Questions, Answered

A continuous assurance platform for businesses of every size, from a small firm without an IT team preparing for its first certification to a company running several frameworks at once. It keeps one record of what your organisation is responsible for, checks whether your controls actually operate, and keeps the evidence that proves it, for compliance, risk, privacy, vendors and AI governance.

No. You can answer in your own words and upload the documents and screenshots you already have; for Cyber Essentials that is enough to reach a readiness pack that is ready to submit. Connecting systems such as Microsoft 365 or Google Workspace is optional, read-only, and adds evidence the system observes itself.

No. Only an IASME certification body issues Cyber Essentials. DoveSure prepares you, gives you a signed readiness pack for the self-assessment you submit, and records the certificate once you have it, with reminders 60, 30 and 7 days before it expires.

SOC 2, ISO 27001, Cyber Essentials, UK GDPR, ISO 42001, HIPAA, PCI DSS, DORA, the NIST AI RMF, the EU AI Act, NIS2, NIST CSF 2.0, ISO 27701, CCPA and EU GDPR, with a Statement of Applicability where it applies. The framework builder lets you add your own obligations, such as contracts or internal standards.

No. A single percentage hides what matters. DoveSure shows counts that link to the records behind them, and rates assurance by dimension: design, operation, evidence strength and freshness.

No. A failing check opens one finding for that test, not a new one on every run, and it moves to verification when a later test passes. If you accept a deviation, record an exception with a reason, an approver and an expiry date; when it expires, the finding reopens.

Record the correction. It is a new record that supersedes the earlier one, and both stay in the history your auditor sees. Nothing is overwritten, so a mistake is corrected in the open rather than quietly changed.

Yes. Auditors get a scoped, read-only workspace, see each piece of evidence with its provenance, and can verify the ledger themselves.

Dove answers from your live records and proposes next steps, such as re-running a test or drafting a questionnaire. It acts with your permissions, never more, only after you confirm, and every action is recorded.

Choose Sign up: where this site offers Create your organisation, you can set it up yourself; otherwise accounts are created by invitation from an administrator of your organisation. If a demo is available, you can explore a fictional organisation with every role and module first. Where the site shows Request a demo, a person at DoveSure reviews your request and you get your own time-limited workspace with fictional records (its length is shown when you ask), deleted when the time is up.

Yes. AI governance finds the AI in use, keeps one inventory with the reason for every risk class, ties each approval to the version that runs, tests systems at endpoints you authorise, decides what agents may do before they act, and watches what they do in operation. See /product/ai.

Evidence is immutable and hashed, and every material change goes on a hash-chained ledger. Corrections are new records that point to the ones they replace, so history is never rewritten.

Yes. Partners run several client organisations from one portfolio and switch between them, keeping each client’s data separate.

AWS, Microsoft Azure and Google Cloud; Google Workspace, Microsoft 365 / Entra ID and Okta; GitHub; Jira; BambooHR; Microsoft Intune, Jamf Pro, CrowdStrike Falcon, Snyk and KnowBe4, all through read-only connectors. A read-only REST API serves your own reporting, and signed webhooks tell your systems when something changes.

No. DoveSure keeps your record and helps you prepare; framework suggestions are a starting point, not professional or legal advice.

Yes. Each organisation can publish a Trust Center that shows customers the controls and evidence you choose to share.

Yes. Audits produce a verifiable export: the evidence, its provenance and the ledger entries that show it was not changed.

Access follows ten roles, from employee to auditor, each granted specific capabilities. People see only what their role allows.

Where this site offers a demo, you ask with your name, company, work email, industry and what you want to see, and confirm your email address. You can also give your company’s website: it is optional, and it helps the person reviewing your request when you use a personal address such as Gmail or your email domain is not your website’s. A person at DoveSure reviews every request. To help them, DoveSure reads the public home page of your email’s domain once, as a browser would, and of the website you gave if it is a different one, to see what the company does, and asks each domain’s registry when it was registered; it does not scan your systems. If approved, you get a single-use link to a temporary workspace with fictional data and every role, open for the time the approval email states (an hour and a half unless DoveSure sets otherwise), with a guided tour, and then deleted. What you told us is deleted a day after you asked.