Continuous compliance · by RUCLabs
ComplianceIQ checks your controls every day, whatever framework you're audited against, collects signed evidence from inside your network without opening a single inbound port, and keeps it ready before the auditor asks.
The problem
Most teams prove their controls the same way they did ten years ago: by hand, once a year, from systems they would rather not touch.
01
Screenshots, CSV exports and email threads, gathered by people who have better things to do. Reproducing them a year later is guesswork.
02
Controls are tested once a quarter or once a year. A control that breaks in February is found in December.
03
ERPs, identity providers and databases sit on-prem for good reasons. Opening them up to a SaaS tool is not an option.
What it does
Every control runs the way it needs to: checked daily, reviewed formally each period, or both. Results, evidence and sign-offs end up in the same record.
Continuous monitoring
Scheduled checks run your controls every day. Pass or fail is recorded the moment it happens, and a deviation raises an alarm by email or Microsoft Teams.
Formal control execution
For controls that need a formal review, ComplianceIQ works out the period, collects the evidence, drafts an AI risk analysis and routes it to a reviewer with separation of duties enforced.
Formal control execution
Each formal control gets the review it needs. Separation of duties is enforced, not assumed: the person who prepares a review can't approve it.
One reviewer approves or rejects.
A preparer and an independent reviewer.
Each evidence row is reviewed on its own.
Activity logs matched to change tickets and attested line by line.
How it works
Model your frameworks, controls, business units and applications. Start from a built-in framework or bring your own.
Cloud systems connect by API. Internal systems are reached through a lightweight agent you run on-prem.
Checks run on schedule, formal reviews on their own cadence. Evidence is collected, hashed and signed automatically.
Every result, change and approval is in an append-only audit log. Export a PDF or Excel report per application or business unit.
AI under your control
AI answers questions, drafts controls and writes the workflows. People confirm every step that changes something. And your admins decide which models it uses, who can use them and how much they can spend.
ComplianceIA
A chat assistant that answers from your live data, not from memory. It looks things up with read-only tools scoped to your organization, so it can tell you what is failing and why, but it can't change anything.
Which controls are failing in Finance right now?
Two controls are failing in Finance, both on the ERP production instance:
CIS 5.3 found 14 accounts with no sign-in for 90+ days. Want the list?
GRC Agent
A guided agent that turns a regulation, a policy or a codebase into a control plan you can adopt. It works in phases, and nothing moves forward or reaches your platform until someone on your team confirms it.
Builds a compliance plan and a control set from your business units, applications and existing controls.
Open Q&A about your compliance data and how to close a gap. Read-only.
Reads a policy PDF or a code repository and drafts the controls it implies.
Designs a governance model for your own AI use, for standards such as ISO/IEC 42001.
Guardrails & governance
Every AI feature runs behind the same controls. Admins decide who gets which model, cap spend per role or per user, and can switch AI off for anyone. Every change to these rules lands in the audit log.
Describe the evidence you need and it drafts the automation workflow. It is only published after you review and confirm it.
Define agents with their own model and instructions for the jobs your team repeats.
On any control, ask for guidance on what it means and how to test it, or let AI improve the control's own prompt.
Security by design
The part of compliance automation that worries security teams most is the part we designed first.
Your network
Outbound, encrypted
0 inbound ports
The on-prem agent opens no inbound ports. It pulls work and pushes results over outbound encrypted connections, so nothing inside is exposed to the internet.
Every screenshot is hashed with SHA-256 and every result manifest is signed with a per-agent key, then verified before it is stored.
Each organization's data is isolated at the application and database layers. Regulated customers can run on a fully dedicated deployment.
Credentials and API keys are kept in a vault, never in config files. Agents enroll with single-use tokens that rotate.
Every change, approval and action is recorded and cannot be edited after the fact, so you can show who did what, and when.
Inside the platform
Posture across every framework, business unit and application.
Executions and activity as they happen.
The full history of every control, period by period.
Active deviations, with email and Microsoft Teams notifications.
Periodic runs with the review period worked out for you.
Review queue with sign-off, separation of duties, evidence and tickets.
Standards and their controls, built in or your own.
Your organization and software estate; controls run per deployment.
Ready-made evidence workflows you import in minutes.
Your on-prem agents and what they're running.
ComplianceIA, GRC Agent, Workflow Creator, models, agents and costs.
Audit log, users and roles, settings and AI guardrails.
Frameworks
Common standards come built in, and any regulation, standard or internal policy can be modelled as your own. Every framework runs on the same monitoring, reviews and evidence.
Common standards are ready to use, with their controls already defined.
Model any regulation, standard or internal policy, control by control.
Turn a regulation or policy document into a framework, review it and deploy it.
Who it's for
Who spend their weeks collecting evidence by hand.
Who need evidence they can reproduce for any period.
Who want assurance every day, not a yearly snapshot.
Running many applications and business units across several frameworks.
FAQ
No. It removes the manual work: collecting evidence, running checks, keeping records. Your team and your auditors spend their time on judgement, with better evidence in front of them.
Through a small agent you run on your own infrastructure. It only makes outbound, encrypted connections, so no inbound port is opened and nothing internal is exposed.
Each piece of evidence is hashed with SHA-256 and the result manifest is signed by the agent. The platform verifies both before storing it, and every action is kept in an append-only log.
Yes. Data is isolated per organization at the application and database layers. If you need more, ComplianceIQ can run on a dedicated deployment just for you.
Yes. Connect your own OpenAI-compatible or Anthropic endpoint and every AI feature uses it. Your API key is kept in a vault and never shown again. Or pick which models to enable from the built-in catalog.
Common standards such as SOX ITGC and CIS Benchmarks come built in. Beyond that, you can model any regulation, standard or internal policy as your own framework, and it runs on the same monitoring, reviews and evidence.
No. ComplianceIA only reads your data. The GRC Agent drafts plans and controls, but each phase, and the final deploy, needs a person to confirm it. Formal reviews are approved by people, with separation of duties enforced.
Thirty minutes, one of your real controls, and an honest answer on whether ComplianceIQ fits.
