Answers auditors' questions on the status of security obligations with evidence, not assertions.
Developed in Germany · Hosted in the EU or on-premises
Delivered together with
Sovereign hosting in Germany, single-tenant from the first user.
Legal, tax and compliance expertise for legally sound deployment.
Advisory and implementation for the public sector, starting with the AI readiness assessment.
The evidence for an obligation is rarely in one place. The designated officer keeps the registration, the technical measure sits in the operations team's ticketing system, and the approval is in the minutes of executive management. For every audit question, someone pulls these three strands together by hand, and then does it all again at the next audit.
The two days of preparation per audit shrink to one, the five questions without evidence are known before the audit instead of turning up in the minutes afterwards, and the evidence effort falls by 50%.
The 50% reduction in evidence effort is this agent's headline figure. The number of obligations and the two days of preparation per audit reflect a typical process at an operator; they were not measured.
For every obligation, the agent brings the three strands together: registration, technical measure and the management resolution. It records the date and source of every piece of evidence.
26 obligations, 21 fully evidenced, as of 14 MayThe agent compares the entity's data with what was last reported. It lists every change to contacts, assets or services individually.
Registration of 8 November last year, 2 contact details out of dateThe agent bundles evidence, status and open points into one evidence pack per audit topic. The information security officer takes it into the audit.
nachweismappe_termin_mai.pdf, 26 obligations, 5 open pointsIt shows which evidence exists for it and which is missing. The information security officer makes the assessment, and responsibility stays with executive management.
It records which report went out when and what is still outstanding. Executive management submits the report itself.
It sees in the ticketing system that network segmentation was reported as completed on 3 March. Only the operations team's test shows whether it holds in the control system.
Connected systems
Operations
A pilot typically runs on your own data within 6 to 8 weeks. The agent connects to your existing systems rather than running as a separate, parallel environment.
EU cloud or private cloud. Processing is GDPR-compliant and models are never trained on your data. Details in the Trust Center.
It is based on experience from comparable projects and process benchmarks, not a commitment. We work out the realistic effect for your organisation during the assessment before the pilot.