Getting started with Kanonik

What Kanonik is and how its core loop works.

Kanonik is security compliance software. It is your compliance system of record. Your program lives in Kanonik, with the proof behind every part of it. There is no separate platform underneath it.

The part that is different from older tools: you do not do the compliance work inside Kanonik, and you do not fill in forms. Your own AI does the work. Kanonik holds the record and runs a safety check before anything lands. It also provides an approval gate and a tamper-evident audit log. This page explains the loop and the right first move.

What Kanonik gives you

Kanonik holds the record and guards every change to it.

• The record. A connected model of your program. Things in scope and how they relate, kept current as your AI works.
• The safety check. An automated review that runs on Kanonik's servers before any change can be approved. It cannot be skipped. Low-confidence items go to a review queue instead of landing.
• The approval. One request per piece of work. Your decision on each item is what records it. Saying "yes" in your chat is never enough on its own.
• The audit log. A permanent, tamper-evident timeline of who proposed what, the safety-check result, who approved it, and when. Nothing is quietly edited or removed.

You approve. You do not edit compliance objects by hand in the dashboard. If something needs to change, you tell your AI and it produces a new version for you to review.

Your AI does the work

Your AI is Claude Desktop, Claude Code, or any MCP-capable client, loaded with Kanonik's signed skills. The skills load automatically over the connection, so there is nothing to install. Once connected, your AI knows how to do compliance work against your record: draft policies, identify controls, map them to the framework, and more.

Kanonik holds no credentials to your own systems. When your AI needs to look at your cloud accounts, your code, or your tickets, it connects to those through its own tools, not through Kanonik.

The core loop

Day to day, the rhythm is the same every time.

1. You ask your AI to do a piece of compliance work.
2. It drafts the work, runs it through Kanonik's safety check, and refines it until the check is satisfied or it needs your judgment.
3. The finished work reaches you as one approval request, in To decide and as a link.
4. You read each item and approve it, send it back with your reason, or reject it.
5. On your last decision, the items you approved are recorded in your audit log.

If an item is not right, you send it back and your AI revises it. Only your decision records anything.

The right first move

The instinct from older tools is to write a policy first. That is the wrong place to start here. Start with risk-driven discovery and let everything else follow from it.

The order that works:

1. Your AI finds your assets, vendors, and risks first.
2. Then the controls that treat those risks.
3. Then it maps those controls to the framework.
4. Policies come last, written to match the controls you actually have.

Done this way, your record reflects your real program, and your policies describe controls that exist rather than ones you wish you had. A good opening ask is simply: "Help me start my SOC 2 program. Find my assets and risks first."

Kanonik works with 17 frameworks, and one program serves them all. NIST CSF 2.0 and GDPR come with every plan. See Working to more than one framework.

Where to go next

Two steps and you are working.

1. Connect your AI. Open "Connect your AI" in the dashboard and follow the short setup to wire your client to Kanonik. The skills load on their own. The walkthrough is in Connecting your AI.
2. Ask it to start. Use a starter prompt, or just describe your goal in plain words. Your AI proposes the first change, the safety check runs, and the result waits for you under "To decide."

From there, the work happens in your AI client, and the dashboard is where you review, approve, and see your record grow.

More help

Browse every article in the Help center. For anything else, email [email protected] and a person who works on the product answers.