Your company brain.
Built with you, owned by you.

use cases

Compliance, inline with the work.

Your own policies, applied as the work happens - a draft that breaks a rule flagged before it leaves, every obligation evidenced as it is met, and the exceptions, not a sample, put in front of a person.

“A customer sent a security questionnaire, and it took a week and four people to answer what we already knew.”

§ 01 Is this you?

Is this you?

  • A customer's security questionnaire stalls a deal while someone hunts for evidence you already had.
  • Compliance is a sample: a few files checked each quarter, and hope for the rest.
  • The policy says one thing and the team does another, and nobody finds out until the audit.
  • Nobody can say which AI tools the team uses, on what data, or under which policy.
  • A rule changes, and nobody can say quickly which of your existing duties it touches.

If two or more of these sound familiar, this is the use case to start with.

§ 02 Before and after

Before and after

today with a company brain
A draft goes out It is checked against policy only if someone thinks to, and usually after it has gone. It is read against your own policies as it is written, and anything that breaks one is flagged to its owner before it leaves.
A customer sends a questionnaire Someone spends a week finding answers and evidence the business already had. Each answer is drafted from your own policies and evidence, with its source, for the owner to check and sign.
A rule changes It lands in one inbox, and someone works out later, under pressure, what it means for you. It is read against the obligations you already carry, and each affected owner has an impact note before the rule is in force.
Checking that it holds A sample is reviewed each quarter, and the rest is assumed. Every obligation is evidenced as it is met, and the review is of what actually deviated.
§ 03 What you would see

Illustrative: the shape of what you would receive, not a client's record.

What you would see

exception flag

Proposal draft: a term your policy does not allow

what it saw
A client proposal offering unlimited liability, where your contracting policy sets a cap.
which rule
The contracting policy, liability section, owned by the head of legal.
recommends
Restore the standard cap, or ask the head of legal to approve an exception.
how sure
Sure of the conflict. Whether an exception is justified is the owner's call.
sources
The draft, the policy clause and past approved exceptions, each linked.

recommend flagged to the author and the policy owner before it is sent

questionnaire answers

Security questionnaire from a prospective customer

what it holds
A draft answer to each question, from your own policies, controls and evidence.
sources
Each answer linked to the policy or record it came from.
gaps
Four questions have no evidence on the record. They are marked for the owner, not guessed.
owners
Head of IT, with the head of compliance for the policy answers.

draft drafted, held for the owners to check and sign

AI use register

A new AI assistant in use in the finance team

what it saw
An AI assistant in regular use in the finance team that is not on the register.
what it touches
Customer invoices and payment data, which your AI policy limits to approved tools.
recommends
Review the tool with the finance director, then approve it on the register or move the work to an approved one.
owner
The person responsible for AI use, with the finance director.

recommend added to the register as unreviewed, owner told

Every output says what it saw, why it matters, what it recommends and how sure it is, and links each fact to its source.

§ 04 How it works

How it works

  1. 01 it notices Drafts, contracts, rule changes, control tests, questionnaires and the AI tools in use, where they already appear.
  2. 02 it connects Each one to the policies and obligations it touches, and each obligation to its owner, its controls and its evidence.
  3. 03 it judges Whether the work matches your own policies, what a change means for you, and whether the evidence that a control held is complete.
  4. 04 it checks Every action against your rules: who may see what, and what needs a signature before it leaves.
  5. 05 it acts Within the permission you have granted: it flags, recommends, drafts, or acts where you allow it.

It reads from your compliance tool, such as Vanta or Drata, your document and contract systems, and the places evidence is produced. It does not replace them, and nothing is migrated.

§ 05 What it runs on

The parts of a company brain compliance relies on, in the framework's own terms.

What it runs on

01The record
Every obligation, policy, control and piece of evidence, with a full history of what changed and when.
02Finding the answer
Each question answered with its sources, or a plain "I can't answer that well".
03The company manual
Your policies, what your terms mean and who owns each obligation, written by your people and approved by them.
04The way in for AI tools
How your people ask it from the AI assistant they already use, on the same permissions as everyone else.
05Connectors
Rule changes, contracts, control tests and audit requests, from sources someone accountable has named.
06Who may see and do what
Who may see each obligation and its evidence, checked before every answer and every release.
07Agents and actions
Drafting impact notes, evidence packs and exception flags, only through actions agreed in advance, each with a named owner.
08Where people use it
Where owners approve a pack, correct a mapping or sign an attestation.
09Testing it on your own questions
Tested against your own past information requests before it is trusted with new ones.
the company brain keeping it trustworthy, under all of it your systems documents email, calendar business systems your ai tools your people namedsources checked,then kept checkedfirst read in your terms a question,and its answer approvals acting, througha second door 05 connectors 01 the record 06 who may see and do what 02 finding the answer 03 the company manual 04 the way in for ai tools 08 where people use it 07 agents and actions 09 testing on your questions 10 keeping it running 11 keeping every brain current 12 before anythingis built
The twelve parts of a company brain, with the ones compliance runs on drawn in red. Read left to right: what comes in, what it knows, and who and what uses it.

what this shows about a company brain

It works through the AI tools you already use

Your people reach it from the assistant they already have, on the same permissions. They might ask:

“Can I use this AI tool on client data, and which policy says so?”

It compounds

The obligations, owners and controls it records are what supplier risk, operational resilience and management reporting read next, so each of those starts with the record already in place.

It is yours

The record, the rules and the permissions it builds belong to you, not to a vendor: handed over to your team or run for you. The same company brain runs every use case you add.

§ 06 You stay in control

You stay in control

  1. observeIt reads silently and measures its own accuracy against what really happened.
  2. recommendIt puts the case and a proposed action to a named owner.
  3. draftIt prepares the action, and holds it for a person to sign.
  4. actIt acts within the bounds you set, and logs everything it does.

Each permission is granted or withheld, taken back as easily as it was given, and expires unless someone renews it. Everything starts at observe, and a permission is granted on the measured record, never on a promise. Every action is checked against your rules before anything goes out.

Attestations, regulatory submissions and anything a regulator or customer sees stay behind a named person's signature, permanently if that is your policy.

§ 07 Where it starts

Where it starts

first scope
One policy set, one framework or one class of obligation: the duties that cost you most to evidence.
how it proves itself
It runs at observe against your own past requests and questionnaires first, so you see how it would have done before it is allowed to do anything.
what it connects to
The systems you already run: your compliance tool, policy library, contract repository, ticketing and the tools where evidence is produced. Connectors are built for you, as part of the work. How it connects.
what you own
You own the result: the obligations record, the rules, the permissions and the way it runs, handed over to your team or run for you.
§ 08 Questions

Questions

We already use Vanta or Drata. Why this?
Keep it. If you need a SOC 2 or ISO 27001 certificate, those tools are built for that, and the company brain reads from them. What they cannot see is the work itself: the proposal going out, the clause in a contract, the decision in an email. That is where your own policies are kept or broken, and that is where this works.
Why not an AI assistant over our policy documents?
An assistant can find a policy. This holds what each policy means, who owns it and what it applies to, checks the work against it, and keeps the evidence that it held, with permissions checked before every answer.
Which rules and frameworks does it cover?
Yours, and the frameworks you choose. A framework such as ISO 27001, Cyber Essentials, UK GDPR, the EU AI Act or ISO 42001 is a starting map: its requirements are matched against your existing policies and controls, the gaps are shown, and your owner confirms each mapping. It is not certification, and an independent auditor still audits.
Who can see what?
Only what each person is allowed to see. Permissions are checked before every answer, and every question is recorded.
Will it send anything to a regulator or a customer on its own?
No. Anything that leaves waits for a named owner to sign it, and you can keep it that way for good.
Where does our evidence live?
In your company brain, which you own, in your own environment rather than in a vendor's product. The way ours is governed, from the sources it admits to the permissions it checks, is on the page about how we run our own.
Is this available today?
It is built for each company that runs it, on that company's own brain, not installed off a shelf. The question audit comes first and shows what it would and would not do for you before anything is built.
§ 09 Start

Start

try this on your own record

Take three past requests: a customer questionnaire, an auditor's request, and one where the evidence could not be found. What did your own record hold, and when could you reach it?

Questions like this are what the question audit answers: about two hundred real questions from your business, each answered in writing, so you know what compliance on a company brain would and would not do for you before anything is built. It is a small fixed fee, credited against the build or the service if you go ahead.

book a discovery call → take the diagnostic · 10 min (opens in a new tab)