“Approve Polarlink.”
I can’t approve suppliers. Ingrid holds that mandate. Shall I open the decision for her?
We’re out of stealth · See it work →The compliance team you need.
Compliance has a proof problem.
The compliance team you need.
Without hiring one.
AI does the compliance work. A named person makes every decision, and every decision is proven.
One platform for your customers and your suppliers.
For anyone whose decisions can be questioned: by a regulator, a customer, an auditor or the board.
See it work · 1:20
Compliance is decisions.
Watch the AI prepare them.
It reads every supplier, contract and certificate, shows what each answer rests on, and stops where your judgment starts. You decide, and every decision is proven.
Compliance kept AI out, for good reason
The AI that refuses to guess.
So we built one that never decides for you. It prepares, asks and follows up. It never approves, seals or signs. Reading, comparing, drafting and chasing are its job. Approvals, tiers, seals and anything sent outside Proofbacked stay with a named person, enforced in the product, not left to a prompt.
“Set Ravnsund Cloud as non-critical.”
That’s a decision for the domain owner. I’ve prepared the options and the sources.
“Send this to the supplier.”
Here is the draft. It waits in the queue until someone with authority sends it.
“Does Polarlink keep data in the EEA?”
Their statement says yes, the audit report says no. I won’t guess. I’ve put both in front of Ingrid.
Know. Decide. Prove.
Two years later, someone asks why.
You just show them.
Who decided, under which mandate, on what evidence, and that nothing has changed since. Every decision becomes a receipt. It is tamper-evident, and anyone you share it with can verify it. No account needed.
Receipt · illustrative
SealedRequest clarification
- Receipt
- PB-2026-001234
- Decided by
- Head of Procurement · Procurement policy §4.2
- Evidence
- [01] Supplier statement · [02] Audit report
- Reason
- Statement and audit disagree on subcontractors.
- Signed
- 2026-10-16 09:42 UTC
Tamper-evident record · not an audit opinion or certificate
Know which suppliers need you.
Every supplier read and tiered by what it touches. Three things to judge, not forty.
Explore Third-PartyAnswer customers from verified facts.
Questionnaires drafted with their sources and approved by a named person before anything is sent.
Explore customer responsesOne way of working, every framework.
NIS2, DORA, ISO 27001 and your customers’ demands. Do the work once; it counts everywhere.
Explore ProgrammeThird-party risk, seen from every seat
One supplier. Seven functions.
Seven different pictures of the risk.
Every supplier relationship runs through seven functions, and each one sees a different part of it. Nobody holds the whole picture.
SeesCannot answer alone
LegalContracts and DPAsAre the clauses we signed being kept?
ProcurementPrice, onboarding, tier 1Who are our suppliers’ suppliers?
IT securityAccess, alerts, integrationsWhich vendors are critical to the business?
Product developmentLibraries, APIs, modelsAre our dependencies in the register at all?
SalesCustomers’ questionnairesWhere is our own evidence, and is it current?
Management and boardSummariesWho decided what, on which evidence?
CISOPolicy and a sampleWhat about the suppliers nobody reviewed?
One set of facts.
Every function reads the same supplier facts, from the same sources.
Each seat decides its part.
Legal, security, procurement and the business each own their decisions, by name.
One record for the board.
Who decided what, on which evidence, and when it must be looked at again.
Reads everything. Connects everything. Drafts everything.
Supplier reviews, framework mappings and customer questionnaires: read, compared and drafted by your AI colleague.
Grow without growing the team.
One AI colleague takes on the reading, comparing, drafting and chasing a compliance team would.
Every decision, proven.
Lapsed evidence comes back to its owner. Every decision has a named person and a receipt.
Built for the rules you answer to
- DORA
- NIS2
- ISO 27001
- GDPR
- CRA
- AI Act
- Customer requirements
Two products · One shared foundation
Start with suppliers.
Or with your whole programme.
Third-Party
Know your customers and your suppliers. Own every decision.
300 suppliers, one click. Every answer cross-checked against contracts and policies.
- Enterprise
- Critical suppliers, named decision-makers, exit plans and your DORA register of information, from the same data.
- Growing companies
- Answer your customers’ supplier questions once, and show the proof behind every answer.
Programme
Get compliant. Stay compliant.
New rule? Drop it in and see what’s already covered. Do it once, it counts everywhere.
- Enterprise
- NIS2, DORA, ISO 27001 and more as one set of controls, owners and evidence, entity by entity.
- Growing companies
- Know what ISO 27001 or NIS2 asks of you, close the gaps and answer customer appendices fast.
A colleague for every team.
Without new hires.
Sales, Procurement, Security and Compliance get the groundwork done. Each team keeps its own decisions.
Sales
The pain
Chasing answers across teams.
With your AI colleague
Your AI colleague drafts the answers from your policies and evidence. Sales confirms the claims and closes.
Explore the work
Procurement
The pain
Chasing supplier evidence.
With your AI colleague
Your AI colleague reads the contracts, drafts the questions and chases the gaps. You decide.
Explore the work
Security
The pain
Rechecking controls for every request.
With your AI colleague
Your AI colleague checks each request against the controls you already have. You confirm the matches.
Explore the work
Compliance
The pain
A new framework. Another mapping exercise.
With your AI colleague
Your AI colleague maps the new framework onto your existing work and flags what is new. You decide what applies.
Explore the workWatch your AI colleague work.
Contract reviews, sourced answers and framework checks, done before you open them. You decide.
Illustrative example
Contract review, prepared.
Prepared work
- Notice period
- 90 days’ written notice
- Renewal date
- 30 June 2027
- Audit rights
- Scope needs review
Ready for your review
The key terms are ready for review.
Notice periods, renewal dates and audit terms are pulled into the review, with the source attached. You check the terms and make the decision.
Review owner · Procurement
What does this change for us?
Proposed links: awaiting your review
RequirementExisting workReview
Supplier registerConfirm match
Audit rightsReview wording
Exit planningNo evidence linkedCheck what exists
Your authorised reviewer confirms the matches.
Draft for review
Our policy requires annual reviews. The current review needs confirmation.
Notice periods, renewal dates and audit terms are pulled into the review, with the source attached. You check the terms and make the decision.
Review owner · Procurement
The preparation is done. The judgment is yours.
Your example decision
Explore supplier reviews Fictional sources · Interactive product illustration
Your AI colleague · Proofbacked Agent
Drop a framework.
See what it means for you.
Your AI colleague reads the regulation word for word, works out which duties apply to you and shows how much of it your existing work already covers. Your compliance lead confirms the matches.
EIOPA guidelines on outsourcing to cloud service providers.pdf
Our supervisor says we must follow these. What does it mean for us, and what have we already done?
✓ Read 1 document · source kept word for word · matched against your 6 rule sets, 61 controls and 64 suppliers
These guidelines bring 41 duties for an insurer. Most overlap the DORA work you already do. Only 5 are new.
Duties that apply41
Likely covered already27
Partly covered9
New for you5
Guideline 13 · stored word for word“The undertaking should notify the supervisory authority in a timely manner of planned cloud outsourcing arrangements of critical or important operational functions…”
Review the 41 matchesAdd as a rule setDraft tasks for the 5 new duties
Illustrative example · Matches go to your compliance lead to confirm. A rule set joins your plan only when someone with that authority accepts it.
The people behind it
Built by people who have
had to answer for the decision.
We have reconstructed decisions after something went wrong, run security for global companies and sold to the teams who carry the risk. Proofbacked is what we wished we had.
Christer HernestigChief Commercial Officer
Leon EckervallChief Executive Officer
Jarkko RautulaChief Information Security Officer