Export what you already have
Run the Shadow AI report in Defender, Netskope, Zscaler, or whichever CASB you already own, and export it. That report exists in most organisations before they ever talk to us.
Govern™
Obligations. Mapped. Owned. Evidenced.
A determination is true on the day it is made. Govern is where it stays true — every duty with a named owner, a date, and the evidence attached to it. Bring your own Shadow AI export; there is nothing to connect.
Govern™ Tracking
From $149 / month per deployment
Priced by
How much regulatory surface there is to watch
Or standalone
Track chosen instruments without a determination
The day after you file
The document was the easy part.
What an inquiry actually tests is not whether you produced an assessment. It is whether the organisation did the things the assessment said it would.
01
Every obligation has a person's name on it
Not a department. A department cannot be asked what it decided, and cannot answer when the review began.
02
Every obligation has a date
When it attaches, when the evidence is due, and how long that evidence has to be kept — as a number of days, taken from the provision that requires it.
03
Evidence lives next to the duty
Not in a drive somebody has to remember. The record and the requirement are the same object.
04
One definition of a material change
The signal that says your assessment may need re-running is the same one that sizes what you pay to track it — and the definition comes from Colorado Rule 8.05(D)(1) and California § 7155(a)(3) rather than from us. Two systems watching for the same event would eventually disagree about whether it happened.
05
Change arrives as a diff, not as a newsletter
When a provision behind one of your obligations moves, you are shown which of your documents depended on it — the specific citation and the specific document, not a headline about the law.
06
What was assessed and dismissed is kept too
The decision not to act is a decision. Undocumented, it is indistinguishable from not having noticed.
How your tools get in
We never connect to your systems.
There is no agent to install, no credentials to hand over, and no integration for your security team to review. You already run the discovery tool. You bring us its output.
Drop the file in
The export becomes your tool inventory in Govern. What arrives is a list of the AI capabilities actually in use — which is almost always longer than the list anybody was maintaining by hand.
Run determinations from the list
Pick a tool off that inventory and run a Compass report against it. The list is the queue, so the work is visible: what has been assessed, what has not, and in what order.
Why it works this way. An integration is a project — a security review, a set of credentials, a standing permission into your estate, and a reason for the whole thing to stall before it starts. A file you already know how to produce is not.
And back out again
Your obligations, in your GRC tool.
The same door in both directions. Every Compass report exports as a GRC-compatible package — CSV and JSON — that loads into Jira, ServiceNow, or whatever your programme already runs on.
One row per obligation, carrying the statutory citation it was determined from, the jurisdiction, the severity, the owner role it should land on, and whether it binds near-term or continuously. Evidence rows join on the same obligation key, so the duty and the proof stay attached to each other after they leave us.
Govern™ Tracking
One fee for watching, priced by how much there is to watch.
Management and monitoring used to bill as two lines. They are one now, scaled to the regulatory surface of the deployment rather than to a flat per-seat or per-tool number.
From a determination
Your Compass™ report already resolved the instruments and the jurisdictions, so the rate comes out of the determination rather than out of a second questionnaire. Year one bundles creation and tracking into one figure; month thirteen steps down to tracking alone.
Without one
Select instruments from our catalogue and be told when they change — no determination required. To be exact about what that is: we track the laws you have told us apply. Establishing which laws actually apply to a deployment is a determination, and that is a different product.
What fires a notification. A tracked instrument changing — a citation renumbered, a status moving from draft to active, a commencement date shifting, a new obligation added. Not every edit is worth an alert, so changes are triaged by whether they alter what is covered, when it applies, or what is required. We detect regulatory change; a change to your deployment is something you tell us.
See it against your own inventory
Bring one real deployment.
A walkthrough on a hypothetical is a demo. A walkthrough on a tool you actually run is a decision. Bring the second one.