Kanonik
Log inTalk to usStart your trial
Menu

Live assurance for people and agents.

Kanonik is security compliance software. It keeps every promise you've made to customers and auditors in one record, with its proof and approver. Questionnaires and audits run on it, so they stop holding up deals. And it warns you when a change puts a promise at risk.

See the full walkthrough

Kanonik maps your record to SOC 2, ISO/IEC 27001, HIPAA, GDPR and 12 more.

New Foresight

Test a change against your commitments before you make it. See how it works

A demo of Kanonik Foresight. In it a phone photographs page 4 of the Brookvale Backup contract. The photo goes to @Kanonik in the team chat with the question: We're moving backups to Brookvale. Does this break anything? Kanonik answers: Brookvale breaks 2 of your promises. Backups are kept for 30 days: Brookvale keeps them 14 days. Customer data stays in the EU: Brookvale stores it in the US. Dana Reyes signs off.
@KanonikWorks in Slack, Microsoft Teams and Claude

Do you encrypt backups?

Yes, approved by Dana Reyes on 12 Sep.

We're moving backups to Brookvale. Does this break anything?

Brookvale breaks 2 of your promises

  • Backups are kept for 30 daysBrookvale keeps them 14 days
  • Customer data stays in the EUBrookvale stores it in the US

Dana Reyes signs off

New

Kanonik Foresight

Test a change against your commitments before you make it.

It works in your team chat, and on customer calls in Microsoft Teams with Copilot.

Press the shutter to try it.

See how it works

Security answers for your whole team in real time.

Slack or Microsoft Teams available today.

Every answer comes straight from the record your security owner approved. When there's no approved answer, @Kanonik asks the owner instead of guessing.

Set up in an afternoon, not a project.

Each person signs in as themselves, so @Kanonik only shows what they're allowed to see, and every question and answer is on the record.

  • Ask

    For everyone on the team

    Ask a security question and get the approved answer, with who approved it and when.

  • Foresight

    For anyone planning a change

    Check a vendor change against your promises before you sign. See a vendor change

  • Author

    For the security team

    Your AI drafts policies, controls and answers. Kanonik checks each draft before anyone sees it.

  • Approve

    For the people who approve

    Approval requests arrive in the chat. You open your signed link, read, and approve. Approval itself never happens in a chat message.

@KanonikHarbor Ledger, a fictional company

Kanonik:

Hi, I'm Kanonik. I answer security questions about Harbor Ledger only from what its team approved. If nothing is approved yet, I ask the owner. I don't guess.

You: Do you encrypt backups?

Kanonik:

Approved answer

Yes. Nightly backups of the ledger database are encrypted with keys held in our cloud key service, and each backup is kept for 30 days.

Approved by Dana Reyes, 12 Sep 2026
Rests on Backup and recovery policy

Works in Slack, in Microsoft Teams and with Claude. Each person signs in as themselves.

Ask it yourself

@Kanonik also helps on customer calls in Microsoft Teams.

When a buyer asks a security question on the call, Copilot reads it from the transcript and asks Kanonik, and your rep sees the approved answer on screen. If the rep offers 60 days' notice where the approved answer says 30, the rep sees it and puts it right before the call ends. Kanonik never joins the call. Watch a sales call

Every answer you give a customer stays linked to the records behind it, and Kanonik tells you when one of them changes.

When a buyer asks where an answer came from, you can show them the policy and evidence behind it, and who on your team approved it.

Harbor Ledger, a sample company

  1. Your AI answers a buyer's questionnaire from your record.

    Brightwater Payments vendor security questionnaire

    Answer set14 answers: 10 from your record, 2 stated, 2 open

  2. Each answer shows where it comes from.

    Is multi-factor authentication required for administrator access?

    Yes

    Every admin sign-in requires a hardware security key.

    From your evidence

  3. You read the whole set and approve it once.

    I have read the 14 answers, including 2 stated and 2 open. They go to Brightwater Payments under my name.

    Approve

  4. It goes on the record under your name.

    Approved as one set. Recorded.

Most security promises get checked once, when you make them.

Meanwhile your company keeps changing. A team replaces its CRM vendor, or someone signs up for a new AI tool, and nobody goes back to see whether "customer data stays in the EU" is still true until a customer or an auditor asks.

If a policy behind an answer is revised, or the person who owns the answer leaves the company, Kanonik flags the answer for review.

ForesightForesight checks a vendor change before you make it. Tell your AI you're switching CRM vendors, and Foresight shows which of your promises the switch would break.

Harbor Ledger, a sample company

  1. You ask your AI once. It sets up a weekday routine in its own scheduler.

    You

    Keep our record current. Check the cloud, the repo, contracts and tickets every weekday morning.

    Your AI

    I loaded Kanonik's monitoring instructions and set a weekday routine in my own scheduler. I read your systems with my own read-only access.

  2. On Tuesday it finds a data store in your AWS account that isn't in your infrastructure code.

    kanonik search_estatenot on record
    kanonik propose_assetReporting replica
    kanonik commit_batch1 of 1 passed

  3. It waits in To decide. A person reads it and accepts it in Kanonik, not in the chat.

    Reporting replica, found by the weekday run

    SystemWaiting for you

    I have read this item.

    Accept

  4. Old evidence gets the same treatment. Kanonik keeps the new report's fingerprint and a link, and the file stays in Confluence.

    Ledger restore test report, September 2026

    EvidenceWaiting for you

  5. On Monday, one short brief.

    kanonik kanonik_get_weekly_digestlast 7 days
    Your AI

    1 new system and 1 evidence file came in. You accepted the system. The restore test report is waiting for you.

When your auditor sends the request list, you answer it from the same record.

Your policies, risks, vendors and controls are mapped to the frameworks you're audited against. Kanonik suggests the mappings and someone on your team confirms each one. Standing shows where you are on each framework, today or on any earlier date your auditor asks about.

Harbor Ledger, a sample company

  1. Standing shows where you are on each framework, using counts.

    As of: now

    FrameworkCoveredPartlyOpen
    NIST CSF 2.012921
    ISO/IEC 27001:2022181215
    SOC 29623

  2. Pick an earlier date to see the record as it was on that day.

    As of: 30 Jun 2026

    FrameworkCoveredPartlyOpen
    NIST CSF 2.04223
    ISO/IEC 27001:20229720
    SOC 25231

  3. At the end of June, fewer items were covered and more were open.

Nothing goes on the record until a person on your team approves it.

Before a draft from your AI reaches anyone on your team, Kanonik checks it against fixed rules, adds its own AI review where the work needs judgement, and sends anything that falls short back with the reasons. Whoever approves it is named on the record. Share an export with your auditor and they can check on their own computer that nothing changed after it was signed.

Watch an approval, step by step

Try it on your next security questionnaire.

Solo is $99 a month and starts with a 14-day trial.

Start your trial