Every framework, mapped for you
One control, one owner, one piece of evidence, counted wherever it applies.
Programme
A compliance programme that keeps up.
Without a bigger team.
NIS2, DORA, ISO 27001, GDPR and your customers’ requirements as one set of controls, owners and evidence. Your AI colleague maps every new framework, keeps the evidence current and prepares the board pack. Your people confirm, decide and sign.
CISO · Compliance · Board · From first certification to group-wide programmes
Every requirement, owned
Accountability sits with named people, entity by entity. Your AI colleague keeps them on schedule.
Every gap, caught early
Lapsed evidence comes back to its owner before an auditor finds it. Never a quiet green.
What your AI colleague takes on
Get compliant. Stay compliant. Prove it.
Without adding headcount.
01 · Scope
Know what applies.
State your country, sector and role. Proofbacked runs the rules that apply to you, and never someone else’s.
02 · Map
Drop a framework.
New regulations, guidelines or your own policy, read word for word and matched against what you already do.
03 · Own
Controls with names on them.
Every control and policy has an owner. Policies are accepted by the people they apply to, with a record.
04 · Run
The year, planned.
Reviews, training and tests on a cadence. When something lapses, it surfaces with a date and a next step.
05 · Report
The board sees the real state.
A board pack and a statement of applicability built from your data: met with evidence, open or missing, never a vanity score.
06 · Prove
Answer once. Show many times.
A trust page for customers, an auditor workspace and receipts that anyone can verify.
Works with what you have
- Fortnox
- Visma
- Microsoft 365
- Entra ID
- GitHub
- Jira
And more by country. Read-only where it reads; scope agreed for your environment.
Your AI colleague · Proofbacked Agent
Drop a framework.
See what it means for you.
Your AI colleague reads the regulation word for word, works out which duties apply to you and shows how much of it your existing work already covers. Your compliance lead confirms the matches.
EIOPA guidelines on outsourcing to cloud service providers.pdf
Our supervisor says we must follow these. What does it mean for us, and what have we already done?
✓ Read 1 document · source kept word for word · matched against your 6 rule sets, 61 controls and 64 suppliers
These guidelines bring 41 duties for an insurer. Most overlap the DORA work you already do. Only 5 are new.
Duties that apply41
Likely covered already27
Partly covered9
New for you5
Guideline 13 · stored word for word“The undertaking should notify the supervisory authority in a timely manner of planned cloud outsourcing arrangements of critical or important operational functions…”
Review the 41 matchesAdd as a rule setDraft tasks for the 5 new duties
Illustrative example · Matches go to your compliance lead to confirm. A rule set joins your plan only when someone with that authority accepts it.
See the work
An existing control. A proposed match.
Explore a fictional example. Open the sources, then try the human review step.
Illustrative example
New supplier framework
Prepared work
Ready for your review
Proposed links. Your review.
Compare new requirements with existing work before starting again.
Review owner · Procurement
What does this change for us?
Proposed links: awaiting your review
RequirementExisting workReview
Supplier registerConfirm match
Audit rightsReview wording
Exit planningNo evidence linkedCheck what exists
Your authorised reviewer confirms the matches.
Draft for review
Our policy requires annual reviews. The current review needs confirmation.
Compare new requirements with existing work before starting again.
Review owner · Compliance
Reuse existing work. Review the differences.
Your example decision
Explore compliance work Fictional sources · Interactive product illustration
One product · Every size
From a five‑person supplier
to a regulated group.
Same platform, same proof. What changes is how much it takes on for you.
Growing companiesEnterprise
How you startA baseline in about a working dayA baseline per legal entity
ProgrammeA security handbook, yearly reviews, a one-page continuity planAll policies with owners, quarterly risk, crisis room, group roll-up
CertificationAn optional certification trackAlways available, per entity
First scopeOne customer appendix or one defined scopeOne framework across entities
HelpAdd a vCISO when you need oneA named person from our team, and a vCISO if you want one
The same at every size
- A named person makes every decision
- A receipt for every decision
- Gaps stay gaps, never filled with prose
- Export everything and leave, any time
A few useful answers.
Is it for small companies or enterprises?
Both. A growing company gets a baseline in about a working day and an optional certification track; enterprises run every entity with mandates, crisis room and group roll-up. And if you need a security lead, add a vCISO.
Which frameworks are covered?
NIS2 (including Sweden’s Cybersäkerhetslagen), DORA, ISO 27001, GDPR, CRA, the AI Act and more, plus your own policies and your customers’ requirements as rule sets.
Are proposed matches automatically confirmed?
No. A proposed link is preparation for review. Coverage counts only once your authorised reviewer confirms the match.
Does “no evidence linked” mean the control is absent?
No. It means the comparison has not linked evidence yet. The reviewer checks what exists before drawing a conclusion.