SOC 2 · ISO 27001 · HIPAA · AI-powered compliance, in private beta
Compliance,without the chaos.
Koralyt keeps your controls, evidence, policies and audit in one system that checks itself every day. You always know what is ready, what has gone stale, and what the auditor will ask for next.
Private beta. We invite teams in small groups.
- Systems
- Evidence
- Controls
- Policies
- Assurance
- Illustration, not live data
Animation: a scattered cloud of points settles into concentric rings of systems, evidence, controls and policies around a single point of assurance, with pulses travelling inward along the connections between them.
01 · The problem
Audits rarely fail on security. They fail on bookkeeping.
Evidence lives in screenshots.
The quarterly access review exists, somewhere, in a folder. Nobody noticed that it expired in August.
Status lives in someone's head.
“Are we ready?” takes a week of chasing owners to answer, and the answer is out of date by Friday.
The audit becomes the project.
Fieldwork starts, and the team stops shipping to hunt for the documents the auditor asked for.
02 · How Koralyt works
One connected model, from system to assurance.
Five kinds of record, each pointing at the next. What was scattered across folders and inboxes comes into focus, and proof flows inward from the systems you run to a readiness figure you can stand behind.
01 · Systems
Start from what you actually run.
Assets, vendors and the systems in scope are recorded once, each with an owner. Risks and controls point back to them, so scope is a fact and not a memory.
02 · Evidence
Evidence with an expiry date.
Each control states what proves it and how often. Koralyt works out freshness and audit-period coverage from the records themselves, so stale evidence surfaces on its own, with the day it went stale.
03 · Controls
Controls that explain their own status.
A control is scored on visible, weighted checks: an owner, implementation, current evidence, design review, open exceptions. There is no status field for anyone to forget to update.
04 · Policies
Policies with a paper trail.
Draft, review, approve, acknowledge. Every version is kept, and the person who wrote a policy cannot be the one who approves it.
05 · Assurance
One number you can defend.
Readiness is the sum of those checks, and every figure links to the records behind it. Your auditor works in a scoped workspace with requests, tests and exceptions in one place.
03 · The product
Built, not promised.
These are screens from the application as it runs today, not mock-ups.
Where the program stands this morning, and what needs you first.
Shown with the demo workspace, Meridian Ledger, a fictional company.
04 · AI, with a boundary
AI drafts. People approve.
An assistant that can approve its own work is not a control. In Koralyt the model can read and draft; the rule that a person decides is enforced in the application, not requested in a prompt.
Generated
AI reads your program through permissioned tools.
Draft
The result is saved as a marked, unapproved draft.
Human review
A person accepts, edits, rejects or asks for changes.
Approved
Only then does a compliance record change.
What the AI does
- Answer questions about readiness, with sources
- Draft policies from 13 structured templates
- Suggest which evidence fits which control
- Draft responses to auditor requests
- Summarize gaps and propose remediation tasks
What it can never do
- Approve a policy
- Accept evidence as valid
- Submit anything to your auditor
- Change permissions
- Alter or delete history
Every AI result records the template, the model, the tools it called and the records it cited, so “why did it say that?” always has an answer.
05 · What's built
What works today, and what doesn’t yet.
You are being asked to trust a compliance tool. It should start by being straight about itself.
In the beta today
SOC 2, ISO 27001 and HIPAA
Three frameworks on one set of controls. Map a control once and Koralyt suggests where it also counts in the others.
Control library
Controls mapped to each framework's requirements, with owners and revision history.
Statement of applicability
For ISO 27001, every Annex A control marked applicable or excluded with a reason.
Evidence lifecycle
Requirements, uploads, review, freshness and Type II period coverage.
Policies
Versions, approval with separation of duties, and acknowledgements.
Risks, vendors and assets
Registers linked to the controls that address them.
Audit workspace
Auditor requests, control tests, exceptions and scoped auditor access.
Readiness and deadlines
Explained scores, a compliance calendar, tasks and notifications.
AI assistance
Copilot, policy drafting, evidence analysis and a human review inbox.
Automations
Five built-in workflows, from evidence-due reminders to readiness reviews.
Tamper-evident activity log
Every compliance change recorded in a hash-chained log.
Public progress page
A read-only page showing how close you are, shared by secret link.
On the roadmap
Automated evidence collection
Connectors for AWS, GitHub, Bitbucket, Okta and Google Workspace. Today, evidence is uploaded.
Single sign-on
OIDC and SAML sign-in, multi-factor authentication and SCIM provisioning.
Document export
Generated policies and reports as PDF and DOCX.
Email and Slack notifications
Today, notifications appear inside Koralyt.
More frameworks
Frameworks are data in Koralyt, not code, so others can follow the three that ship today.
06 · Foundations
Held to the standard it helps you meet.
- Isolated by design
- Every query is scoped to your organization on the server. Another tenant's record behaves exactly like one that does not exist.
- History, not overwrites
- Controls keep revisions, policies keep versions, accepted evidence is immutable and exceptions are never deleted.
- A log that shows tampering
- Each activity entry is chained to the one before it by hash, so a changed or missing entry is detectable.
- AI on your terms
- AI is off by default, and a data-classification ceiling limits what may ever be sent to a model provider.
07 · Private beta
Be ready before the auditor asks.
We are opening Koralyt to a small number of teams preparing for SOC 2, ISO 27001 or HIPAA. Request access, and tell us a little about where you are.
Request access
Start with your email. A few optional questions follow.
We use your address to write to you about beta access, and for nothing else. Privacy
08 · Questions
Asked often.
Can I use Koralyt today?
Koralyt is in private beta. Request access and we will write to you when a place opens; we invite teams in small groups.
Which frameworks does it cover?
SOC 2, ISO 27001 and HIPAA (the Security and Breach Notification Rules). You can run them side by side: one control can meet requirements in all three, and Koralyt suggests where your existing controls already overlap. Others, such as GDPR, are not available yet.
Does Koralyt replace my auditor?
No. A SOC 2 report is issued by an independent CPA firm and an ISO 27001 certificate by an accredited certification body; HIPAA has no official certificate. Koralyt gets you ready, keeps you ready, and gives your auditor a workspace with the requests, tests and evidence in scope.
Does it connect to AWS, GitHub or Okta?
Not yet. Connectors are on the roadmap. In the beta, evidence is uploaded and reviewed in Koralyt, which then tracks its freshness and coverage for you.
What does the AI do with our data?
It reads only through tools that enforce the asking person's permissions, and it can only create drafts. It is off by default, and a data-classification ceiling limits what may be sent to the model provider.
What will it cost?
Pricing is not set. That is one reason the access form asks what you would expect to pay.