Automated compliance leaves you a green tile nobody can explain¶
Most first audits turn on one question, asked about an item on a dashboard: "how did this get here?" Too often the answer is silence.
That silence is what "automated compliance" produces. The platform collected something and ran it through a rule. Then it turned a tile green. The customer never saw the rule. The vendor's support team can maybe find the log. All the auditor can write down is a screenshot. They move on to the next item with a little less confidence in everything else.
Compliance work can't be automated in the sense the word is sold. Someone has to decide what a control means in your environment and whether the evidence supports it. They also have to judge whether the risk you're accepting is one you understand. What can be built is a system that records every one of those decisions well enough for a stranger to check it later. That is a different product, and it is the one we built.
Kanonik is security compliance software. It keeps every promise you've made to customers and auditors in one record. Each promise carries its proof and its approver. Questionnaires and audits run on it, so they stop holding up deals. And it warns you when a change puts a promise at risk.
What proof looks like, step by step¶
Start with a change to your compliance record: a new control, a mapping to a requirement, a risk acceptance, a policy revision. In Kanonik that change begins as a draft from your own AI, working from what you actually run.
Before it can land, the Verifier on Kanonik's servers checks it. Fixed rules run first: does the control cite a requirement that exists, is the placeholder text gone, does the workspace match. For the kinds of record where judgment is involved, Kanonik's own model reads it too, on its own account, separate from the model that drafted it. The verdict and the reasons are recorded whether the draft passes or fails.
Then a person on your team approves it. The approval request can arrive in chat, but the approval itself happens in the Kanonik web app, through a signed link that works once, for the person signed in. The name of the person who approved is on the record. Nothing your AI drafts goes into the record without that approval.
Every one of those events, the draft, the verdict, the approval, the write, goes onto your workspace's log, where each entry carries the hash of the one before it. The head of the chain is signed, and the verification key ships with the export. Change one byte of history and the chain stops verifying.
The part that matters to an auditor¶
A signed log inside a vendor's product is still the vendor's word. So we ship the checker.
Your Auditor Export is a bundle: the records, the events, the verdicts, the approvals, and a report. Alongside it is a checker that runs entirely in a browser. No install, no upload, no network connection. It recomputes the hashes, checks the chain, and validates the signature against the published key, on the auditor's own laptop. They can see for themselves that the record is intact, without asking us.
That changes the audit conversation. "How did this get here?" now has a real answer instead of a screenshot: a draft with a timestamp, a verdict with its reasons, a named person who approved it, and a chain that shows none of it was edited afterwards.
The same record answers your customers¶
A record built this way does more than get you through an audit. When a customer sends a security questionnaire, the answers come from the approved record, each with its source and approver. When someone on your team asks their connected AI, they get the same approved answer, with who approved it and when. And when a change is coming, Foresight reads the record and says which promises the change would break, before anyone ships it. People ask in chat, but the approval itself happens on the record, by a named person.
What you get, and what it costs¶
Your team still makes the real decisions, and every one of them is on the record, checked and signed, for anyone who wasn't in the room. Starter is $3,000 a year or $300 a month, and starts with a 14-day trial (card required, one trial per organization). Audit-Ready is $6,000 a year with one audited framework of your choice: SOC 2, ISO 27001 or HIPAA. Enterprise starts at $18,000 a year. Another audited framework is $3,000 a year. Users are unlimited, and the plans as listed are for organizations up to 200 people. Your compliance work runs on the AI you already pay for, so we don't charge you for one. No per-user fees, no per-questionnaire fees. Your own AI subscription is separate. Private deployment is offered on Enterprise; talk to us.
Kanonik is security compliance software: one record for your questionnaires, audits and live assurance. Try the checker at kanonik.ai/verify, then start your 14-day trial.