See evidence checked against the rules. Then picture it running on yours.
A working reference build, shown on an ISO 27001 and SOC 2 scenario. Your version is configured to your rules, systems and sign-off — for audits, KYC, transaction review or policy checks.
No demo login yet?
- Evidence mapped to controls on arrival
- Consistency checks before fieldwork
- Exceptions routed with a trail
- Reports generated from the workflow
Where compliance work breaks down
Two sides of the same rule — those who check it and those who must prove it's followed. Pick the one that sounds like you and we'll show how the reference build handles it.
Reading every policy and cross-checking every piece of evidence by hand takes weeks — and it is the same weeks on every single engagement.
Evidence turns up as 200 ZIP files and a shared-drive link, with nothing filed against a clause. Sorting it is day one of the job.
The report is due at the closing meeting, in each regime's own wording, and it has not been started.
We approved the policy months ago. Whether the team actually follows it, we only find out when something goes wrong.
The first time we hear about a major finding is at the closing meeting, when it is already on the record.
The same nonconformity comes back at every surveillance audit, because nobody established why it happened.
The building blocks we start from
Components SmartDev has already engineered. In production, we switch on only what your workflow needs.
- Pre-built
- Configured per client
- Built per engagement
AI Finding Insights
Pre-builtConsistency checks run before fieldwork, catching version errors and register mismatches early.
Confidentiality & Data Isolation
Configured per clientRuns with the residency and access controls you require. Never used to train public models.
Integrations & Continuous Monitoring
Built per engagementPulls evidence from source and keeps watching between reviews. AWS and GitHub live in the demo.
Token-Based Evidence Requests
Pre-builtAuditees upload via a secure link into a clause-filed index. No account needed.
Pre-Audit Gap Scanner
Pre-builtReadiness scored per framework, so gaps are known before certification.
Findings & Report Drafting
Pre-builtFindings drafted in each regime's wording, exported to Word or PDF for review.
Three-Tier Evidence Map
Pre-builtEach requirement mapped to policies, records and technical artefacts.
Cross-Framework Evidence Reuse
Configured per clientOne control library, so a second framework starts as a delta.
Two-Tier Access Model
Pre-builtAuditees see checklists; test criteria stay with the auditor.
Corrective & Preventive Action Engine
Pre-builtRemediation with owner, due date and root cause — verified, not just closed.
From raw document to reviewable finding, step by step
Two pipelines do the heavy lifting. One turns a regulation or internal policy into testable controls; the other runs evidence against them — as a remediation loop for compliance teams, or a sign-off flow for auditors. Every run is logged, and every conclusion stays with a person to approve.In the demo, both pipelines run on sample documents. In production, the controls, thresholds and approval steps are set with your process owner.
Control Framework Builder
How a regulation becomes your organisation's compliance guideline.
- Upload regulation documentPDF, DOCX, scanned gazettes
- Control extractionRequirements → testable controls
- Compliance guidelineYour organisation's rulebook
Assessment & Remediation
Evidence judged, remediated and re-checked until it passes.
- Upload evidenceUploads + live connectors
- Extract findingsAutomated consistency tests
- AI judge against controlsGraded per regime wording
- Remediation suggestionFix guidance per failed control, looped back to evidence
- Compliance reportWord / PDF, ready for review
Assessment & Sign-off
Evidence becomes a defensible, signed-off report.
- Upload evidenceUploads + live connectors
- Extract findingsAutomated consistency tests
- AI judge against controlsGraded per regime wording
- Auditor approvalFindings confirmed and signed off
- Compliance reportWord / PDF, ready for review
The audit is one workflow. Compliance runs in many more.
What the demo shows — evidence checked against an approved rule, exceptions routed with a trail, a record kept continuously — is the same pattern behind every compliance workflow below. ISO and SOC 2 assessment is simply the one we've built a walkthrough for.
KYC file completeness
Every required document present and current — checked continuously, not just once at onboarding.
Transaction-exception review
Flagged transactions checked against the approved policy, with a traceable reason recorded for every disposition.
Policy adherence monitoring
The live process checked against the policy that was actually approved, on an ongoing basis — whichever framework applies.
Your workflow?
If a process has to follow an approved rule and you need to prove it does, it's likely a fit. Bring us the workflow and the rule it should follow.
Each workflow is qualified with your process owner before anything is built — so we'll tell you early if it isn't worth taking to production.
Connected to the systems where your evidence already lives
In a production deployment, NORA connects to your ERP and IT estate to collect evidence and watch for control deviations — so risk is monitored between reviews, not just during them. In the demo, AWS and GitHub run live; every other connector is configured during deployment.
Evidence, pulled from source
In production, configuration exports, access lists, change logs and approval records are pulled straight from source systems — timestamped, tamper-evident, and mapped to the control they answer.
Risk signals, watched continuously
In production, control-relevant signals are watched around the clock. A repository turned public, an over-privileged account, an unapproved production change — each is raised as a finding with the evidence attached.
- Live in the demo
- Configured during deployment
- AWS(live in the demo)
- GitHub(live in the demo)
- SAP
- Oracle NetSuite
- Odoo
- Microsoft Azure
- Google Cloud
- GitLab
- Jenkins
- Jira
- Confluence
- ServiceNow
- Slack
- Microsoft Teams
- SharePoint
- Okta
- Microsoft Entra ID
- + REST API & webhooks
Control libraries we start from
ISO/IEC 27001 and SOC 2 are ready today and run in the demo. Other frameworks are mapped in with your team on request.
ISO/IEC 27001:2022
Annex A, 93 controls — control set, test criteria and tiered evidence expectations.
SOC 2 Type I & II
AICPA Trust Services Criteria — control set, test criteria and tiered evidence expectations.
NORA Compliance supports readiness, evidence management and internal assessment. Certificates of conformity are issued solely by accredited certification bodies, and SOC 2 opinions solely by independent licensed CPA firms. Nothing on this page constitutes legal advice or a regulatory determination.
Framework or system not listed? Discuss it with SmartDev (opens in a new tab)
From demo to a workflow running in your environment
Your baseline KPIs are measured in Workflow Qualification — so the numbers you see are yours, not ours.
- 01 · 1–3 weeks
Workflow Qualification & Production Design
Map your approved rules, surface the exceptions, and leave with baseline KPIs plus a clear build, redesign or stop decision.
- 02 · 6–10 weeks
Production Deployment
One compliance workflow live in your environment, connected to the systems where the evidence sits, with agreed controls.
- 03 · 12-month default
Operate & improve
Quality, exceptions, cost and controls managed continuously, with regular KPI review against the baseline.
- 04 · 3–9 months
Scale
The proven pattern extended to adjacent policies, business units or frameworks.
The questions every buyer asks
Is this the product we'd buy?
No. It's a reference build that shows how the components work, using sample data. What you'd get is one compliance workflow deployed in your environment, configured to your rules, and run with you after go-live.
Does NORA Compliance only cover audits?
No. ISO and SOC 2 assessment is the scenario this demo walks through. The same building blocks run KYC completeness checks, transaction-exception review, policy adherence monitoring and other workflows where a process has to be evidenced against a rule.
Talk to the SmartDev team (opens in a new tab)What does the demo not show?
Your systems, your rules and your exceptions. Those are mapped with your process owner in Workflow Qualification, before anything is built.
Isn't this just another document repository?
No. Shared storage holds files; NORA reasons about them. It applies codified compliance reasoning — testing evidence against the approved rule, corroborating records, and surfacing deficiencies a keyword search would miss.
Can NORA certify us or issue a SOC 2 report?
No — and be wary of any tool that implies it can. Certificates of conformity are issued solely by accredited certification bodies, and SOC 2 opinions solely by independent licensed CPA firms. NORA gets the evidence in order and supports the engagement; it doesn't replace it.
Is our data used to train AI models?
Never. Your documents and system logs are never used to train public models. Encryption, residency and access logging are configured to your requirements during deployment.
Does the auditee have to buy or adopt anything?
No. The auditee receives a secure link and uploads evidence into a pre-structured index — no account or licence on their side.
How do I get access to the demo?
The demo runs behind a login. If you don't have one yet, request access from the SmartDev team and we'll set you up.
Seen enough to picture it in your workflow?
Whether it's an audit engagement, a KYC process or a policy you need to prove is followed — bring one workflow and the rules it should follow. We'll tell you whether it's worth taking to production.
Read how NORA Compliance works (opens in a new tab)