The AI trust platform

Continuous compliance, live risk posture, cloud security and a public trust page. Everything a buyer asks for before they sign, in one system.

Book a demo See how it works

NorthIronScoping questionnaireIntegrationsCompliance / Evidence VaultCompliance / Evidence VaultCompliance / Compliance Readiness

01Scope
02Connect
03Collect
04Review
05Ready

DashboardAction ItemsIntegrations

Compliance

Compliance ReadinessControl RequirementsEvidence VaultPolicy ManagementVendor ManagementRisk Management

People

PeopleAwareness Training

Security posture

Cloud Security

AKExample workspace

Scoping questionnaire

Section 4 of 12

Sent by your consultant. No account needed, and no blank page.

Which framework is the buyer asking for?ISO 27001
Where does production run?AWS, one region
Do you run your own code repositories?Yes, GitHub

Draft evidence listResolved from your answers

62Manual34Hybrid21Automatic

A consultant reviews and publishes this. The published list is your Evidence Vault.

Integrations

Evidence collected on a schedule

Connect the cloud accounts, repositories and directory your team already runs.

Cloud security

ConnectedAWSLast scan 12m ago9 checks failing
ConnectedGoogle CloudLast scan 12m ago3 checks failing
ConnectedMicrosoft AzureLast scan 1h agoAll checks passing

Source code management

ConnectedGitHubLast scan 26m ago4 checks failing
ConnectedGitLabLast scan 26m agoAll checks passing

Identity providers

ConnectedMicrosoft Entra IDLast scan 8m agoRoster in sync

Checks that produce findings reach the vault on their own.

Evidence Vault

ISO 27001

Some items a person uploads. Some arrive from another module, or reference a report without copying it.

RequirementsAuto Evidence

EvidenceCollectionStatus

Access control policyFrom Policy ManagementHybridUnder review
Q2 access review, AWS productionUploaded by youManualUnder review
Backup restore test, MarchUploaded by youManualAccepted
Penetration test reportReferenced from VAPTHybridAccepted

Whichever route it took, it lands in one queue under review.

Evidence Vault

ISO 27001

Q2 access review, AWS production

EvidenceCollectionStatus

Access control policyFrom Policy ManagementHybridUnder review
Q2 access review, AWS productionUploaded by youManualUnder review
Backup restore test, MarchUploaded by youManualAccepted
Penetration test reportReferenced from VAPTHybridAccepted

AI evidence reviewGaps foundChecked against the control’s acceptance criteria

Deprovisioning is evidenced: Reviewer sign-off is present, but nothing shows the flagged accounts were actually removed.
Review falls in the defined window: Dated 4 April, outside the Q2 window set in the access control policy.

GLAwaiting your named GRC lead. Nothing counts until they accept it.Accepted by your named GRC lead. That decision is the one an auditor sees.

Executive dashboard

Read-only roll-up across every module

Updated 18s ago

Compliance score62%In progress

Active programmes2ISO 27001SOC 2

Open findings252 critical9 high

Controls coverage62%89 of 144 · 21 evidence pending

Compliance score trend

Activation to due date, progress toward target

62%Current80%Target18 ppGap49dRunway

Target 80%

Findings by severity

Across cloud, source control and vulnerability scans

Critical2
High9
Medium8
Low6
Remediated31

Counts update when a scan completes.

NorthIron customers

Compliance busywork kills momentum.

Manual prep. Screenshots. Spreadsheets. Endless back-and-forth. Your team is stuck checking boxes instead of closing deals and building security.

To-do
Re-export the access list for the SOC 2 auditor.
To-do
Complete the customer questionnaire, tab 3 of 7.
Alert
The quarterly access review is overdue.
Notice
The auditor asked for the same evidence again.

CC
6.3

SOC 2

Ensure every team member has MFA enabled

Export users with MFA in GitHub

UserMFA

Maya RaoEnabled
Arjun MehtaNot enabled
Nadia KhanEnabled

Screenshot taken

Remind Arjun Mehta to enable MFA in GitHub

Book a demo

Every delay in compliance costs you revenue.

Every slip in compliance is a deal you lose, a market you don't enter, or a customer you can't win.

Cannot Move Forward Due to Missing Compliance

Maya Patel

maya.patel@helixpayments.com

Wed, 16 July, 4:31 PM

Hi team,

As part of our vendor security assessment, we found that your company does not currently hold SOC 2 or ISO 27001 certification. Our IT security policy requires one of these as a baseline for onboarding new vendors, so we are unable to move forward at this time.

We appreciate the time you have invested in this process and wish you the best going forward.

Best regards,
Maya Patel

ReplyForward

ARR bookings declining over last 30 days

↓ 40%Last 30 days

Halcyon Systems

$1,200,000

Closed lost

Reason: Compliance

Meridian Grid

$1,500,000

Closed lost

Reason: ISO 27001 delay

See how much time NorthIron can save you

For startups

Need SOC 2 to close your next deal?

Get audit-ready with a field-tested playbook, expert guidance, and a clear path through every compliance milestone.

See the startup playbook

Your first framework

Scope the first audit
Connect cloud and code
Build evidence that carries forward

SOC 2 · ISO 27001

One control set from day one

The AI review

AI reads the evidence. A named person still accepts it.

It is checked against the control's acceptance criteria before a reviewer opens it. What comes back is advice, and the platform treats it as advice.

It sees the file and the criteria. Nothing else.
One gap per criterion, at most.
A file that talks to the model gets flagged.
Closing a gap is not approval.

NorthIronCompliance / Evidence VaultSigned in as youGLGRC lead

EvidenceUpload evidence

manual upload

access-review-q2.pdfUnder review

AI evidence reviewGaps foundOpen gaps (3)

Covers every in-scope production system
Satisfied by the uploaded file.
Deprovisioning is evidenced
Sign-off is present, but nothing shows the flagged accounts were removed.
Review falls in the defined window
Dated outside the window set in the access control policy.
Each retained account has a justification
Three service accounts carry no business justification.

access-review-q2.pdfUnder review

AI evidence reviewGaps foundOpen gaps (3)

Covers every in-scope production system
Satisfied by the uploaded file.
Deprovisioning is evidenced
Sign-off is present, but nothing shows the flagged accounts were removed.
Mark as done
Review falls in the defined window
Dated outside the window set in the access control policy.
Mark as done
Each retained account has a justification
Three service accounts carry no business justification.
Mark as done

access-review-q2.pdfUnder review

AI evidence reviewGaps foundOpen gaps (0)

Covers every in-scope production system
Satisfied by the uploaded file.
Deprovisioning is evidenced
Marked as done. The finding stays on record.
Review falls in the defined window
Marked as done. The finding stays on record.
Each retained account has a justification
Marked as done. The finding stays on record.

Every gap is closed, and the evidence still is not accepted. Awaiting your named GRC lead.

access-review-q2.pdfAccepted

AI evidence reviewClosed

Covers every in-scope production system
Satisfied by the uploaded file.
Deprovisioning is evidenced
Marked as done. The finding stays on record.
Review falls in the defined window
Marked as done. The finding stays on record.
Each retained account has a justification
Marked as done. The finding stays on record.

Accepted by your named GRC lead. That decision is the only one an auditor sees.

Modules

The compliance side of the platform

One control set sits underneath all of it, so a piece of evidence accepted once counts everywhere it is relevant. These are the surfaces your team works in day to day.

One engine underneath every framework.

NorthIron pools weighted progress across every framework in scope. Partial control progress earns partial credit, while the exact missing evidence remains visible underneath the score.

One live readiness number across enrolled frameworks
Shared atomic controls show where work carries over
Every score traces back to accepted evidence

Evidence collected once, reviewed before it counts.

Manual uploads, module references, and automatic checks meet in one evidence queue. AI flags gaps for review, but only a named person can accept evidence and change readiness.

Manual, hybrid, and automatic collection
Advisory AI gaps with a human acceptance gate

AWS and GitHub checks feed the same control set.

Connect cloud accounts and repositories, run checks, and work from the resulting findings. Passing checks and resolved gaps feed the same evidence and control model as manual work.

Provider-aware connection and scan status
Findings grouped by service, repository, and severity

Policy Management

Draft, review, publish, and version policies already mapped to controls. Send acknowledgements by magic link and keep the receipts beside the policy.

Mapped controls
Version history
Acknowledgements

Risk Register

Work from a maintained risk library, assign owners and treatments, and track mitigation tasks through approval instead of leaving the register as a spreadsheet.

Risk ownership
Treatment plans
Mitigation tasks

Vendor Risk

Assess vendors across attack surface, questionnaire responses, and supporting documents. The score rebalances when a pillar does not apply instead of treating missing data as failure.