Agentic assurance platform

Assurance across
every jurisdiction
in which you operate.

Conscious identifies the control frameworks and privacy regimes that apply to each entity in a group and meets them with one library of controls, mapped to every framework. The AI proposes; a named person accepts, and the acceptance is recorded with that person’s name.

55 control frameworks · 34 privacy regimes · free assessment, no account required

  1. Domestic processing
  2. Permitted with safeguards
  3. Restricted by default
  4. 34 regimes · select a marker to view the regime

01 Jurisdiction

Worked example: a group consolidates payroll data in Riyadh from six subsidiaries.

Select a sending entity to view its transfer position. Each position is read from the regime pack, which records the instrument and the date on which it was last verified.

02 The platform

One control library,
mapped to every framework.

ObligationsEvidenceJudgementProof

  1. Home and the review queueReadiness by framework, the items that need attention and the work assigned to each person. Every proposal the AI drafts waits in one review queue with its sources, a confidence and the reason, until a named person accepts, edits or dismisses it.
  2. Frameworks and controlsEach requirement is met by controls from one library, and a framework’s readiness rolls up from them. A control counts as ready only when it is in scope, has current evidence or a passing reading, and is approved where approval is required.
  3. AssessmentsA formal, point-in-time sign-off against one framework. Its rows are pre-filled from the state of the controls, reviewed requirement by requirement, and locked on approval.
  4. RisksA register scored for inherent, residual and target risk, with treatment plans, key risk indicators and continuity plans held beside it.
  5. EvidenceDocuments, connector readings and imported email, each filed against the controls it supports, with an owner and a renewal date. Expired evidence does not count towards readiness.

Live console · demonstration workspace

The Conscious console: what requires a person today, the readiness score, and proposals from the evidence Framework readiness: each framework that binds the entity, with its readiness figure Assessments: each framework assessment with its readiness figure and approval status Risk register: risks scored, treated and re-scored by department Evidence register: documents, connector readings and attestations filed against controls

The programme, in four groups

  • ComplianceFrameworks, controls, evidence, policies and auditsPolicies move from draft to published with version history, and a material change asks staff to acknowledge them again. Audits hold the auditor’s requests, their threads and the evidence package.
  • RiskRisks, vendors, assets and incidentsVendors are tiered, reviewed and renewed. Assets include the AI systems the organisation operates. An incident links to the breach it became.
  • PrivacyData map, privacy assessments, subject requests and breachesEach law’s deadline is applied where the instrument sets one. Where it sets no verified deadline, the workspace sets its own target and the console shows it as the workspace’s, not the law’s.
  • TrustTrust centre and questionnairesA public page of the programme’s standing, with documents released on request. Questionnaire answers are drafted from an approved answer library and accepted by a person.

03 Agentic assurance

Each judgement is drafted by an agent, accepted by a named person and recorded in a hash-chained ledger.

The AI collects and analyses; a named person decides. Each proposal states what changes, its sources, a confidence and the reason, and a person accepts it, edits it before accepting, or dismisses it. The acceptance is recorded as that person, with the AI recorded as the source of the draft, in a single hash-chained audit log that also holds the policy each agent action was checked against.

Proposal · derived from evidence on fileNCA ECC-2:2024 · 1-5-1

Rate 1-5-1 Implemented

Based on the approved cybersecurity policy (v3.2, signed 14 August 2026), awareness acknowledgements from 214 of 231 staff, and the minute of the quarterly review. Each artefact the guidance requires is present.

  • Structure valid
  • Conclusive yes
  • Mapping equivalent
  • Complete 4 of 4
  • Verdict permitted
  • Recompute verified

Acceptance requires a named individual.

Audit log · hash-chained · verified on this page● chain intact

    Each entry commits to the entry before it. Altering any entry invalidates every subsequent entry.

    From an empty workspace to a first framework

    • Quick startThe profile is read, then confirmed.Conscious reads the organisation’s website and DNS records and proposes its industry, markets and service providers, each answer citing where it was read. A person confirms the profile once.
    • GenerationThe programme arrives as proposals.Policies as version 1.0 drafts, a seed risk register, vendors, processing activities, control owners and scope reach the review queue as proposals, never as records.
    • Review queueOne queue, decided by people.High-confidence proposals in one group may be accepted together. Medium- and low-confidence proposals are reviewed one at a time.
    • ConnectorsIdentity and cloud, connected with app credentials.Each connection signs in with an application’s own credentials, never a pasted short-lived token. Connector readings are proposals; people rate the controls.
    • EvidenceNo event is fabricated.The AI never drafts a board minute, test result, review record or attestation as evidence. A control is proposed as implemented only with linked evidence or a passing reading.
    • AccountabilitySome decisions stay with a person.Policy approval, access-review certification, the breach-notification decision and the management assertion are made by a person, and the console says which.

    04 Coverage

    Control frameworks and privacy regimes.

    Control frameworks55

    Privacy regimes34

    55control frameworks, national and international, each requirement mapped to controls from one library
    34privacy regimes, each with its own transfer posture, notification period and subject rights
    3,113assessment questions available in the free assessment

    05 Independent verification

    Regulators, auditors and customers verify the record without reliance on the vendor.

    Compliance evidence is examined by regulators, external auditors and customers’ security functions. Each is able to verify a Conscious record independently.

    • IsolationEnforced at the data layer.Tenant isolation is implemented as PostgreSQL row-level security on every table holding customer data, and is tested against the running system.
    • RecordHash-chained, with no deletion path.Each audit entry references the entry before it. Alteration or omission is detectable by the customer and its auditor without vendor involvement.
    • VerificationExecuted on the customer’s own instance.Six verification suites ship with the platform and run where the data resides: isolation, the end-to-end HTTP run, cold start, every link and button, the ECC engagement rehearsed end to end, and operational health.
    • AgentPermission-checked and labelled.Each agent tool is subject to a permission check. Draft categories are disabled until an administrator enables them, and every draft is labelled as such.
    • ContentLicensed text is not reproduced.A licensed requirement carries its reference number, a title written by Conscious and the controls that satisfy it, with a line crediting the publisher. Openly published texts are carried in full, including the Saudi NCA packs in the NCA’s own English and Arabic.
    • ProvenanceEvery fact records its source.Regime packs record the instrument and the date of verification. Each mapping states whether it was transcribed from the authority’s own published mapping or authored and dated by Conscious.

    Free assessment · no account required

    Establish which obligations apply to your organisation.

    Three steps identify each framework and regime that binds your organisation, with the reason for each. A readiness assessment is then available against any of them, written as an assessor would ask. Obligations are held as data; a regulation outside the catalogue is ingested from the published instrument.

    The full list of assessments is also available.