Standards and controls
A catalogue of standards: ISO 27001, NEN 7510, NIS2, BIO, SOC 2 and more. One measure can satisfy several standards at once, and coverage is measured on three levels: design, existence and operation.
What it is
From standard to evidence, one chain
Pulse connects a standard to the controls it asks for, the security measures that implement them, the policies and tasks behind those, and the evidence that proves them. Where that chain breaks, there is a gap, and Pulse shows it.
The registers
Processes, assets, risks, incidents with the duty to report and recovery plans, physical locations, suppliers with contracts, processing agreements and questionnaires, tasks, policies and audit planning, with a log that cannot be edited.
Evidence and reports
Proofs collected in Pulse or from SharePoint, and the reports an audit asks for: the Statement of Applicability, audit readiness, a risk report and an evidence index.
Gappie, the AI assistant
Reads what is in your environment and makes proposals: a gap analysis of policies against a standard, evidence checked against a policy, measures and risks suggested. It never records anything itself, never acts outwardly, and never decides whether you comply.
Pulse does not make you compliant. It shows what you agreed, what you did and what you can show for it; the judgement stays with you and your auditor.
Who it is for
Organisations that run an ISMS, and the partners who help them
CISOs, IT managers, compliance officers and internal auditors in healthcare, finance, legal, government and managed services. And implementation partners: the partner portal lets a consultancy or managed service provider follow its customers' environments from one overview and work in them with an account of its own, after the customer's consent.
What you can count on
Your own environment, your data in the EU, open to your tools
Your own environment
Every organisation has its own address and its own isolated data. People sign in with the organisation's own Microsoft Entra directory, connected by the organisation itself; local accounts use two-step verification.
Data in the EU
Production runs in data centres in the Netherlands and Germany. Gappie's model runs on infrastructure PulseComply manages itself: documents never go to a commercial AI provider and are not used for training.
Open to your tools
Per organisation: a public API over the same registers, connected apps with scopes, personal tokens with every write logged, an MCP server so an assistant can do what you can do in the browser and nothing more, and a developer portal with the documentation and a changelog.
A help centre that fits you
Help in Dutch and English, filtered on what your organisation has, with a search and an assistant that read the help articles, not your registers or your evidence.