance, data residency options, financial stability, and low vendor lock-in position them exceptionally well for future migrations.

Compliance

9 in-scope frameworks identified; showing 3.

CPRA — No public evidence

6clicks has a US Government instance and hosts data in the United States, making it likely they process the personal information of California residents.

Evidence: https://securetechie.com/blog/ccpa-california-privacy-compliance/, https://oag.ca.gov/privacy/ccpa, https://securecontrolsframework.com/grc-fundamentals/common-cybersecurity-laws/ccpa-cpra-compliance-guidance, https://growjo.com/company/6clicks, https://www.6clicks.com/company/about-us, https://www.6clicks.com/plans

PIPEDA — No public evidence

6clicks hosts data in Canada, which means they are processing the personal information of Canadian residents and are subject to the Personal Information Protection and Electronic Documents Act.

Evidence: https://secureprivacy.ai/blog/what-is-pipeda, https://safetica.com/resources/blogs/pipeda-the-scope-purpose-and-how-to-comply, https://www.accountablehq.com/post/pipeda-personal-information-explained-with-real-world-scenarios, https://hyperproof.io/personal-information-protection-electronic-documents-act/, https://www.onetrust.com/blog/the-ultimate-guide-to-pipeda-compliance/, https://www.6clicks.com/resources/faqs

ISO 27001 (source) — Evidence found

As a global cybersecurity and GRC platform provider, ISO 27001 is a fundamental market requirement to demonstrate a commitment to information security best practices.

Evidence: https://www.6clicks.com/resources/faqs, https://www.6clicks.com/resources/blog/6clicks-announces-iso-27001-certification, https://www.6clicks.com/resources/trust, https://www.6clicks.com/resources/blog/the-first-2022-iso/iec-27001-certified-company-in-australia

Financials

Three-year financials

Financial Resilience Score: 5/10

6clicks is a mid-stage private Australian GRC scale-up with an estimated ~US$8.3M ARR (2025) and ~75-81 employees. The company has strong strategic backers including Centerstone Capital and OneVentures, and now Acorn Investment, with a fresh US$20M commitment announced in February 2026 to accelerate GCC expansion. Product differentiation via its unique 'Hub & Spoke' architecture is well suited to MSPs, advisers, and multi-entity governments, and the company operates in a growing AI/GRC market with reported growth of over 100% in some metrics. However, financial transparency is very limited - no audited statutory accounts are publicly available since the company appears to fall below Australia's 'large proprietary company' disclosure thresholds. Absolute scale (~US$8.3M ARR) is modest compared to well-funded competitors like Fortinet, OneTrust, MetricStream, and Reciprocity. The announced US$20M Middle East build-out is large relative to disclosed ARR and prior funding (US$10M Series A in 2022), creating meaningful execution and future fundraising risk. Overall resilience is moderate - backed by supportive investors and growth momentum, but constrained by small scale, limited capital, and opacity.

Key strengths: Strong institutional backers: Centerstone Capital, OneVentures, and Acorn Investment, Fresh US$20M investment commitment announced Feb 2026 for GCC expansion, Differentiated 'Hub & Spoke' GRC platform architecture suited to MSPs and multi-entity governments, Customer base spanning 40+ countries with growing AI/GRC market tailwinds, Reported growth of over 100% in some metrics

Risk factors: Very limited financial transparency - no audited statutory accounts publicly available, Small absolute scale (~US$8.3M ARR) vs. deep-pocketed competitors like Fortinet, OneTrust, MetricStream, Capital dependence - US$20M expansion is large relative to disclosed ARR and prior funding, Modest cumulative funding (US$10M disclosed Series A) may constrain scaling, Concentration risk in AI/GRC narrative as features are commoditised by larger horizontal players

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report