What we're building

Automated scan of web-facing infrastructure: TLS configuration, security headers, DNS records, CMS fingerprinting with known-CVE checks.

First version of the NIS2 questionnaire (Q1 2026), built on the areas of Article 21(2) NIS2 — governance, risk, incidents, supply chain, cryptography and more. The question set has grown since.

Automatic NIS2 scope determination from Czech/Slovak VAT IDs using ARES and ORSR APIs with sector classification.

Claude-generated compliance recommendations with explicit references to NIS2 articles, SK Act 366/2024 and CZ Act 264/2025.

Downloadable PDF with scan results, compliance gaps, recommendations and roadmap — ready to share with management.

NIS2 fine calculator, board liability check, contract clause generator, incident deadline tracker, threat & vulnerability catalog.

Built-in library of 23 threats, 28 vulnerabilities and 34 asset types mapped to ENISA Top-8, MITRE ATT&CK, OWASP Top 10 and CIS Controls.

Scanner now queries the NIST NVD database for fresh CVEs affecting detected CMS and PHP versions, complementing the hardcoded CVE list.

Honest feature-by-feature comparisons with Cyberday, Kybeon, Vanta and Drata for CZ/SK buyers evaluating alternatives.

Upgrade AI reports from Haiku to Sonnet for deeper analysis, richer context and stronger legal reasoning.

Adversarial AI review that simulates a real regulator audit — finds gaps a checklist would miss before the real inspection arrives.

5-minute wizard with VAT ID auto-prefill, sector detection and first scan — so users hit their first 'aha' moment without friction.

Central register of security incidents with automatic NIS2 (24h/72h/1-month), DORA and GDPR deadline tracking and reminders.

ROPA (Article 30 GDPR), processor register with DPA, DPIA generator (Article 35 GDPR), breach register (Art. 33/34 GDPR), international transfer map (Art. 44–49 GDPR), sub-processor register and DSAR workflow — all backed by audit log and retention crons.

ICT third-party register per Art. 28(3) DORA — provider identification, criticality of function, LEI, substitutability, exit strategy, SLAs and audit rights. ESA reporting-compatible.

Cyberday-style % overlap indicator showing how an ISO 27001 or GDPR assessment maps onto SK Act 366/2024 and CZ Act 264/2025.

Guided Data Protection Impact Assessment with auto-populated threat and vulnerability sections from the built-in catalogs.

Detect whether you're dragged into NIS2 scope via a parent company, supplier, or customer — even when your own entity is formally out of scope.

Feedback contact data, auth_attempts emails and client IPs are pseudonymized with pgcrypto + salted SHA-256. Peppers live in Supabase Vault with a documented rotation procedure.

TOTP MFA with recovery codes, session management UI, HIBP password check, strength meter, brute-force lockout, CSRF, rate limiting, re-auth on sensitive actions and RBAC (owner/admin/member).

Every citation in AI reports (NIS2 Art. 21, § of SK Act 69/2018 Coll. as amended by Act 366/2024, vyhláška 227/2025, CZ Act 264/2025) is cross-checked against a known-sections registry — LLM hallucinations are flagged before the user sees them.

Anonymized aggregated report from our scans (SK/CS/EN) — score distribution, sectoral view, country context from entyrix.com. For press, regulators and customers.

Vendor Auto-Audit from ICO — security score, sanctions, credit score, UBO and findings in a single call. IBAN check against the SK tax-office register (invoice fraud). NIS2 scope cross-validation, 18-obligation checklist, VIES VAT validation, sector benchmark and daily vendor change monitoring.

Visualization of vendor ↔ person ↔ company links via directors, shareholders and beneficial owners (RPVS) with color-coded bankruptcy, tax debt, sanctions and CVE flags. Art. 29 DORA concentration risk via automatic shared-UBO and corporate-parent detection.

Pre-filled reports for NBÚ/NÚKIB with entity identification, NIS2 scope, incident category, chronology, actions taken and references to § 20 and § 24 of SK Act 69/2018 Coll. (as amended by Act 366/2024) or to CZ Act 264/2025 Coll. — a PDF ready to submit.

Public Terms of Service (SK Act 108/2024, CZ NOZ § 1829) and Imprint (§ 4 of Slovak Act 22/2004) with operator details, supervisory authorities (SOI, ČOI, UOOU), ADR bodies and Art. 50 AI Act transparency disclosures.

Turnstile fail-closed in prod, daily caps on scope-check and company-search (protects the company register from scraping), monthly cap and spend alert for the AI express assessor, and Schrems II / SCC transfer guarantees plus Art. 22 GDPR disclosure added to the privacy policy.