Help center¶

Browse the guides below. Email us when you want a person; someone who works on the product answers.

Get an answer right now¶

The guides below cover each page of the app. If you do not find your answer, [email protected] always works.

Getting started¶

Getting started with Kanonik ¶

What Kanonik is, how a change your AI drafts gets checked and approved before it goes on your record, and what to do first.

Signing up and your trial ¶

What the sign-up page asks for, when your card is charged, and what happens once your workspace is created.

Connecting your AI ¶

How to connect Claude Code, Claude Desktop, or any MCP-capable client to your workspace, and what happens once you do.

Your first job, step by step ¶

Five steps to your first approved record, with what you see on screen at each one.

Finding your way around your workspace ¶

The dashboard is where you see what your AI did and approve what needs you. Here is what each item in the left-hand menu is for.

How your next step is recommended ¶

Where the recommended next step and suggested prompts come from: fixed rules over your own recorded data, with no model call involved.

In the app¶

Start: your first record ¶

What the Start page shows on your first visit, and how to begin your security record.

To decide ¶

Where the drafts your AI makes wait for you, and how to approve, send back or reject each one.

Copy a prompt to your AI ¶

How the Copy prompt panel works, so you always see exactly what your AI will be told.

Send a draft back ¶

What Send back does, why it needs your own words, and how your AI revises the draft.

Settings ¶

What each section of Settings is for, and who can change it.

Working with your AI¶

How risk discovery works ¶

How your AI finds, scores and treats your risks: assets and vendors first, then risks, then gaps, then controls.

Revising a draft before you approve ¶

How the back-and-forth works: every revision is re-checked, and you only ever approve a version checked in the exact state it lands.

Closing the loop on a change ¶

Why a change is not done until it is connected, and how Kanonik surfaces the missing next step in the moment.

Keeping your compliance current ¶

How to amend risks, controls, and policies over time, how often to review, and what continuous evidence means for SOC 2 Type 2.

Approvals and the record¶

Why you approve every change ¶

The approval gate and your role: nothing your AI drafts reaches your record without an approval from a signed-in person's account, that recorded approval is what makes the record defensible, and the few things saved without an approval are listed.

Deciding on an approval request, item by item ¶

Work your AI submits together arrives as one request. You decide on each item, and the request lands on your last decision.

How confidence scoring works ¶

What the confidence score is made of, how it decides quick approval versus review versus rejected, and how to set the scrutiny.

When you and the safety check disagree ¶

You have the final say. How a reasoned, acknowledged override becomes a permanent, defensible part of your record.

Foresight: checking a change against your promises ¶

Before you swap a vendor, ask your AI to check the change against what you have promised customers: the four results, the dates it assumes, and what it does not check.

Getting approval notices in Slack ¶

How to get a notice in Slack when an approval request is waiting, what the notice shows, and how to test or disconnect it.

Asking your record a question ¶

Ask your connected AI what your company has approved, what is waiting for you, or whether a change breaks a promise, and have it search your approved record for the answer.

Frameworks and audits¶

Proving your controls cover your requirements ¶

Why declaring a control's requirements is not proof, why you approve each connection, and how to read the coverage states.

Where you stand ¶

How to read the Where you stand screen, what each count means, and how to close what is open.

Working to more than one framework ¶

How one program serves several frameworks, why one control usually satisfies many, and why nothing is credited without your approval.

Framework licences ¶

Why a copyrighted framework needs your licence on record, how to record it in Settings, and what adding a framework costs.

Your program as it stood on any date ¶

Every fact carries two dates, so you can prove what your program was on the audit date, and prove you did not change it afterward.

Telling AI law from standards and guidance ¶

How to tier the EU AI Act, ISO/IEC 42001, and the NIST and Singapore frameworks, and why the tier changes what you must do.

How Kanonik supports your AI-governance work ¶

A precise map of what Kanonik supports and maps to across the named AI frameworks, and what it deliberately does not do.

Evidence and exports¶

Exporting your evidence for an audit ¶

What the sealed audit export contains, how to hand it to your auditor, and how they confirm independently that it is genuine.

The Proof Snapshot ¶

A free, signed copy of where your program stands that anyone can check offline, and how it differs from the Sealed Audit Package.

An audit trail that survives scrutiny ¶

The full-decision-chain standard buyers now ask for, and the four properties that make a record defensible.

Proving what your AI did, and who stood behind it ¶

Why auditors now ask who stood behind what an AI did, and where Kanonik fits.

Reading your audit log ¶

How to read the Audit log, search and filter it, check the chain in your browser, and see what one person did.

Account and security¶

Signing in and keeping your account secure ¶

Password reset, changing account details, inviting teammates, and multi-factor authentication options.

Your data and privacy ¶

What Kanonik stores, what it never holds (your source-system credentials), and how the record is protected.

Roles and inviting your team ¶

The four roles you can give someone, what each one can do, and how inviting and removing people works.

Your subscription: upgrading and cancelling ¶

Where to see your plan, how to move up to Audit-Ready, how to cancel or undo a cancellation, and what happens to your workspace when the subscription ends.

When things go wrong¶

When something goes wrong ¶

Approval requests that ran out of time, links no longer usable, a request still landing, a spinner after you approve, and how to confirm what actually landed on your record.

Frequently asked questions¶

What Kanonik is¶

Kanonik is security compliance software: your compliance system of record, where your own AI does the compliance work. Every change your AI proposes runs through a server-side safety check, waits for a named person's one-click approval, and is sealed into a tamper-evident audit log. Your assets, vendors, risks, controls, policies, and framework decisions live in Kanonik, with the proof behind each one.

Which AI you can use¶

The one you already use. Kanonik is model-agnostic and connects over MCP (Model Context Protocol): Anthropic Claude, OpenAI, Google Gemini, AWS Bedrock, Azure OpenAI, or any MCP-capable client. You bring your own model key for your side of the work, so your AI provider stays your direct contractor.

Which frameworks run today¶

Kanonik works with 17 frameworks: SOC 2, ISO/IEC 27001, HIPAA, GDPR, NIST CSF 2.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, NIST SP 800-171 Rev. 3, FedRAMP Rev. 5 baselines, GovRAMP Rev. 5 baselines, CCPA/CPRA, DORA, NIS2, NYDFS Part 500, EU AI Act, NIST AI RMF 1.0 and NIST SSDF. NIST CSF 2.0 and GDPR come with every plan. For ISO/IEC 27001, Kanonik uses the clause numbers with its own descriptions, never the standard's text, and asks you to confirm you hold a licensed copy before it builds your audit package. The record underneath is framework-agnostic: you author a control once and each activated framework projects onto it, so a second framework is mostly recognition of work you already did.

How approvals work¶

Nothing your AI drafts reaches your compliance record without an approval from a signed-in person's account. Every policy, control, risk, mapping, piece of evidence or decision it drafts is checked on our servers first. It then waits until someone signed in to your workspace approves it, with a decision in the dashboard or on the emailed approval link, and the approval is recorded against that person's account. Asking in the chat is never enough. Kanonik cannot tell whether the person, or software acting in their signed-in browser, made the click. A few things are saved without an approval; they are listed here. In a one-person workspace, you approve your own AI's work, and the record marks each of your own governance items that would otherwise need a second person as a named exception. Work submitted together arrives as one approval request, and every item you approve is still sealed as its own entry.

Who runs the safety check¶

The safety check (the Verifier) runs on Kanonik's servers, under Kanonik's own model account, separate from the AI and key you bring. Today it uses an Anthropic model, so if your AI is Claude the check comes from the same model company. Your AI cannot skip it or talk its way past it.

What your auditor gets¶

A single sealed export: the complete decision record, your Statement of Applicability and documents, a cryptographic integrity proof, and a self-contained verification tool the auditor runs on their own machine, with nothing sent to anyone. The auditor of record can also be invited to your workspace read-only.

What data Kanonik stores¶

Your compliance record and its full history, isolated per workspace. Kanonik never holds your source-system credentials (your cloud, code, and tickets stay connected to your AI, not to us) and never receives your conversation with your AI. It sees only the tool calls your AI makes against your record.

How pricing works¶

Starter is $3,000 a year or $300 a month, with a 14-day trial. Audit-Ready is $6,000 a year with one audited framework (SOC 2, ISO 27001 or HIPAA), and Enterprise starts at $18,000 a year. Your compliance work runs on the AI you already pay for, so we don't charge you for one. No per-user fees, no per-questionnaire fees. Details on the Pricing page and in Plans and pricing.

Installing anything¶

No. You connect your AI client to your workspace link once, sign in, and Kanonik's signed skills load over the connection on their own. From then on the work happens in your AI client and the results wait for your approval in the dashboard.

Getting support¶

Email [email protected]; a person who works on the product answers. Security questions live on the security page; the binding documents are the Terms, Privacy Policy, and DPA.