The Platform
One platform delivers solutions for three functional areas
Operate top-down, govern bottom-up, and know across both. They meet at controls and evidence.
Design what the organization should do, from its mission to the steps of daily work. Can be used on its own.
Requirements
From a template library, tailored to your mission and obligations.Policies
Drafted from requirements, with review, approval and publishing.Procedures and steps
The day-to-day layer people actually follow.Controls
Built into the step where the work happens.
Northwind Health · Procedure
Grant access to patient records
- 1. Request received from department head
- 2. Confirm role and need-to-know
- 3. Grant role-based accessControl C-12
- 4. Record approval with a reason
Show that the organization works the way it was designed to. Can start from the procedures you already have.
Risks
Recorded and linked to the requirements they threaten.Evidence
Belongs to the control that produces it. Flagged when it goes stale.Monitoring
Health dashboards, not just audit status.Audit
Scoped by framework. Findings flow back as controls.
Northwind Health · Evidence
Ask a question, get an answer from your approved policies and procedures, cited and scoped to the person asking.
Cited answers
Each answer names its source.Respects access
Only what the person may see.Local by default Coming soon
Designed to run on a local model inside your environment.Hosted only if you opt in
A hosted model is used for your organization only if your administrator chooses it. Your text is never used to train models.Says when a source is out of date Preview
An answer that rests on a document past its review date says so.
Who approves privileged access?
Source: Access Control Policy v4, section 5.
They meet at controls and evidence. Evidence is the record that the work happened as designed.
Start where you are
Adopt it in the order that fits
- 01
Operate first
Requirements, policies and procedures. No need for risk or audit.
- 02
Govern first
Bring your existing procedures, attach controls, then manage risk and audit.
- 03
Both
Every control traces from mission to evidence.
Where each piece stands
Live, in preview, and coming soon
Preview means built and tested, not yet proven on a customer’s live systems.
Live
Live- Requirements, policies, procedures, controls
- Risks, exceptions, findings, audits
- SOC 2, ISO 27001, HIPAA coverage
- Ask, search, summaries
Preview
Preview- 21 evidence connectors
- Single sign-on, passkeys, approvals
- Tamper-evident audit log
- Vendor access you approve
- Agents acting for a person, with a record of what they changed
- Collection agent for your own network
Coming soon
Soon- Questionnaire answering
- Trust Center
- Third-party risk
- Local-model deployment
- More frameworks
Ready to see it on your own organization?
We'll walk you through the platform end to end and show you what audit-ready-by-design looks like.