Neural Inverse Govern / Compliance and evidence
Evidence toward your controls, without claiming more than it shows.
Framework rule packs, checks against your organisation's records, hashed evidence records, decision records and project policies, each stating what it proves and what it does not.
- Frameworks
- SOC 2, ISO 42001, EU AI Act, GDPR, HIPAA and more
- Checks
- Against your organisation's own records
- Evidence
- Per control, content hashed
- Overrides
- Bound to break-glass, record only
- Standing
- Evidence toward, never certification
Overview
Govern keeps a catalogue of framework rule packs, runs their checks against what your organisation has actually recorded, and stores evidence and decision records for your assessor. Every check says what it counted, every evidence record carries a hash of its content, and every change is written to the audit log with the change. A pass means a check found what it looks for, not that a control is met.
What it does
What compliance and evidence covers.
Only what works today, and what each record does and does not prove.
Framework rule packsA shared catalogue of rule packs with rules by control, for SOC 2, ISO/IEC 42001, the EU AI Act, GDPR, HIPAA, PCI DSS, FedRAMP and the NIST AI RMF. Packs and rules are published by your platform operators.
SubscriptionsAn organisation subscribes to the packs it needs. Subscribing again refreshes the pack version and keeps the original subscription, with the time of the last check.
Checks against your recordsA check runs every rule of a pack and stores one finding per rule: pass, fail or warn, with a sentence saying why. Policy, data and configuration checks each look at a stated record, such as MFA events or an active signing key.
Honest resultsChecks count records; they do not assess a control. A control with nothing to count reports warn until someone records evidence for it, so a clean report cannot appear by default.
Evidence recordsDocuments and other evidence per framework and control, with the time they were collected. Each record carries a SHA-256 hash of its content that shows a later change to the stored content. It is a hash, not a signature.
Audit packageThe findings and evidence of one framework for a period, as one JSON document with a hash over its contents. The hash shows the package is internally consistent, not who produced it.
Signed evidence from the audit logWhere you need signed evidence, an audit log export carries a manifest signed with Ed25519 that verifies offline against the keys your installation publishes.
GDPR Article 22 decision recordsRecords of automated decisions about people, with the decision type, the legal basis and whether a person reviewed it. Records cannot be changed once written.
Break-glass overridesA time-boxed record that a compliance rule was overridden in an emergency, with a reason. It needs the person's own active break-glass activation and ends with it. It changes no enforcement.
Encryption evidenceOn request, the AI Gateway's encryption posture (key state, rotation, FIPS mode, receipts) is stored as evidence records mapped to controls of HIPAA, PCI DSS, SOC 2 and ISO/IEC 27001.
Detector findingsFindings of the AI Gateway's governance detectors, such as sensitive data and prompt injection, feed compliance evidence alongside the audit log.
Project policiesModel allowlist, data residency and budget policies per project. In enforce mode the AI Gateway refuses a request that breaks one; in shadow mode it records the violation and lets the request through.
Project governance mapEvery control that applies to a project and its state there: enforced, shadow, off or not scoped, so a reviewer sees the project's position in one place.
Domain governanceAI actions are evaluated per domain and tool. High-risk actions wait in a queue for an approver who is not the requester, and a domain can block actions outright.
Evidence records and the audit package are reached through the API; they have no console page yet. Rule packs, subscriptions, decision records and overrides have console pages.
How it works
From a rule pack to a package for your assessor.
- SubscribeChoose the framework rule packs that apply to your organisation.
- CheckRun a pack's checks; each rule records pass, fail or warn with its reason.
- Record evidenceA named person with permission to manage compliance records evidence for the controls a check cannot count.
- OverrideIn an emergency, record a break-glass override tied to your own activation.
- PackageBundle a framework's findings and evidence for a period, or export the signed audit log.
- AssessYour assessor decides what the evidence supports. Certification stays with you.
Who uses it
Built for every role that answers for AI.
Compliance teamsSubscribe to rule packs, run checks, record evidence and decision records, and prepare packages for assessors.
Security teamsSet project policies, run them in shadow mode before enforcing, and approve high-risk AI actions in their domain.
Assessors and auditorsRead findings, evidence, decision records and overrides, and verify signed audit exports offline.
Platform operatorsPublish the rule packs and rules every organisation on the installation shares.
Enforced and recorded
Recorded with the change, or not changed at all.
Compliance records are only useful if their own history is complete, so each one is written with its audit entry.
Enforced
Audit with every changeCreating a pack, a rule, a subscription, a decision record or an override, and revoking an override, write the audit entry in the same transaction. If it cannot be written, the change is rolled back.
Overrides need break-glassAn override is refused unless it names the caller's own active break-glass activation, and it ends when that activation ends.
Project policiesIn enforce mode, the AI Gateway refuses a request for a model outside the project's allowlist or residency, or beyond its budget.
No self-approvalA high-risk AI action held by domain governance cannot be approved by the person who asked for it.
Recorded
FindingsEvery check's findings by rule, with status and reason, readable by framework.
EvidenceEvery evidence record with its content hash and collection time.
Decisions and overridesEvery GDPR decision record, and who created or revoked every override. The audit entry is the only record of who did so.
Shadow violationsEvery request a shadow-mode project policy would have refused.
Govern produces evidence toward the controls of these frameworks. It does not certify your organisation, and Neural Inverse holds no certification on your behalf.
Self-hosted and in your cloudFindings, evidence and decision records live in your own database, under the same tenant isolation as everything else.
Air-gappedChecks read your installation's own records; nothing is sent to an outside service to run them.
Verify offlineSigned audit exports verify without network access, against keys your installation publishes.
Hosted by usWe run it for you, with the same controls and audit record.
Get started
Set it up with the documentation.
What's next
Being built now.
These are in development and not part of the product today.
Automatic evidence collectionEvidence gathered from the organisation's live state on a schedule, instead of recorded by hand.
Evidence packs from live statePacks for SOC 2, ISO/IEC 27001 and the EU AI Act built from collectors over the organisation's own data.
Framework reportsReports and control status for the EU AI Act and the NIST AI RMF generated from live data.
Policy changes through GitTwo-person review of policy changes kept in sync with a repository you name.
Console pages for evidenceEvidence records and the audit package in the console, beside rule packs and overrides.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.