Help center¶

Ask the assistant, browse the guides, or email a person who works on the product.

Get an answer right now¶

If the assistant does not load, the guides below cover the same ground, and [email protected] always works.

Getting started¶

Getting started with Kanonik ¶

What Kanonik is, how a change your AI drafts gets checked and approved before it goes on your record, and what to do first.

Signing up and your trial ¶

What the sign-up page asks for, when your card is charged, and what happens once your workspace is created.

Connecting your AI ¶

How to connect Claude Code, Claude Desktop, or any MCP-capable client to your workspace, and what happens once you do.

Your first job, step by step ¶

From a connected AI to your first approved record, in five steps, with what you see on screen at each one.

Navigating your workspace ¶

The dashboard is where you see what your AI did and approve what needs you. Here is what each item in the left-hand menu is for.

How your next step is recommended ¶

Where the recommended next step and suggested prompts come from: fixed rules over your own recorded data, with no model call involved.

Working with your AI¶

How risk discovery works ¶

How your AI helps you find, score, and treat your risks: assets and vendors first, then risks, then gaps, then controls.

Revising a draft before you approve ¶

How the back-and-forth works: every revision is re-checked, and you only ever approve a version checked in the exact state it lands.

Closing the loop on a change ¶

Why a change is not done until it is connected, and how Kanonik surfaces the missing next step in the moment.

Keeping your compliance current ¶

How to amend risks, controls, and policies over time, how often to review, and what continuous evidence means for SOC 2 Type 2.

Approvals and the record¶

Why you approve every change ¶

The approval gate and your role: nothing your AI drafts reaches your record without an approval from a signed-in person's account, that recorded approval is what makes the record defensible, and the few things saved without an approval are listed.

Deciding on an approval request, item by item ¶

Work your AI submits together arrives as one request. You decide on each item, and the request lands on your last decision.

How confidence scoring works ¶

What the confidence score is made of, how it decides quick approval versus review versus rejected, and how to set the scrutiny.

When you and the safety check disagree ¶

You have the final say. How a reasoned, acknowledged override becomes a permanent, defensible part of your record.

Foresight: checking a change against your promises ¶

Before you swap a vendor, ask your AI to check the change against what you have promised customers: the four results, the dates it assumes, and what it does not check.

Getting approval notices in Slack ¶

How to get a notice in Slack when an approval request is waiting, what the notice shows, and how to test or disconnect it.

Asking your record a question ¶

Ask your connected AI what your company has approved, what is waiting for you, or whether a change breaks a promise, and have it search your approved record for the answer.

Frameworks and audits¶

Proving your controls cover your requirements ¶

Why declaring a control's requirements is not proof, why you approve each connection, and how to read the coverage states.

Where you stand ¶

How to read the Where you stand screen, what each count means, and how to close what is open.

Working to more than one framework ¶

How one program serves several frameworks, why one control usually satisfies many, and why nothing is credited without your approval.

Framework licences ¶

Why a copyrighted framework needs your licence on record, how to record it in Settings, and what adding a framework costs.

Your program as it stood on any date ¶

Every fact carries two dates, so you can prove what your program was on the audit date, and prove you did not change it afterward.

Law, standard, or guidance ¶

How to tier the EU AI Act, ISO/IEC 42001, and the NIST and Singapore frameworks, and why the tier changes what you must do.

How Kanonik supports your AI-governance work ¶

A precise map of what Kanonik supports and maps to across the named AI frameworks, and what it deliberately does not do.

Evidence and exports¶

Exporting your evidence for an audit ¶

What the sealed audit export contains, how to hand it to your auditor, and how they confirm independently that it is genuine.

An audit trail that survives scrutiny ¶

The full-decision-chain standard buyers now ask for, and the four properties that make a record defensible.

From evidence to accountability ¶

Why the bar moved from evidence collection to accountability and verification of autonomous action, and where Kanonik fits.

Reading your audit log ¶

How to read the Audit log, search and filter it, check the chain in your browser, and see what one person did.

Account and security¶

Password reset, changing account details, inviting teammates, multi-factor authentication options, and single sign-on.

Your data and privacy ¶

What Kanonik stores, what it never holds (your source-system credentials), and how the record is protected.

Roles and inviting your team ¶

The four roles you can give someone, what each one can do, how inviting and removing people works, and what an extra person costs.

Your subscription: upgrading and cancelling ¶

Where to see your plan, how to move up to Pro, how to cancel or undo a cancellation, and what happens to your workspace when the subscription ends.

When things go wrong¶

When something goes wrong ¶

Approval requests that ran out of time, links no longer usable, a request still landing, a spinner after you approve, and how to confirm what actually landed on your record.

Frequently asked questions¶

What is Kanonik?¶

Kanonik is new-gen GRC: your compliance system of record, where your own AI does the compliance work. Every change your AI proposes runs through a server-side safety check, waits for a named person's one-click approval, and is sealed into a tamper-evident audit log. Your assets, vendors, risks, controls, policies, and framework decisions live in Kanonik, with the proof behind each one.

Which AI can I use?¶

The one you already use. Kanonik is model-agnostic and connects over MCP (Model Context Protocol): Anthropic Claude, OpenAI, Google Gemini, AWS Bedrock, Azure OpenAI, or any MCP-capable client. You bring your own model key for your side of the work, so your AI provider stays your direct contractor.

Which frameworks run today?¶

Kanonik works with NIST CSF 2.0, SOC 2 (Trust Services Criteria), GDPR, HIPAA and ISO/IEC 27001:2022. NIST CSF 2.0 comes with Solo, and copyrighted frameworks, such as ISO/IEC 27001:2022, also run against your own licensed copy of the standard. The record underneath is framework-agnostic: you author a control once and each activated framework projects onto it, so a second framework is mostly recognition of work you already did.

How do approvals work?¶

Nothing your AI drafts reaches your compliance record without an approval from a signed-in person's account. Every policy, control, risk, mapping, piece of evidence or decision it drafts is checked on our servers first. It then waits until someone signed in to your workspace approves it, with a decision in the dashboard or on the emailed approval link, and the approval is recorded against that person's account. Asking in the chat is never enough. Kanonik cannot tell whether the person, or software acting in their signed-in browser, made the click. A few things are saved without an approval; they are listed here. In a one-person workspace, you approve your own AI's work, and the record marks each of your own governance items that would otherwise need a second person as a named exception. Work submitted together arrives as one approval request, and every item you approve is still sealed as its own entry.

Who runs the safety check?¶

The safety check (the Verifier) runs on Kanonik's servers, under Kanonik's own model account, separate from the AI and key you bring. Today it uses an Anthropic model, so if your AI is Claude the check comes from the same model company. Your AI cannot skip it or talk its way past it.

What does my auditor get?¶

A single sealed export: the complete decision record, your Statement of Applicability and documents, a cryptographic integrity proof, and a self-contained verification tool the auditor runs on their own machine, with nothing sent to anyone. The auditor of record can also be invited to your workspace read-only.

What data does Kanonik store?¶

Your compliance record and its full history, isolated per workspace. Kanonik never holds your source-system credentials (your cloud, code, and tickets stay connected to your AI, not to us) and never receives your conversation with your AI. It sees only the tool calls your AI makes against your record.

How does pricing work?¶

Solo is $99 a month and starts with a 14-day trial: we check your card at signup, and we charge the plan price on day 15 unless you cancel first in your workspace settings. Solo includes one user and NIST CSF 2.0, checks each change, seals it, and can produce an auditor-ready export. You can add teammates and other frameworks when you need them; Kanonik shows the charge before you confirm it. For Assure, Complete or a private deployment, talk to us. No token meters. Details on the Pricing page.

Do I need to install anything?¶

No. You connect your AI client to your workspace link once, sign in, and Kanonik's signed skills load over the connection on their own. From then on the work happens in your AI client and the results wait for your approval in the dashboard.

How do I get support?¶

Ask the assistant at the top of this page, or email [email protected]; a person who works on the product answers. Security questions live on the security page; the binding documents are the Terms, Privacy Policy, and DPA.