One control, linked to every clause it answers across 48 frameworks. The mapping is recorded and traceable, published as a crosswalk anyone can follow.

It is never applied automatically behind the scenes. Nothing discharges a clause on your behalf without that link being visible and checkable.

Clauses no control reaches are a first-class view, not a footnote you have to go looking for.

Four distinct kinds of absence are never merged into one green tick: not yet assessed, no control assigned, no evidence attached, not yet accepted. Silence is never reported as compliance.

Every acceptance carries a person, their role, the date and their statement, frozen at the moment it was made.

Validity is judged against who held that role at the time, not who holds it today. An acceptance is valid, void pending reaffirmation, or superseded, as at any date you ask.

An assessment records the exact framework version it was tested against.

A completed run cannot be edited. Run it again and you get a new record, never an overwrite of the old one. Your history stays exactly as it was made.

What binds you is your business, not a global vendor setting. You decide which frameworks apply to you and to what degree.

Coverage that no named person has accepted cannot move your reported position, no matter what the engine proposes.

A server-side accessible view needs no JavaScript to work.

The state is announced in text, never by colour alone, so it reads the same whether or not you can see the colour.

Sign-in, users and file access all run through your own Microsoft Entra. There is no separate account system to manage.

It reads documents and evidence in place, with your own signed-in permissions. If you can't see a source, neither can the tool, and it will not guess at what it cannot see.

Your data is isolated at the database itself, keyed to your tenant, not by the application remembering to filter it.

That isolation holds even if something above it goes wrong, because it is a property of the data layer, not a promise made in code.

We keep the framework corpus current, so you never have to track regulatory change yourself.

You choose when an update reaches your production, under your own change control. Nothing is pushed at you, and there is no third-party regulatory data feed to buy.

Hosted for you, on your own infrastructure, or as your own multi-tenant instance for your clients.

On the second and third, no vendor access path exists at all. The choice of where it runs is yours, not a licensing tier.

Locally hosted models. No paid AI service and no paid regulatory data feed.

Containerised on standard PostgreSQL, with no dependency on any cloud-provider-specific managed service. Plain, portable, and nothing metered behind your back.

48 frameworks are ready at launch, across two licence models: Basic and ISO Framework, covering the ground most organisations actually need. If yours needs a framework that isn't on the list, adding it is a matter of hours, not days.

Two more licence models are coming: Internal Audit, for running your own internal audits from the app and connecting to existing common controls or creating your own, and Enterprise, for managing complex regulatory requirements such as Bank of England and BaFin.