Compliance Dashboard

Posture overview across all frameworks - every figure computed from the demo data layer.

108

Total Controls

Across all frameworks

34%

Implemented

37 of 108 controls

Open Risks

Requiring attention

Evidence Items

Artifacts in the library

AI Actions

Logged in the audit trail

34%

Task Completion

Not audit readiness - see Gap Analysis

RealThe engine that runs

Analysis engine (live model or deterministic)
Provenance contract on every AI output
Append-only audit-log logic

SimulatedThe data it runs on

Control + mapping dataset is synthetic
No live tenant / cloud connection
AI audit log ships as seed data

Start here

Run a Gap Analysis

Score readiness against SOC 2 / ISO / HIPAA - auditor-weighted, not checkbox-weighted.

Validate Evidence with AI

Paste an artifact; the engine grades sufficiency and stamps provenance on the verdict.

Generate a Policy

Draft a control-mapped policy scaffold for a named owner - nothing auto-approved.

Map once, satisfy many

The AMCF control-overlap engine

Explore the overlap

30common controls99requirements satisfied3frameworks57-70%evidence reuse

Author a control once; it satisfies requirements across every framework it maps to. Line thickness = requirements satisfied. Computed from the synthetic AMCF mapping dataset.

Framework Progress

In Progress

Risk Heatmap

Negligible

Minor

Moderate

Major

Severe

Almost Certain

Likely

Possible

Unlikely

Rare

Impact →

Low Medium High Very High Critical

AI Audit Trail

5 logged

Control Suggestion

claude-3.5-sonnet

AI recommendation engine suggested additional controls for HIPAA compliance based on current implementation gaps.

Compliance Officer · Mar 25, 2026

Policy Generated

claude-3.5-sonnet

AI-assisted generation of Data Classification and Handling Policy aligned with ISO 27001 A.5.12 and SOC 2 CC6.7.

CISO · Mar 18, 2026

Risk Assessment

claude-3.5-sonnet

AI-assisted risk assessment for third-party payment processor integration, evaluating data flow, access patterns, and contractual safeguards.

Security Engineering Lead · Mar 12, 2026

Gap Analysis

claude-3.5-sonnet

AI-powered gap analysis of current SOC 2 control implementation status against Trust Services Criteria requirements.

CISO · Mar 5, 2026

Policy Generated

claude-3.5-sonnet

AI-assisted generation of Incident Response Policy based on SOC 2 CC7.3, CC7.4 requirements and NIST SP 800-61 framework.

CISO · Feb 20, 2026

Every AI action is logged for audit readiness. Older rows are seeded demo records; runs you trigger on the Gap Analysis / Policy / Evidence surfaces are appended live (in-memory - they reset when the demo server restarts).

AI Insights

From audit log

Gap analysis: 8 open control gaps

3 critical

Identified 8 control gaps requiring remediation. Priority areas: 1) Formal risk assessment process (CC3.1-3.4), 2) Continuous monitoring pro

HIPAA: 80% control overlap

80% reuse

Suggested prioritizing: 1) ePHI data flow mapping (leverage existing data classification), 2) BAA management process, 3) Breach notification

AMCF efficiency

57-70% reuse

30 common controls satisfy 99 framework-specific requirements across 3 frameworks.

5 AI actions logged

Audited

2 policy drafts generated via claude-3.5-sonnet, plus gap analysis and risk reviews - each captured in the audit trail.

Trust & Governance

The AI-action lifecycle, end to end - each stage badged by what enforces it. Click a stage for detail.

Honesty boundary: tenant isolation & identity

Demo gap

Single synthetic identity, in-memory store - no live auth, no persistence.

Runs reset on restart. The committed schema (src/prototypes/gorico/db/schema.sql) shows the production posture: row-level security fences every tenant table to the org claim in the JWT, so an application bug cannot become a cross-tenant evidence leak.

create policy org_isolation on evidence for all to authenticated
  using (org_id = gorico.current_org_id());

Data handling:Processed in-request onlySent to OpenRouter only if a key is setNothing you enter is storedDo not paste real PHI or confidential audit artifacts into a public demo.