See who is affected
From the regulation through your control to the application and its evidence. When something changes, you see at once which applications are affected.
GRC for cloud and AI workloads
You set the requirements. Do you know whether they are met?
GovHub turns DORA, ISO 27001, the EU AI Act and your own policies into testable requirements for every application – and shows at any time what is in place and what is missing.
- Hosted in the EU
- Human-approved AI
- Open to AI agents
One catalog for every framework you answer to
- DORA
- ISO/IEC 27001
- NIS2
- EU AI Act
- GDPR
- BSI C5
- BSI IT-Grundschutz
- PCI DSS
- SOC 2
- ISO/IEC 42001
- BAIT / VAIT
- Internal controls
The problem
Two worlds, no shared language.
Compliance receives abstract rules and cannot assess the technology. Engineering implements, but cannot show whether it is enough. In between: spreadsheets and email.
-
1 · Requirements stay abstract
“Encrypt your data” leaves 80 ways open. Which one is enough?
-
2 · Knowledge is scattered
When a requirement changes, nobody knows which applications are affected.
-
3 · No feedback loop
Whether requirements are met only shows in the audit – then everyone hunts for evidence.
-
4 · Go-live without approval
Applications reach production before security and data protection have signed off.
Paragraphs become clear tasks.
You break the regulation down into your own control that says exactly what to do – such as “encrypt databases with your own key, rotate keys yearly”. And it applies only where it is needed.
- Write your own control and map it to DORA, ISO 27001 or the EU AI Act
- Proven once, every mapped regulation is met
- Applies only where needed: by application type and protection need
- The AI suggests matching mappings, you decide
| Workload type | Normal | High | Very high |
|---|---|---|---|
| Cloud application | 18 | 41 | 63 |
| SaaS | 12 | 29 | 47 |
| AI use case | 27 | 55 | 82 |
| AI tool | 16 | 35 | 58 |
One place for requirements, applications and evidence.
GovHub links every requirement to the applications it applies to and the evidence that meets it.
Goodbye, Excel
A searchable catalog instead of scattered spreadsheets. Every change becomes a new version; evidence for the old version is marked outdated.
Evidence and review
Teams attach evidence per control. What cannot be met is accepted as a risk – for a limited time only.
Audit-ready at any moment
Status per application and framework: what is proven, what is missing, which approvals expire. Every decision is logged.
No go-live without approval.
You define the stages once, such as privacy and security. Every matching application passes through them – approved by the right people.
-
1
Draft
Register the application, pick its type, answer a few questions.
Intake -
2
Data protection
Conditional questions trigger a privacy impact assessment only when personal data is actually processed.
GDPR check -
3
Pre-Go-Live
Security and compliance review the applicable controls and proof. Multi-eyes approval, separation of duties built in.
Four-eyes -
4
Production
Approved and live. Approvals carry an expiry date; then GovHub reopens the stage.
Audit-ready
Smart questions, not endless forms
- If-then rules show a question only when it matters
- Several lifecycles can run in parallel per workload
- Answers are frozen at submit — history never rewrites itself
- Notifications when a stage needs you, reminders before it expires
AI does the reading. Your experts make the call.
The AI reads your docs and proposes – your experts decide, every proposal with its source.
Simplify controls
Control Quality Reviewer
Finds vague wording, duplicates and gaps across a framework and proposes clearer, testable controls as change proposals.
Proposals, not busywork
Change proposals
The assistant drafts new or clearer controls as change proposals. You accept, edit or discard them.
Find the evidence
Evidence Analyst
Reads the workload's Confluence pages, GitHub repositories, URLs and uploads and proposes proof for open controls — only with verified citations.
Human in the loop — nothing is applied without a person accepting it
Secrets redacted — tokens and keys never reach the model
EU-hosted models — your data stays in Europe
Your landscape
AI, cloud and SaaS – one register for everything.
Start where the pressure is highest – today often the EU AI Act. The same requirements, evidence and approvals then carry your cloud applications and SaaS tools.
Govern AI before it governs you
Register every AI application with risk tier and owner. The EU AI Act and your AI policy apply as requirements; before launch an approval stage checks documentation, oversight and privacy.
- AI register with risk tier and owner
- AI-Act-ready control set, scoped by risk
- Model cards and evaluations as cited proof
Cloud workloads with a real footprint
GovHub reads from Google Cloud which services your applications use and flags services you allow only with conditions.
- Read-only: projects and services from Google Cloud
- Per service: whether and under which conditions it is allowed
- What the platform meets, it proves once for all
SaaS and AI tools under control
Every third-party tool your teams adopt gets a lightweight intake, a protection class and the vendor controls that match. Renewals and re-attestations run on schedule instead of on memory.
- Fast intake for new tools
- Vendor and data-protection checks in one flow
- Periodic attestation with reminders
Getting started
Up and running in four steps.
- 01
Activate frameworks
Start from curated frameworks maintained by Cloudpilots or import your own internal controls.
- 02
Model your landscape
Register workloads with their type, owning team and protection need — or let cloud discovery do the groundwork.
- 03
Define your stages
Set up the lifecycle once: intake, data protection, security review, go-live. Approvers and validity included.
- 04
Let AI help
Switch on the assistants to simplify controls, track framework updates and gather evidence from your sources.
Security & trust
Built like the controls it manages.
EU hosting
Runs in Frankfurt on Google Cloud, with EU-resident AI models.
Open to AI agents
Through the Model Context Protocol (MCP), AI assistants such as Claude work directly with GovHub – only with your consent per app.
Security by design
Each organisation’s data is strictly separated. Cloudpilots sees it only with your explicit release.
Audit-proof
Published versions never change. Every decision is recorded in the audit log.
Pricing
Plans that grow with your landscape.
Pricing details are coming soon.
Starter
For teams replacing their first spreadsheet
Coming soon
- Control catalog and frameworks
- Workloads and proof
- Reports
Plan details coming soon
Professional
For organisations with regulated workloads
Coming soon
- Everything in Starter
- Lifecycle stages and approvals
- AI assistants
- Cloud footprint sync
Plan details coming soon
Enterprise
For groups with many companies and units
Coming soon
- Everything in Professional
- Organisation units and delegation
- Single sign-on and API access
- Dedicated support
Plan details coming soon
FAQ
Questions, answered.
Which frameworks does GovHub support?
Any framework you can describe as requirements: regulations such as DORA, NIS2, the EU AI Act and GDPR, standards such as ISO/IEC 27001, BSI C5 or PCI DSS, and your own internal controls. Cloudpilots maintains a curated global catalog you can activate; your own frameworks live alongside it.
Does the AI change my controls on its own?
No. The assistants only propose. Every suggestion — a clearer control text, an update after a framework revision or a proof assessment — waits in an inbox until a person accepts, edits or dismisses it. Proof suggestions always carry citations to the source they are based on.
How do controls reach an application?
You decide per control which application types and protection classes it applies to. Without a rule it applies to all. Only controls of activated frameworks count.
Where is my data stored?
GovHub runs in the EU (Frankfurt). AI features use EU-resident models, and secrets found in your sources are redacted before anything is indexed.
Can we migrate from our existing spreadsheets?
Yes. Controls, frameworks and workloads can be brought in through the API and the built-in editors. Ask your Cloudpilots contact about a guided migration.
Ready to make compliance visible?
See GovHub with your own frameworks and workloads. Already a customer? Sign in and pick up where you left off.
Demo requests: contact channel coming soon.