Canonical model
One canonical shape across the platform — obligation, commitment, control reality, claim. Each layer has named owners, scoped assumptions, and an expiry. Confidence is a window, not a stamp.
Compliance tools tell you you're fine.
Get Frank tells you the truth.
Frank is the tool you run on yourself before the audit, the board, or the regulator — not the dashboard you show afterwards. It ships the date your posture expires, with the scope, named owners, and evidence that earned it. Bring your registers, or let Frank be the system of record — one canonical model underneath.
Overall assurance posture
Conditional
Conditional posture holds until 2026-10-22. Identity Service and Incident Management are the binding constraints.
Reading this: confidence is the probability the posture still holds at the decay date. Signals are the individual checks contributing to it.
Coverage
78%
↑ 4 this week
Confidence
0.81
decays 2026-08-01
Open debts
12
3 expire soon
§ 01
Principles we ship by
Commitments encoded into the product. None are subject to renegotiation by sales.
Discomfort is signal
Surfacing gaps, fragility, and dependency risk is the point — not a failure mode. Frank exists to make things uncomfortable enough to act on.
Real ownership
No anonymous controls. A named accountable owner per commitment, with contributors and dependencies made explicit.
No theatre
We reject "one-click compliance" and AI-powered maturity scores. We will not help an organisation mislead a regulator.
§ 02
Boards don't need more dashboards. They need fewer lies.
Your register isn't wrong — it's just unfalsifiable. Frank can be your system of record or a lens over the systems you already keep. Either way, one canonical model underneath. Most GRC tools optimise for the moment a certificate issues. Frank optimises for the eleven months in between — when posture decays, ownership drifts, and evidence quietly goes stale.
Not acceptable
Compliance theatre
- ×"One-click compliance" — generate a pass before reality is understood
- ×AI-powered maturity scoring that smooths over uncomfortable gaps
- ×Fully automated GRC promising outcomes before evidence exists
- ×Per-user pricing that punishes accountability roles
- ×SSO tax. Activity metering. Hidden exceptions to keep dashboards green
- ×Vanity dashboards engineered to stay green between audits
Acceptable
Frank assurance
- ✓Identify obligations that actually apply — with explicit scope and assumptions
- ✓Show whether each control works on a Tuesday, not just on audit day
- ✓Name owners. Surface unowned dependencies. Track exceptions as first-class objects
- ✓Charge for scope and projections — never for users or activity
- ✓BYO identity. Essential Eight stays free for SMBs. Evidence integrations included
- ✓Publish verifiable claims linked to obligations, evidence and known limitations
§ 03
The canonical model.
Obligation to verifiable claim, without inventing what you don't have. One shape across the platform — same four layers, same expiries, same ownership rules wherever assurance is asserted. Each layer adds explicit structure to the next. Confidence is time-bounded; exceptions are governed; evidence has lineage. Nothing renews itself silently.
Step 01 · Obligation
What applies
Regulations, contracts, and commitments that bind you. Scope, jurisdiction, and the assumptions you're standing on — named.
Step 02 · Commitment
What you said
Obligations translated into commitments your organisation actually made — to customers, regulators, your board — with named owners.
Step 03 · Control reality
What you do
How each commitment is met in practice. Effectiveness, fragility, dependency risk. Exceptions are first-class, not hidden.
Step 04 · Verifiable claim
What you can prove
Machine-consumable trust signals linked to obligations, evidence lineage, scope, and known limitations. Renewable. Auditable.
Signal posture · live example
Payment Gateway · 14 of 18 holding
Disclosure
Confidence is a window, not a stamp. Every claim Frank publishes carries an expiry.
§ 04
What you'll find in week one.
Three things most teams surface before they finish onboarding. None of them require an enterprise contract — and none of them are flattering.
An obligation you didn't know applied
A regulation, contract clause, or buyer commitment that has been quietly in scope for months. Surfaced with jurisdiction, source, and the assumption it depends on.
A dependency with no named owner
A backup system, an upstream feed, a vendor — load-bearing but un-owned. Frank treats unowned dependencies as first-class objects, not footnotes.
An assumption no one wrote down
The thing a control implicitly trusts: a tenancy boundary, a key rotation, an SLA. Once named, it stops being silent and starts being assurable.
§ 05
Your risk register says what you typed. Frank says what your evidence does.
Most registers record what you told them: scores you assigned, residuals you declared, a heat map that turns a guess into a coloured square. Frank reads risk as a read-only lens over the canonical model — every risk domain materialises from the obligations, decisions, debts, and assumptions already under assurance, and lights up where the register and the incidents beneath it diverge: a stalled treatment, an acceptance whose review window has lapsed, a residual reduction the incident record disproves. You do not curate it. It resolves to the same coverage assertion as everything else Frank publishes — with one named authority standing behind it.
Three things Frank refuses to do — on principle
No credit for self-reports. The register materialises from the model, or it does not exist. These refusals are the difference — not gaps we apologise for.
- No heat map A coloured grid launders a judgement into something that reads like a measurement. Frank publishes posture with an expiry, not a quadrant.
- No self-reported residual A residual score you assigned yourself is an opinion. Frank credits neither the number nor the optimism behind it — only what the evidence shows.
- No in-app curation If you could edit the register by hand, it would say what you typed again. It is materialised from the model, never maintained inside the app.
§ 06
Claims as verifiable assertions, not marketing copy.
Every claim links to its obligations, commitments, control reality, evidence, scope, and known limitations. Hand a regulator a credential, not a slide deck — backed by verifiable data with provenance. Aligned with verifiable credentials and assurance levels.
Anatomy of a coverage assertion
Every claim Frank publishes carries this shape.
- What it covers
- Obligations across regulations, contracts, and buyer commitments — with jurisdiction and source named.
- Who stands behind it
- A named accountable authority inside your organisation. Not a vendor footer.
- What evidence backs it
- Controls without contradiction, with lineage from source system to assertion.
- What holds it down
- Scoped debts and exceptions — each with a named owner and an expected resolution date.
- When it stops being defensible
- Holds until 2026-08-28. Confidence is the probability the posture still holds at that date.
A regulator, insurer, or buyer verifies provenance — not just trust the publisher. Aligned with verifiable credentials and assurance levels.
Start with the uncomfortable answer
What obligations apply to you — and what are you assuming?
The free tier won't certify you, score you, or reassure you. It will tell you what's actually true about your scope. That's where useful work begins.
Who this is not for
We turn buyers away. It saves both of us a renewal.
- N01 Organisations seeking reassurance, certification shortcuts, or cosmetic compliance. Refused
- N02 Buyers who expect a tool to smooth uncomfortable truths. Refused
- N03 Teams unwilling to name ownership, assumptions, or dependency risk. Refused
- N04 Sales-led compliance motions where outcomes are promised before reality is understood. Refused