Compliance management for ISO 27001 · TISAX · ISO 9001 · NIS2
A management system you can prove.
AuthenticTrust takes a company from an empty workspace to the certification audit: the registers each standard asks for, documents with approval and review dates, audits and their findings — and a rule-based compliance review that checks every requirement against your records.
Runs in the browser, nothing to install. Every company works in its own workspace.
- standards in one workspace
- 6
- guided steps to the certification audit
- 8
- Annex A controls in the Statement of Applicability
- 93
- decisions the AI takes on its own
- 0
Standards
Built for the standards you apply
ISO 27001, ISO 9001 and TISAX run on the guided path to certification. NIS2, SOC 2 and GDPR are checked requirement by requirement in the compliance review.
- ISO 27001ISO/IEC 27001:2022 — information security
- TISAXAssessment Level 2, VDA ISA catalogue
- ISO 9001ISO 9001:2015 — quality
- NIS2NIS2 Directive
- SOC 2SOC 2 Type II
- GDPRGeneral Data Protection Regulation
Getting Started
From an empty workspace to the audit, in eight steps
Getting Started is the guided path inside AuthenticTrust. Each step ticks off from your own records — never because you opened a page, and never because the AI agent said so.
1. Define Scope and Activate Frameworks
Choose ISO 27001, TISAX and/or ISO 9001, describe the context and the interested parties, and get the Description of Scope approved.
2. Invite your team and assign roles
Top management, an Information Security Officer, a Quality Management Representative — each held by a real, active member who has signed in.
3. Build the asset register
Information and processes first, then the hardware, software and services that carry them.
4. Run the risk analysis
One draft risk per asset plus typical scenarios, rated on your own risk matrix, treated with controls from the Statement of Applicability.
5. Author documents and policies
Write them in AuthenticTrust or upload PDFs. Approval by a named person, review dates and renewal are built in.
6. Run your first AI review
Rule-based checks across the selected frameworks; the model words the summary; you decide every recommendation.
7. Close gaps via actions
Accepted recommendations become tasks with an owner and a due date. Nothing closes by itself.
8. Book the certification audit
A proposal with the target period; you send the request to the certification body and record the confirmed date.
With ISO 9001 a ninth step joins the path: Define Opportunities.
What is inside
Everything a standard asks for, in one place
Registers, documents, audits and actions are not separate lists. Most pages read records from other pages, and the compliance review reads them all.
Registers that follow the standard
Context, interested parties, assets, risks, opportunities, the Statement of Applicability, objectives, suppliers, monitoring and measurement. Each register follows the structure of the standard.
Documents and evidence
Policies and procedures written in AuthenticTrust or uploaded as PDF. Every document has a named approver and a review date, and is renewed before it goes stale.
Document vault
Sealed records that can never be changed: signed minutes, certificates, questionnaire summaries. A new version supersedes the old one, and the seal can be verified at any time.
Audits and findings
Internal, second-party and certification audits. Findings become numbered nonconformities or opportunities for improvement, with root cause, corrective action and a review of effectiveness.
Compliance review
Every requirement of every active standard is checked against your records. A figure per standard; proposals for nonconformities wait for your decision.
Tasks, calendar and reminders
Review dates, due dates, audits and training deadlines from all registers in one calendar. The bell shows what is overdue or due within 14 days.
Management review
The inputs come from the registers, the outputs become tasks, and the signed minutes are sealed in the vault.
Decision trail
Every human decision — an approval, an acceptance, a changed framework selection — is recorded with who and when. Decisions that took over an AI proposal are marked.
How the modules connect
One record, shown wherever it matters
A change on one page moves the figure on another — on purpose. This is the chain the standards describe, and it is how AuthenticTrust is wired.
- Assets
- Risks
- Controls / SoA
- Policies & documents
- Audits
- Nonconformities
- Improvements
- 01Assets
- What you protect: information, processes, and the systems that carry them.
- 02Risks
- One risk per asset plus typical scenarios, rated on your risk matrix.
- 03Controls / SoA
- Each risk's treatment names applicable Annex A controls. Marking one Not Applicable flags the risks that use it.
- 04Policies & documents
- They describe how the controls work. A document that references a control is its evidence.
- 05Audits
- Internal audits are planned and done; findings are recorded on the audit.
- 06Nonconformities
- NC-00n with root cause, correction, corrective action, owner and due date.
- 07Improvements
- The review of effectiveness closes the NC; OFIs cover continual improvement.
- The compliance review reads all of it
- It takes the approved documents, the Statement of Applicability, the registers and the evidence, and decides per requirement whether it is fulfilled.
Nothing is copied along the chain: a nonconformity recorded on an audit is the same record in Tasks and in the register.
Risks — asset-based and scenario-based, rated on your matrix Statement of Applicability — 93 Annex A controls with justification and evidence Compliance review — a figure per standard, requirement by requirement Audit Program — internal, second-party and certification audits with their findings
Honest AI
AI, labelled honestly
AuthenticTrust uses the word “AI” in several places. Here is exactly what it means.
Rules decide
Checks, figures, findings, severities and proposals come from fixed rules applied to your records. The same records always give the same result.
The model words
Where a model is used, it rewords a draft the rules produced: a risk description, an SoA justification, the summary of a review. It runs on AuthenticTrust's own server — your data is not sent to a third-party AI service. If it is busy or offline, the rule text stands in, and AuthenticTrust says so.
A person decides
Every AI text is a proposal. Someone accepts it, changes it, restores the original or throws it away. Decisions that took over a proposal are marked in the decision trail.
AuthenticTrust never approves, replaces or signs anything on its own.
No AI feature can approve a document, accept a risk, close a nonconformity, assign a role, activate a framework or book an audit. The assistant answers from your live data and changes nothing.
Labels you will see on screen
- Rule-based draft, worded by the model.
- Rule-based draft; the model was not available.
- Rule-based answer — the AI model could not be reached.
- AI proposal
Workspaces, roles, outsiders
Built for everyone around a certification
The compliance team, the colleagues who report problems, the external auditor and the suppliers — each sees exactly what they should.
One workspace per company
Every company works in its own workspace. Data is never shared between workspaces, and a new workspace starts blank — no demo content, no sample records.
Roles checked on the server
Manager, Contributor and Auditor (read-only). AuthenticTrust checks the role on the server for every change; a hidden button is never the only protection. Only the approver named on a document can approve it.
Auditor portal
Time-boxed, read-only access to the evidence of one audit for your external auditor — no workspace account, no ZIP files by e-mail. Watermarked previews, every view logged, access ends with the audit window.
Supplier questionnaire
Send the Information Security questionnaire as a personal link. The supplier answers online or declines; the summary is filed as a PDF in the document vault.
Submissions from anyone
Colleagues who are not on the nonconformity team can still report a problem. The team accepts, rejects, asks for clarification or turns it into a record.
Reminders by e-mail
AuthenticTrust reminds people about supplier links, pending answers, software requests and the Auditor portal. The bell lists what is overdue or due within 14 days.
FAQ
Questions we hear first
Which standards does AuthenticTrust cover?
ISO/IEC 27001:2022, TISAX (Assessment Level 2), ISO 9001:2015, NIS2, SOC 2 Type II and the GDPR. ISO 27001, ISO 9001 and TISAX run on the guided path to certification; the other three are checked by the compliance review.
Do we need to install anything?
No. AuthenticTrust runs in the browser. Accounts are invitation-only: a Manager of your workspace invites the colleagues and assigns their roles.
Where does the AI run, and what does it see?
The model runs on AuthenticTrust's own server; your data is not sent to a third-party AI service. It sees only the workspace you work in, and only accepted context entries. The assistant reads — it changes nothing.
Can the AI approve, close or delete anything?
No. No AI feature approves, rejects, signs, closes or deletes. Every AI text is a proposal a person accepts or throws away. If the model cannot be reached, the rule-based text stands in.
Is AuthenticTrust available in German?
The application's interface is currently in English. This website and the user guide are available in German; the guide quotes the labels exactly as they appear on screen.
How does our external auditor get to the evidence?
Through the Auditor portal: a Manager invites the auditor for one audit. The auditor signs in on a separate page and sees only what was shared for that audit — on screen, watermarked, logged, until the audit window ends.
What happens to our data?
Every company has its own workspace; data never moves from one workspace to another. Sealed records are never edited — a new version supersedes them. The application runs on servers in the EU. How your data is processed is governed by the contract with you, including the data processing agreement.
How do we start?
Write to contact@novationtec.com. We show you the demo workspace, answer your questions and set up a workspace for your company.
See AuthenticTrust with your own standards.
Write to us. We show you the demo workspace, answer your questions and set up a workspace for your company.