AI does the drafting, your team does the deciding
Our assistant takes the tedious first pass on the work people review and sign off, grounded in your own data. It proposes; your team approves. No autonomous-agent claims, no decisions made without a human in the loop.
Practical assistance across the workflow
Six places the assistant removes busywork, each one a draft a person reviews before it counts.
Questionnaire drafting
Draft answers to DDQs and RFPs from your policies, evidence, and past responses; your reviewer edits and approves before anything is sent to a prospect.
Test-failure explanations
Turn a failing automated test into a plain-language explanation of what broke, why it matters for the control, and a concrete remediation step.
Policy-to-control mapping
Suggest which controls and requirements a policy or piece of evidence satisfies, so mapping is a review step instead of manual data entry.
Vendor document parsing
Extract the auditor's opinion, scope, and exceptions from a vendor's SOC 2 report to speed up third-party assessments.
Risk & executive summaries
Summarize posture, open findings, and what changed for leadership, without rebuilding a deck from scratch each quarter.
Evidence request drafting
Propose the evidence you need to collect for a control, ready to assign to an owner with a due date.
A propose-then-approve loop, every time
The same four steps run behind every AI feature. It is the difference between an assistant you can trust in a compliance program and a black box.
Retrieve
The assistant pulls the relevant slice of your own graph (policies, controls, evidence, past answers) so the draft is grounded in your reality, not the open web.
Propose
It produces a draft: an answer, a mapping, a remediation, a summary. Every draft is labelled as a proposal and shows what it was grounded in.
Review
A person on your team reads, edits, accepts, or rejects it. Nothing skips this step: the human is the decision-maker, the AI is the drafter.
Apply
Only after approval does the result become evidence, leave your workspace, or update a record. Actions are gated; there is no silent auto-apply.
AI for drafting. Not for deciding.
Our AI assists the work humans review and sign off. It proposes; your team approves. No autonomous claims, no black boxes.
- Draft evidence requests and remediation steps the moment a test starts failing.
- Suggest answers to security questionnaires grounded in your own documents, with citations.
- Summarize risk posture and what changed since last quarter for executive reporting.
- Map policies to controls and explain, in plain language, exactly why a test failed.
- Answer conversational questions across your own control, evidence, and policy graph (ChatGRC).
Yes. Data is encrypted in transit and at rest. The draft cites your encryption policy and the passing control that proves it, ready for your reviewer to approve.
Every suggestion is reviewed and approved by a person before it leaves your workspace.
Every answer is traceable to your data
A generic chatbot will confidently invent a control number. Ours retrieves from your own graph and shows its work, so a reviewer can verify a draft in seconds instead of distrusting all of them.
- Answers cite the policy, control, or evidence they came from, so you can trace every claim.
- The assistant reads your tenant only; it does not invent facts about your program.
- If the data to answer something does not exist, it says so instead of fabricating it.
- Drafts are versioned, so you can see what the AI proposed and what a human changed.
“Data at rest is encrypted using platform-managed keys across production stores.”
Grounded in: Encryption Policy v3
Backed by: test “Encryption at rest”, passing
Satisfies: CC6.1, ISO A.8.24
Built with a human in the loop
Human in the loop, always
Every suggestion is a draft a person reviews. We make no autonomous-agent claims and ship no action that mutates your systems without an explicit human gate.
Scoped to your tenant
The assistant (and the MCP server it powers) enforces the same org-scoping as the rest of the platform. One tenant's AI can never read another's data.
Clear on what's in progress
We describe capability and direction, not imaginary production agents or integrations that don't exist yet. If a feature is in progress, we say so.
The assistant, answered
No. The assistant drafts; your team decides. Every output (a questionnaire answer, a control mapping, a remediation, a summary) is a proposal a person reviews, edits, and approves before it is used. There is no mode where it silently changes your records or sends something on your behalf.
From your own data: the policies, controls, requirements, evidence, and past answers in your tenant. Retrieval happens over your graph, so drafts are grounded in what is actually true for your program, and each draft can cite the source it drew from.
It tells you. Rather than fabricating a plausible-sounding answer, the assistant flags that the supporting evidence is missing, which is itself useful, because it points to a gap worth closing.
We deliberately avoid that framing. Some competitors market self-driving agents; we ship propose-then-approve assistance. The AI can draft and surface, but applying anything to your systems is gated behind a human. This is a design choice, not a limitation we're hiding.
Yes, that's what the MCP server is for. Connect Claude, Cursor, or any MCP client to your tenant's compliance graph and work against it from your own editor, with the same tenant-scoping and review discipline.
Your compliance data is used to ground answers for your tenant, not to train a model shared with other customers. We treat your evidence as yours.
Bring your compliance data to your AI tools
Connect Claude, Cursor, and other MCP clients to your tenant's compliance graph, securely scoped to your org.