An obligation you didn't know applied
A regulation, contract clause, or buyer commitment that has been quietly in scope for months. Surfaced with jurisdiction, source, and the assumption it depends on.
Compliance tools tell you you're fine.
Get Frank tells you the truth.
Frank is the tool you run on yourself before the audit, the board, or the regulator — not the dashboard you show afterwards. It stamps a scope and an expiry date on your posture, with the named owners and the evidence that earned it — so the person who signs can stand behind what they signed.
Overall assurance posture
Conditional
Conditional posture holds until 2026-12-16. Identity Service and Incident Management are the binding constraints.
Reading this: confidence is the probability the posture still holds at the decay date. Signals are the individual checks contributing to it.
Coverage
78%
↑ 4 this week
Confidence
0.81
decays 2026-10-01
Open debts
12
3 expire soon
§ 01
Boards don't need more dashboards. They need fewer lies.
Most GRC tools optimise for the moment a certificate issues. Frank optimises for the eleven months in between — when posture decays, ownership drifts, and evidence quietly goes stale. The problem is not your team. It is a category built to manufacture confidence.
Not acceptable
Compliance theatre
- "One-click compliance" — generate a pass before reality is understood
- AI-powered maturity scoring that smooths over uncomfortable gaps
- Fully automated GRC promising outcomes before evidence exists
- Per-user pricing that punishes accountability roles
- SSO tax. Activity metering. Hidden exceptions to keep dashboards green
- Vanity dashboards engineered to stay green between audits
Acceptable
Frank assurance
- Identify obligations that actually apply — with explicit scope and assumptions
- Show whether each control works on a Tuesday, not just on audit day
- Name owners. Surface unowned dependencies. Track exceptions as first-class objects
- Charge for scope and projections — never for users or activity
- BYO identity. Essential Eight stays free for SMBs. Evidence referenced in your systems — never hoarded
- Publish claims with a scope, an expiry, and the evidence lineage that earned them
§ 02
The coverage assertion: a posture you can put your name to.
The coverage assertion is the artefact Frank exists to produce — we stand behind this posture, for this scope, until this date, on this evidence. Every claim links to its obligations, commitments, control reality, and known limitations, so you hand a regulator a credential, not a slide deck.
Anatomy of a coverage assertion
Every claim Frank publishes carries this shape.
- What it covers
- Obligations across regulations, contracts, and buyer commitments — with jurisdiction and source named.
- Who stands behind it
- A named accountable authority inside your organisation. Not a vendor footer.
- What evidence backs it
- Controls without contradiction, with lineage from source system to assertion.
- What holds it down
- Scoped debts and exceptions — each with a named owner and an expected resolution date.
- When it stops being defensible
- Holds until 2026-10-23. Confidence is the probability the posture still holds at that date.
A regulator, insurer, or buyer verifies provenance — not just trust the publisher. Aligned with verifiable credentials and assurance levels.
§ 03
The canonical model.
Obligation to verifiable claim, without inventing what you don't have. One shape across the platform — same four layers, same expiries, same ownership rules wherever assurance is asserted. Each layer adds explicit structure to the next. Confidence is time-bounded; exceptions are governed; evidence has lineage. Nothing renews itself silently.
Step 01 · Obligation
What applies
Regulations, contracts, and commitments that bind you. Scope, jurisdiction, and the assumptions you're standing on — named.
Step 02 · Commitment
What you said
Obligations translated into commitments your organisation actually made — to customers, regulators, your board — with named owners.
Step 03 · Control reality
What you do
How each commitment is met in practice. Effectiveness, fragility, dependency risk. Exceptions are first-class, not hidden.
Step 04 · Verifiable claim
What you can prove
Machine-consumable trust signals linked to obligations, evidence lineage, scope, and known limitations. Renewable. Auditable.
Signal posture · live example
Payment Gateway · 14 of 18 holding
Disclosure
Confidence is a window, not a stamp. Every claim Frank publishes carries an expiry.
§ 04
What you'll find in week one.
Four things Frank looks for in your first week. None of them require an enterprise contract — and none of them are flattering.
A dependency with no named owner
A backup system, an upstream feed, a vendor — load-bearing but un-owned. Frank treats unowned dependencies as first-class objects, not footnotes.
An assumption no one wrote down
The thing a control implicitly trusts: a tenancy boundary, a key rotation, an SLA. Once named, it stops being silent and starts being defensible.
A claim your own evidence contradicts
A treatment marked complete that stalled months ago. An acceptance whose review window lapsed. Frank surfaces the contradiction between what you recorded and what the evidence shows — before an auditor does.
§ 05
Your risk register says what you typed. Frank says what your evidence does.
Most registers record what you told them: scores you assigned, residuals you declared, a heat map that turns a guess into a coloured square. Frank reads risk as a read-only lens over the canonical model — every risk domain materialises from the obligations, decisions, debts, and assumptions already under assurance, and lights up where the register and the incidents beneath it diverge: a stalled treatment, an acceptance whose review window has lapsed, a residual reduction the incident record disproves. You do not curate it. It resolves to the same coverage assertion as everything else Frank publishes — with one named authority standing behind it.
Three things Frank refuses to do — on principle
No credit for self-reports. The register materialises from the model, or it does not exist. These refusals are the difference — not gaps we apologise for.
- No heat map A coloured grid launders a judgement into something that reads like a measurement. Frank publishes posture with an expiry, not a quadrant.
- No self-reported residual A residual score you assigned yourself is an opinion. Frank credits neither the number nor the optimism behind it — only what the evidence shows.
- No in-app curation If you could edit the register by hand, it would say what you typed again. It is materialised from the model, never maintained inside the app.
§ 06
Principles we ship by
Commitments encoded into the product. None are subject to renegotiation by sales.
Canonical model
One canonical shape across the platform — obligation, commitment, control reality, claim. Each layer has named owners, scoped assumptions, and an expiry. Confidence is a window, not a stamp.
Discomfort is signal
Surfacing gaps, fragility, and dependency risk is the point — not a failure mode. Frank exists to make things uncomfortable enough to act on.
Real ownership
No anonymous controls. A named accountable owner per commitment, with contributors and dependencies made explicit.
No theatre
We reject "one-click compliance" and AI-powered maturity scores. Discomfort you can act on beats reassurance you cannot.
§ 07
Upstream of the audit, on purpose.
Frank is a tool you run on yourself. It is not an auditor, not a certifier, and not a shortcut to either — and the boundaries that keep it that way are structural, not policy. They are why a posture produced in Frank is one you can defend.
Issues no certificate
Frank grades no maturity and issues no pass. It is the dress rehearsal you run before the audit, the attestation, or the assessment — never a substitute for them.
Stores no evidence
Evidence stays in the systems that produce it. Frank references it with lineage and stores none of it — there is no second copy to secure, and no incentive for us to hoard your data.
Will not help you mislead a regulator
If the evidence does not support the claim, Frank will not publish the claim. That is not a limitation. That is the product working.
Pays for no recommendations
No auditor, assessor, or consultant is paid, given quotas, or otherwise incentivised to recommend Frank. Nobody who certifies you can also sell you Frank.
Independence
Frank is never sold inside an audit or advisory engagement. When a practitioner
directory exists, listing will be free, earned, and carry no commission.
Start with the uncomfortable answer
What obligations apply to you — and what are you assuming?
The free tier won't certify you, score you, or reassure you. It will tell you what's actually true about your scope. That's where useful work begins.
Who this is not for
We turn buyers away. It saves both of us a renewal.
- N01 Organisations seeking reassurance, certification shortcuts, or cosmetic compliance. Refused
- N02 Buyers who expect a tool to smooth uncomfortable truths. Refused
- N03 Teams unwilling to name ownership, assumptions, or dependency risk. Refused
- N04 Sales-led compliance motions where outcomes are promised before reality is understood. Refused