Coverage is enforced by the build: every action must map to a control, so the evidence base grows as capabilities ship.
- SOC 2, ISO 27001, GDPR, HIPAAReadiness and evidence reports generated per framework from live activity.
- Philippines Data Privacy Act, Singapore PDPAThe same mechanism, for the APAC data-protection frameworks.
- EU AI Act, ISO 42001, OWASP for agentic appsEvidenced by the agent-identity layer and the AI governance registers below.
SatisfiedAt least one audit entry in the period counts toward it: the act succeeded, or the act is itself a refusal. A control refusing something is evidence it works.
At least one audit entry in the period counts toward it: the act succeeded, or the act is itself a refusal. A control refusing something is evidence it works.
AttestedA person has signed that the control is met by means the platform cannot see. Shown apart from satisfied, never as satisfied.
A person has signed that the control is met by means the platform cannot see. Shown apart from satisfied, never as satisfied.
- Not applicableThe control asks about a population you do not have. Left out of the score.
- GapNone of the above, with how it closes: in the platform, or by attestation.
Readiness is satisfied plus attested, over the controls that apply. The audit log and its verification are on every plan; the per-framework readiness dashboards and the evidence export are part of the Enterprise plan.
Some controls are met outside the platform: AI literacy training, data governance done elsewhere.
What an attestation holdsA statement of how the control is met, an owner who is an active member, evidence links, and a review date within the next year.
A statement of how the control is met, an owner who is an active member, evidence links, and a review date within the next year.
- How long it countsUntil its review date. After that it lapses and the gap shows again.
Renewing and revokingAttesting again replaces it, and the control stays attested throughout. Revoking keeps the record and shows the gap.
Attesting again replaces it, and the control stays attested throughout. Revoking keeps the record and shows the gap.
- Who can attestOnly people, with the compliance permission. Never an agent or an API key.
The platform records, governs and audits these judgements. It does not make them: it runs no model of its own, so whether a use is fair or safe is your organization's call.
Inventory profileWhat each agent is, and who answers for it.
Evidence forEU AI Act Art 26
Impact assessmentIts risks and the decision to run it, signed off by a second person, with a review date.
Evidence forEU AI Act Art 27, ISO/IEC 42001
Transparency disclosureWhat its users are told, where and in which language. Versioned; the approver signs the exact content they read.
What its users are told, where and in which language. Versioned; the approver signs the exact content they read.
Evidence forEU AI Act Art 50
EvaluationA passing evaluation for every high-risk agent within the last 90 days.
Evidence forEU AI Act Art 15
IncidentA serious incident's report, tracked against its due date.
Evidence forEU AI Act Art 73
Writing and deciding are for people only: an agent's token is refused, whatever it holds. A draft is written by one person and put in force by another, and the author is refused.
GDPR and APAC data-protection rights, as endpoints and as a self-service tab in the app.
- Access and portabilityA person can export everything held about them, immediately, with only their own token.
RequestsData-subject requests are filed, queued and decided by people with the compliance permission, with a record of each step.
Data-subject requests are filed, queued and decided by people with the compliance permission, with a record of each step.
ConsentPer-purpose consent, granted and withdrawn by the person, with an append-only history sealed into the audit log. An agent or an API key is refused.
Per-purpose consent, granted and withdrawn by the person, with an append-only history sealed into the audit log. An agent or an API key is refused.
RetentionDeclare how long each governed data class is kept. The tamper-evident audit log is exempt and never purged.
Declare how long each governed data class is kept. The tamper-evident audit log is exempt and never purged.
Governance records for the frameworks that ask for a running management system. Both are Enterprise-plan capabilities.
ISO 27001 ISMSA risk register scored by likelihood and impact, policies that members read and acknowledge, assets, and the records that evidence a running management system. Every change is audited and mapped to ISO 27001 controls.
A risk register scored by likelihood and impact, policies that members read and acknowledge, assets, and the records that evidence a running management system. Every change is audited and mapped to ISO 27001 controls.
HIPAA registersPHI access logging, with the purpose and the type of access, and the registers a covered entity keeps. No PHI is stored: only opaque tenant-side identifiers.
PHI access logging, with the purpose and the type of access, and the registers a covered entity keeps. No PHI is stored: only opaque tenant-side identifiers.