01 · Traceable answers
Every answer shows its source
Ask in plain language. The answer cites the requirement, control, document and page behind each claim, and every citation opens the thing it points to.
- Each answer says how well it is grounded: Grounded, Partly grounded, or Not in the knowledge base.
- Claims about your organisation come only from your own records. Where they are silent, the answer says so.
- A citation that cannot be resolved is marked unverified, not quietly dropped.
Why it matters
Check any answer in one click, and show an auditor exactly where it came from.
For data at rest, yes on both counts. Your Data Protection Policy requires encryption for every production data store [1], which answers GDPR Art. 32. PCI DSS 3.5.1 asks more: stored card numbers must be unreadable, and your latest evidence does not cover the backup store [2].
6.2 Storage. Personal data and regulated data are stored only in approved systems. Every production data store is encrypted at rest using keys managed in the approved key service. Exceptions are recorded in the risk log.
02 · Expert room
A room of experts, not one chatbot
A GDPR Expert, a PCI DSS Expert, an ISO 27001 Expert, a NIST CSF Expert and a Compliance Advisor. Each is grounded in its framework, your evidence and your organisation's profile.
- The right expert takes the question, and can consult a colleague before it answers.
- You see both messages in the order they were written, with who led and who was consulted.
- Outside your records, web sources are limited to primary authorities.
Why it matters
A cross-framework question gets one joined-up reply, with who said what kept on the record.
5 experts in the room
Your risk assessment method already scores processing risks, so a DPIA can reuse it instead of starting again.
Art. 35 asks for an assessment before high-risk processing starts. You have one on file for the patient portal, and none yet for the new analytics service.
03 · Workflows
Cylanto Intelligence across compliance, governance and control workflows
The same intelligence runs through the work, from first document to final sign-off. Take an audit: framework evidence and documents are prepared as a report, approved internally, then sent to your auditor in the platform.
- Prepared. Every requirement appears with its finding and the evidence and documents behind it, in the framework's own words.
- Approved. A named person signs it off internally. If the facts have moved since the draft was prepared, it cannot be approved until it is brought up to date.
- With your auditor. They read the approved version in the platform, or download it as Word. A report approved on Tuesday still says on Friday what it said on Tuesday.
Why it matters
Understand what needs to change, why it matters, and what to do next—reducing manual analysis, improving control effectiveness and keeping the organisation continuously audit-ready.
04 · Evidence
Evidence to control mapping
Drop in a policy, a report, an export or a screenshot. You do not need to know which framework or control it is for: the platform works out what it proves and shows you where it landed.
- Each document is read three times and placed by majority, on every check it could answer.
- The set of documents on a check is judged together, so one or ten can answer it.
- Where the readings disagree, it asks you. Keep it, or take it off the check, in one click.
Why it matters
Stop sorting documents by hand. One upload lands everywhere it counts, and a person still makes the final call.
The platform placed it here. Is that right?