DoveSureSign inUse your InvitationSign in

The platform

One Record for the Whole Programme

Not a SOC 2 tool next to an ISO tool next to a GDPR tool. One organisational truth, with every framework mapped into it and every control tested continuously.

Compliance Management

Implement and maintain SOC 2, ISO 27001, Cyber Essentials, UK GDPR, HIPAA, PCI DSS, DORA and your own frameworks.

Explore Compliance Management
  • FrameworksEvery framework mapped into one record, with a Statement of Applicability where it applies.
  • ControlsOne canonical set of controls, each tested continuously and rated by dimension.
  • EvidenceImmutable and hashed, stamped with how it was produced.
  • AutomationsScheduled tests that keep evidence fresh and raise findings when something drifts.
  • Framework builderYour own obligations, from contracts or internal standards, versioned.

Risk & Vendor Management

Identify, assess and monitor risks and third parties continuously.

Explore Risk & Vendor Management
  • FindingsClosed only when a later test proves the fix held.
  • ExceptionsTime-boxed and approved, with a reminder before they lapse.
  • Risk registerOwners, treatment and the controls that reduce each risk.
  • VendorsDue diligence with certificates on file and reviews on a schedule.
  • IncidentsFrom detection to lessons learned, on the record.

Privacy & Data Protection

Processing records, DPIAs, data-subject requests and data governance, made simple.

Explore Privacy & Data Protection
  • Processing recordsWhat you process, why, and on what lawful basis.
  • DPIAsData protection impact assessments, linked to the systems they cover.
  • Data-subject requestsTracked against their statutory deadlines.
  • AssetsWhat you run and who owns it.
  • Access reviewsDecisions that become evidence.

AI Governance

Govern the AI you build and buy: find it, keep one inventory, tie each approval to the version that runs, test it, control what agents may do before they act, and watch it in operation.

Explore AI Governance
  • DiscoveryAI found in repositories, agent configurations, the vendor register and agent requests, reconciled with the inventory.
  • Inventory and lifecycleEach system’s owner, purpose, risk class with its reason, use cases and the assessments its facts call for.
  • Agent control planeAgents ask before they act; each request is allowed, limited, held for a person or denied by its grants.
  • Assurance labVersioned test cases sent only to an endpoint you authorise, each answer judged by its rule.
  • Runtime monitoring and remediationWhat it did in operation, judged by the same rules; a fix is proposed, and a person approves it.

Governance & Trust

Policies, audits and a Trust Center, backed by a ledger anyone can verify.

Explore Governance & Trust
  • PoliciesVersioned, with staff acknowledgements.
  • AuditsScoped auditor workspaces and a verifiable export.
  • Trust CenterWhat you can prove, published for customers.
  • QuestionnairesAnswered from your live records.
  • Assurance ledgerEvery material change, hash-chained.

Carbon & ESG

Scope 1, 2 and 3 emissions calculated from your bills, meters and suppliers, with every factor cited and every figure traceable.

Explore Carbon & ESG
  • Upload and planDrop in bills, spreadsheets and logs; Dove shows its plan, quoting what it read, before anything is recorded.
  • Every scopeFuel, refrigerant gases, location- and market-based electricity, and screening of every Scope 3 category.
  • Cited factorsPublished emission factors with their source and file hash, reviewed by someone other than the person who added them.
  • Suppliers and productsSupplier data in Scope 3, and product carbon footprints on the GHG Protocol Product Standard and ISO 14067.
  • Targets and reportsBudgets, targets and an inventory that says what it covers and what it does not.

Connected Asset Compliance

Continuous compliance for equipment and connected assets: signed readings, devices you can trust, and a recorded answer to “may this asset operate now?”.

Explore Connected Asset Compliance
  • Asset registerEquipment, its inspections, firmware and bills of materials, owned before anything is observed.
  • Signed readingsReadings arrive signed by a registered device key; forged, replayed and stale readings never count.
  • Device trustCalibration, tamper signals and key rotation decide how far a device’s readings can be relied on.
  • Compliance twin“May this asset operate now?” answered with the reasons, each naming its record.
  • GatewayRead-only adapters for OPC UA, BACnet/IP, M-Bus, MQTT and Modbus TCP, with SDKs for Node.js and Python.

How it works

From First Answer to Proven in Four Steps

  1. 1

    Answer or connect

    Answer in your own words and upload what you have; no integrations are needed to start. Connect cloud, identity and device systems with read-only access when you want them observed.

  2. 2

    Map

    Pick your frameworks. One set of controls maps to all of them, so nothing is done twice.

  3. 3

    Test continuously

    Scheduled tests check that connected controls still operate. Drift opens one finding per failing test, not an alert on every run, and a later pass verifies the fix.

  4. 4

    Prove

    Share evidence with its provenance with auditors, customers and your board, from a Trust Center or an export.

Integrations

Evidence From the Systems You Run

AWS

Root and console MFA, S3 public access and CloudTrail logging, with the SecurityAudit policy.

GitHub

Two-factor enforcement, branch review rules and ageing Dependabot alerts, read-only.

Okta

MFA on every active user and dormant accounts, with a read-only token.

Google Workspace

2-Step Verification for every user and administrator, and dormant accounts, through read-only domain-wide delegation.

Microsoft 365 / Entra ID

MFA registration, whether Security Defaults or Conditional Access actually require MFA, administrators and dormant accounts.

Microsoft Azure

Storage public access and TLS, Activity Log export and Defender for Cloud, with the Reader roles.

Google Cloud

Bucket public access prevention, uniform access and project IAM, with read-only roles.

Jira

Security issues past their remediation window, and whether production changes are ticketed.

BambooHR

Leavers with their termination dates, and employees without a manager, for joiner and leaver controls.

Microsoft Intune

Disk encryption, compliance and check-ins for every managed device, named device by device.

Jamf Pro

Management, FileVault and check-ins for every Mac, with a read-only API client.

Snyk

Open critical and high issues and how long each has been open, judged against your remediation window.

CrowdStrike Falcon

Sensor health, prevention policy and reduced functionality for every host, with a read-only API client.

KnowBe4

Security awareness training completion for every active user, with expired and past-due courses named, and recent phishing simulations.

REST API & webhooks

A read-only REST API for your own reporting, and signed webhooks that tell your systems when something changes.

Dove, Your Compliance Operator

Dove answers from your live controls, evidence and findings, then proposes the next step: re-run a test, request an exception or draft a questionnaire. You confirm each one. It acts with your permissions and goes on the ledger.

How Dove is governed

Ready to prove it?

Know what you are responsible for, control whether it works, and prove it to anyone who asks.

Use your Invitation