The evidence bundle, NIS2 duties, GDPR requests, the EU AI Act, and how findings map to DORA and ISO 27001.
18 articles
Compliance evidence
NIS2, DORA and SOC 2 all want evidence that access is periodically justified. What the platform does today, what it does not, and how to run a defensible review now.
Compliance evidence
How the incident story, insurer notice, NIS2 early warning, staff note and customer email are drafted from your records, and why nothing is ever sent.
Compliance evidence
What the data export contains, exactly what erasure removes and in what order, the retention model, and the encryption facts you can cite in a questionnaire.
Compliance evidence
The same control expressed in three vocabularies. The NIS2 to ISO 27001:2022 Annex A mapping, the DORA articles findings cite, and what a mapping does not give you.
Compliance evidence
Isolation is enforced in the application, not by the database. Row-level security policies exist on fifteen tables and are inert, and a reviewer is entitled to know which is which.
Compliance evidence
What the eight elements are, why the register lets you save an incomplete record, and the undocumented way amending one actually works.
Compliance evidence
Article 20 puts the duty on the management body, not the IT department. The ten controls to evidence, the reporting clock, the penalties, and what approval requires.
Compliance evidence
The 24-hour, 72-hour and one-month schedule, what the incident register in Qorionix does and does not do for you, and how to file when the register cannot help.
Compliance evidence
When an assessment is required, what the five elements ask, and why a high residual risk raises a duty the product names but cannot enforce.
Compliance evidence
How the NIS2, ISO 27001, GDPR, DORA and Cyber Essentials statements are built, what covered/gap/not covered mean, and how to send an auditor a read-only link that expires.
Compliance evidence
The register of information Article 28 asks you to keep: what a row records, why every status starts at its worst value, the concentration view, and the six duties this page cannot measure.
Compliance evidence
What the AI Act asks of an organisation that uses an AI system rather than builds one, what the system card records, and why the inference region says unverified.
Compliance evidence
One hash-stamped JSON object covering NIS2, DORA, GDPR and the EU AI Act. What is in each section, how the integrity hash is verified, and what it does not claim.
Compliance evidence
What the six pages of the evidence pack measure, what "attested" and "cannot measure" mean, and how the verify link lets a broker or auditor confirm it without seeing your data.
Compliance evidence
What a hash-chained audit trail is in plain terms, how to verify one, what linkage and content mean, and the difference between the two chains in the platform.
Compliance evidence
The ten things an auditor, an insurer or a large customer actually asks for, exactly where each comes from in the platform, and the ones we cannot produce.
Compliance evidence
Home-region binding as a mechanism, what is stored where, why AI inference is a separate question, who else touches your data, and what a DPIA needs from us.
Compliance evidence
How the incident response plan is written from your real setup, what the green and amber dots mean, what a commitment is, and how to attest the plan.