DoveSureFAQ
Questions, Answered
What people ask before, and after, they start with DoveSure.
FAQ
Everything You Need to Know
Frameworks, evidence, auditors, Dove, integrations and getting started, in one place.
Use your InvitationWhat is DoveSure?
A continuous assurance platform. It keeps one record of what your organisation is responsible for, tests whether your controls actually operate, and keeps the evidence that proves it, for compliance, risk, privacy, vendors and AI governance.
Which frameworks does DoveSure support?
SOC 2, ISO 27001, Cyber Essentials, UK GDPR, ISO 42001, HIPAA, PCI DSS, DORA and the NIST AI RMF, with a Statement of Applicability where it applies. The framework builder lets you add your own obligations, such as contracts or internal standards.
Will I get a compliance score?
No. A single percentage hides what matters. DoveSure shows counts that link to the records behind them, and rates assurance by dimension: design, operation, evidence strength and freshness.
How do you stop evidence being altered?
Evidence is immutable and hashed, and every material change goes on a hash-chained ledger. Corrections are new records that point to the ones they replace, so history is never rewritten.
Can our auditors work in DoveSure?
Yes. Auditors get a scoped, read-only workspace, see each piece of evidence with its provenance, and can verify the ledger themselves.
What can Dove, the AI assistant, do?
Dove answers from your live records and proposes next steps, such as re-running a test or drafting a questionnaire. It acts with your permissions, never more, only after you confirm, and every action is recorded.
We are an MSP or consultancy. Does it work for us?
Yes. Partners run several client organisations from one portfolio and switch between them, keeping each client’s data separate.
How do I get started?
Accounts are created by invitation from an administrator of your organisation. If a demo is available, you can explore a fictional organisation with every role and module first.
Which systems does DoveSure connect to?
AWS, Microsoft Azure and Google Cloud; Google Workspace, Microsoft 365 / Entra ID and Okta; GitHub; Jira; and BambooHR, all through read-only connectors. A read-only REST API serves your own reporting, and signed webhooks tell your systems when something changes.
Can we publish what we can prove?
Yes. Each organisation can publish a Trust Center that shows customers the controls and evidence you choose to share.
Can we export evidence for an audit?
Yes. Audits produce a verifiable export: the evidence, its provenance and the ledger entries that show it was not changed.
Who can see what?
Access follows ten roles, from employee to auditor, each granted specific capabilities. People see only what their role allows.
Ready to prove it?
Know what you are responsible for, control whether it works, and prove it to anyone who asks.