ProveStack by Seculogik
FR Contact us

Product Four modules, one evidence record

Readiness for four frameworks, evidence you can defend

ProveStack guides your team through each requirement, records the decisions people make and keeps the evidence behind them. Screenshots show the running product with fictional data; capabilities not delivered yet carry their status and are never mocked up.

Available in the pilot today On request set up with you In development not usable yet

01 Cyber Resilience Act

CRA readiness for each product you ship

  • AvailablePreliminary CRA orientation per product and an obligation catalogue with legal references and dates; a person records each applicability decision with a rationale.
  • AvailableInventory: releases with support periods, CycloneDX JSON SBOM import with source hash, import from GitHub per release.
  • AvailableAdvisories and exploited vulnerabilities: OSV import with explainable matching, CISA KEV and ENISA EUVD feeds, guided checks you run yourself.
  • AvailableReporting preparation: early warning, notification and final report deadlines from the time you became aware; a person submits through the ENISA platform.

The CRA, requirement by requirement

The public demo walks through this CRA journey with fictional data.

Open the public demo

02 ISO/IEC 27001

An ISMS you can explain, control by control

  • AvailableClauses 4 to 10 and Annex A, referenced by identifier, with titles, summaries and steps in our own words: you need your own licensed copy of the standard.
  • AvailableStatement of Applicability and target and achieved maturity per control.
iso 27001 / annex AFictional data
ISO/IEC 27001 module: Annex A filters and one control with its applicability, maturity and evidence status, next to its guidance.
Annex A, filtered by theme, applicability and evidence status.

03 GDPR

35 requirements and your record of processing

  • AvailableApplicability questionnaire that proposes a decision for each of the 35 requirements; a person confirms it with a reason.
  • AvailableRecord of processing activities, versioned, with an owner per activity and an export for the authority.
gdpr / requirementsFictional data
GDPR module: requirements by article and, for the record of processing activities, what to do, the evidence to expect and the proposed applicability decision.
A requirement with its guidance, expected evidence and proposed decision.

04 SOC 2

Type 1 and Type 2 readiness

  • Available61 criteria referenced by identifier, the engagement setup and the system description.
  • AvailableObservation-period coverage for Type 2: which evidence covers which part of the period.

A SOC 2 report is issued by an independent CPA firm after its examination. ProveStack prepares readiness and keeps evidence; it does not attest.

soc 2 / readinessFictional data
SOC 2 module marked readiness only, with the engagement setup of a fictional Type 2 period and a note that the system description is not complete yet.
Engagement setup of a fictional Type 2 period.

05 Operations

Incidents, vulnerabilities and the clocks behind them

  • AvailableIncident management: CRA Article 14 and GDPR Articles 33 and 34 notification decisions and deadlines. ProveStack does not decide whether an incident is notifiable; a person does, with a recorded rationale.
  • AvailableVulnerability tracking: remediation deadlines from your own policy, history, the CRA reporting path for actively exploited ones.
  • AvailableNotification centre, with optional e-mail.
incidents / INC-2026-001Fictional data
A fictional data-leak incident: category, personal data, detection and awareness times, and the handling steps.
vulnerabilities / registerFictional data
Vulnerability register with open, overdue, due-soon and actively exploited counts, and the list with deadlines.

06 Across modules

One evidence engine

  • AvailableLearning journey led by documentation, with knowledge checks, and guidance for every requirement.
  • AvailableEvidence files stored with their SHA-256, write-once; independent review of each version, no self-approval.
  • AvailableExpiry and renewal, and a dashboard with denominators: counts of reviewed records, never a compliance percentage.
  • AvailableAuditor packet export with evidence, decisions, journal and open items.
  • In developmentEncrypted, immutable vault with retention lock and SHA-256 verified on every read, and a cold archive for older evidence.
dashboardFictional data
Compliance dashboard: per module, accepted, expiring, awaiting review, rejected, expired and missing evidence, each shown against its denominator.
Counts with denominators: a record of reviews, not a score.

07 Add-on

AI companion, for drafts a person reviews

  • On requestAsk AI about a requirement and its evidence, and GRC skills that prepare drafts. Every answer cites its sources, is watermarked, and is never applied automatically.
  • On requestModel served through Ollama: hosted (drafts are computed by a third-party model provider) or, on premises, a local model.

See the With AI offer

evidence / ask AIFictional data
Ask AI panel next to an ISO/IEC 27001 requirement: the question, a draft marked as prepared for human review, and the cited guidance and evidence.
A cited draft, labelled for human review.

See it on your own scope

A pilot runs ProveStack on your instance with your people. Prices are public; pilot terms on request.

Ask for a demo See pricing