GovHub
Log in

GRC for cloud and AI workloads

You set the requirements. Do you know whether they are met?

GovHub turns DORA, ISO 27001, the EU AI Act and your own policies into testable requirements for every workload – whether application, AI use case or SaaS tool – and shows at any time what is in place and what is missing.

See how GovHub solves it Log in
  • Hosted in the EU
  • Human-approved AI
  • Open to AI agents

One catalog for every framework you answer to

  • DORA
  • ISO/IEC 27001
  • NIS2
  • EU AI Act
  • GDPR
  • BSI C5
  • BSI IT-Grundschutz
  • PCI DSS
  • SOC 2
  • ISO/IEC 42001
  • BAIT / VAIT
  • Internal controls

The problem

Two worlds, no shared language.

Compliance receives abstract rules and cannot assess the technology. Engineering implements, but cannot show whether it is enough. In between: spreadsheets, meetings and guesswork.

Paragraphs become clear tasks.

You break the regulation down into your own control that says exactly what to do – such as “encrypt databases with your own key, rotate keys yearly”. And it applies only where it is needed.

  • Write your own control and map it to DORA, ISO 27001 or the EU AI Act
  • Proven once, every mapped regulation is met
  • Applies only where needed: by workload type and protection need
  • The AI suggests matching mappings, you decide
Applicable controls per workload type and protection class (example)
Workload typeNormalHighVery high
Cloud application184163
SaaS122947
AI use case275582
AI tool163558

One place for requirements, workloads and evidence.

GovHub links every requirement to the workloads it applies to and the evidence that meets it.

See who is affected

From the regulation through your control to the workload and its evidence. When something changes, you see at once which workloads are affected.

Goodbye, Excel

A searchable catalog instead of scattered spreadsheets. Every change becomes a new version; evidence for the old version is marked outdated.

Proof and review

Teams attach evidence per control. What cannot be met is accepted as a risk – for a limited time only.

Audit-ready at any moment

Status per workload and framework: what is proven, what is missing, which approvals expire. Every decision is logged.

Everything connected

Policies, workloads, teams and cloud – in one graph.

Your workloads sit in a CMDB, your teams in the org chart, your policies in PDFs and your cloud in the console. GovHub links them – and that answers questions no single tool can.

Questions GovHub answers (example)

  • Who is affected?

    DORA Art. 9 reaches the Payments API through control CTL-0087.

  • Who is responsible?

    The Payments team owns the workload; SecOps answers for information security.

  • How well is it covered?

    Per workload and framework: what is proven, what is open, which approvals expire.

  • Which cloud does it run on?

    Google Cloud project prj-payments-prod, using Cloud SQL and Cloud Run.

No go-live without approval.

You define the stages once, such as privacy and security. Every matching workload passes through them – approved by the right people.

  1. 1

    Draft

    Register the workload, pick its type, answer a few questions.

    Intake
  2. 2

    Data protection

    Conditional questions trigger a privacy impact assessment only when personal data is actually processed.

    GDPR check
  3. 3

    Pre-Go-Live

    Security and compliance review the applicable controls and proof. Multi-eyes approval, separation of duties built in.

    Four-eyes
  4. 4

    Production

    Approved and live. Approvals carry an expiry date; then GovHub reopens the stage.

    Audit-ready

Smart questions, not endless forms

  • If-then rules show a question only when it matters
  • Several lifecycles can run in parallel per workload
  • Answers are frozen at submit — history never rewrites itself
  • Notifications when a stage needs you, reminders before it expires

AI does the reading. Your experts make the call.

The AI reads your docs and proposes – your experts decide, every proposal with its source.

Simplify controls

Control Quality Reviewer

Finds vague wording, duplicates and gaps across a framework and proposes clearer, testable controls as change proposals.

Proposals, not busywork

Change proposals

The assistant drafts new or clearer controls as change proposals. You accept, edit or discard them.

Find the evidence

Evidence Analyst

Reads the workload's Confluence pages, GitHub repositories, URLs and uploads and proposes proof for open controls — only with verified citations.

Bring your own AI client

Open interface (MCP)

Connect your own AI client through the Model Context Protocol. It signs in with OAuth 2.1 and you consent per app. It reads frameworks, controls, workloads and compliance, creates and updates workloads, submits proof and lifecycle steps and decides AI suggestions – approvals stay in GovHub.

Human in the loop — nothing is applied without a person accepting it
Secrets redacted — tokens and keys never reach the model
EU-hosted models — your data stays in Europe

What's in it for me

Everyone sees their part – and the same truth.

Compliance, engineering, approvers and leadership work on the same connected data. Each gets the view that answers their question.

See where you stand – without chasing spreadsheets

Break regulations down into your own controls once, map each to the frameworks you answer to and see per workload what is proven, what is open and which approvals expire.

  • One control, mapped to several regulations
  • Coverage per workload and framework at any time
  • Every decision logged for the audit

Know what to build – and show that it is enough

You get clear, testable tasks for your workload instead of paragraphs. Attach proof where you already work, and let the evidence assistant suggest it from your repositories and Confluence pages.

  • Controls worded as tasks you can implement
  • Evidence suggested from repos, pages and uploads – with citations
  • Connect your own AI client through MCP

Approve with the facts in front of you

A submission reaches you only when a stage needs your decision. You see the answers, the controls and the proof behind them – then approve with four-eyes and an expiry date.

  • Privacy review only when personal data is involved
  • Four-eyes approval with separation of duties
  • Reminders before an approval expires

Decide on facts, not on gut feeling

See which workloads are audit-ready, where a risk has been accepted and what still blocks a go-live – per framework, in one place.

  • Audit readiness per workload and framework
  • Accepted risks limited in time
  • A complete trail of who approved what

Your landscape

AI, cloud and SaaS – one register for everything.

Start where the pressure is highest – today often the EU AI Act. The same requirements, evidence and approvals then carry your cloud workloads and SaaS tools.

Govern AI before it governs you

Register every AI use case with risk tier and owner. The EU AI Act and your AI policy apply as requirements; before launch an approval stage checks documentation, oversight and privacy.

  • AI register with risk tier and owner
  • AI-Act-ready control set, scoped by risk
  • Model cards and evaluations as cited proof

Cloud workloads with a real footprint

GovHub reads from Google Cloud which services your workloads use and flags services you allow only with conditions.

  • Read-only: projects and services from Google Cloud
  • Per service: whether and under which conditions it is allowed
  • What the platform meets, it proves once for all

SaaS and AI tools under control

Every third-party tool your teams adopt gets a lightweight intake, a protection class and the vendor controls that match. Renewals run on schedule instead of on memory.

  • Fast intake for new tools
  • Vendor and data-protection checks in one flow
  • Coverage per tool at a glance

Proof of value

Prove it on one of your workloads first.

No big-bang rollout. We start with one real workload and one framework and show you the answer before you decide.

  1. 01

    Pick one workload and one framework

    Choose a workload that hurts today – an AI use case or a payment service – and the framework it has to meet.

  2. 02

    Bring your policies

    In the session, with you: your policy or regulation becomes clear controls, mapped to the workload.

  3. 03

    See the gaps

    Right there you see which controls apply, who is responsible and which evidence is still missing.

  4. 04

    Decide on your own data

    You judge whether GovHub answers the questions your audit asks – and which workloads follow next.

Security & trust

Built like the controls it manages.

EU hosting

Runs in Frankfurt on Google Cloud, with EU-resident AI models.

Open to AI agents

Through the Model Context Protocol (MCP), AI assistants such as Claude work directly with GovHub – only with your consent per app.

Security by design

Each organisation’s data is strictly separated. Cloudpilots sees it only with your explicit release.

Audit-proof

Published versions never change. Every decision is recorded in the audit log.

FAQ

Questions, answered.

Which frameworks does GovHub support?

Any framework you can describe as requirements: regulations such as DORA, NIS2, the EU AI Act and GDPR, standards such as ISO/IEC 27001, BSI C5 or PCI DSS, and your own internal controls. Cloudpilots maintains a curated global catalog you can activate; your own frameworks live alongside it.

Does the AI change my controls on its own?

No. The assistants only propose. Every suggestion — a clearer control text, an update after a framework revision or a proof assessment — waits in an inbox until a person accepts, edits or dismisses it. Proof suggestions always carry citations to the source they are based on.

How do controls reach a workload?

You decide per control which workload types and protection classes it applies to. Without a rule it applies to all. Only controls of activated frameworks count.

Where is my data stored?

GovHub runs in Frankfurt on Google Cloud and is operated by Cloudpilots, who reach your data only with your explicit release. AI features use EU-resident models, and secrets found in your sources are redacted before anything is indexed.

Can I connect my own AI assistant?

Yes. Any client that speaks the Model Context Protocol can connect; it signs in with OAuth 2.1 and you consent per app. It can read frameworks, controls, workloads, compliance and cloud data, create and update workloads, submit proof and lifecycle steps, decide AI suggestions and set responsibilities. Reviewing proof, deciding lifecycle steps and managing teams stay in GovHub.

Which sources can the evidence assistant read?

Confluence pages, GitHub repositories, URLs and uploaded files. Secrets are redacted before anything is indexed, and the assistant only proposes – a person decides.

Can AI usage get out of hand?

No. Every AI run has a token budget, so a single run cannot grow without limit.

Can we migrate from our existing spreadsheets?

Yes. Controls, frameworks and workloads can be brought in through the API and the built-in editors. Ask your Cloudpilots contact about a guided migration.

Ready to make compliance visible?

See GovHub with your own frameworks and workloads. Already a customer? Sign in and pick up where you left off.

Log in to GovHub Explore the platform

Demo requests: contact channel coming soon.