Connector Agent
Runs on every scan. Turns posture signals from your stack into control-level evidence, with the whole scan wrapped in a trace.
Agentic AI
Agents that do the work, and still ask permission.
Six specialised agents watch for change, keep compliance status current and propose fixes. Every step is traced, and how much they may change without you is a setting you control.
The roster
Six agents, each with one job.
Each agent has a defined trigger and a defined scope. What each one runs on and what it may do is rendered from the live registry, so the description cannot drift away from the behaviour.
Risk Scorer
Runs on every scan that found assets. Scores them against a rule library first and a model only for what the rules do not match. It never downgrades a risk on its own.
Internal Auditor
Runs on every scan and every evidence upload. Recalculates coverage per requirement, writes effectiveness onto controls and credits the equivalent controls in other frameworks.
Policy Drafter
Runs whenever a gap is detected. Files a draft policy for review — drafts never publish themselves, at any autonomy setting.
Document Reviewer
Runs when you ask. A three-pass review of a document against the requirement it is meant to satisfy, returning a score and the reasons behind it.
Compliance Calendar
Runs daily. Reports what has expired, what expires within 30 days, what has gone stale and which reviews are due.
The human gate
You decide how much they may change.
One setting, owned by your admins, governs every agent and every kind of change.
Observe
Agents run and record what they saw, and change nothing at all. The traces are there to be read before you trust anything.
Propose
The default. Every change queues as a proposal with its confidence and rationale, and waits for a person to accept or dismiss it.
Auto-apply
High-confidence changes apply immediately with an undo snapshot; everything else still proposes. Critical risks always wait for a human.
Draft policies are excluded from auto-apply at every setting, and a critical risk always waits for a person.
Traceability
Every run shows its working.
Each run records what triggered it, what it observed, how it reasoned, what it did and what it wrote — streamed live as it happens, and readable afterwards.
TriggerEvidence uploaded — access review Q3
Observe3 valid evidence items against the requirement
ReasonCoverage threshold met — requirement passes
ActEffectiveness written to 2 controls
RecordCrosswalk credit applied to the mapped ISO 27001 control
What they will not do
The boring guarantees that actually matter.
No invented activity
An activity record exists only if an agent actually did the thing it describes. There is no synthetic history and no demo filler.
No pretending to think
If no model is reachable, agents complete in rules mode and say so, or write nothing. They never present a fallback as AI analysis.
No overwriting your judgement
An assessment a person made is never overwritten by an agent. Human decisions win.
No re-litigating
A proposal you dismissed is not raised again, and your recent decisions are fed back into how the agents reason.
How it works
From signup to audit-ready in seven days.
Months of compliance consulting replaced by three steps and a team of agents working alongside your own.
01Day 1
Connect your stack
Integrations across source control, model registries, cloud ML platforms, data warehouses and ticketing. AI systems, models and datasets are discovered rather than typed in.
You receive
- Prebuilt connectors
- Assets discovered automatically
- No manual inventory
02Days 2 to 5
Let the agents work
Agents draft policies, map controls, turn scans into evidence and surface gaps as they appear. You review, approve and publish; they do the typing.
You receive
- Policies drafted per framework
- Evidence linked to controls
- Proposals with rationale
03Day 6 onward
Pass the audit
Run a full audit simulation before the auditor arrives: a scored report, a gap remediation plan and an evidence pack ready to hand over.
You receive
- Audit simulation with scoring
- Gap remediation tasks
- Auditor-ready evidence pack
Next / evaluate the platform
Bring your frameworks.
See the operating system.
We will walk through the platform against your own governance and compliance needs, and what getting to audit-ready would take.