Compliance Colleague Ask the standard.
Not the internet.
Upload a policy, a risk register or a network diagram. Get every gap, the clause behind it and the fix — in minutes, not a week of manual cross-referencing.
Encryption in transit is specified for all cardholder data flows.
Req 4.2.1No mention of MFA for remote administrative access into the CDE.
Req 8.4.2Retention period for audit logs is undefined.
Req 10.5.1Policy names an individual responsible for enforcement.
Req 12.1.4- AUDITORS & ASSESSORS
Cut the time a full gap analysis or on-site audit takes.
- SECURITY & COMPLIANCE TEAMS
Write and review information security documents in less time.
- ANY FORMAT
Upload PDF, Word, Excel, Visio, draw.io or a screenshot.
- CISOS & HEADS OF GRC
Get ready for your next compliance audit or assessment.
- vCISOS
Every compliance domain your client roster must meet, in one place.
Ask one question. See the clause behind the answer.
Pick a standard, ask what you’d ask a colleague, and get a cited answer from the standard’s own text. One free question a day, no account needed.
We don’t keep your question or the answer. To enforce the one-a-day limit we keep a scrambled code made from your network address for 25 hours. How we handle data →
Real answers, with the clause. No sign-in needed.
All ten answers →How long do we have to answer a subject access request, and can we extend it?
A controller has one month from receipt to respond. The period can be extended by a further two months where necessary, and the data subject must be told within the original month, with the reasons.
Art. 12(3) GDPR Read the full answer → PCI DSS v4.0.1Can we use SAQ A with a processor's iframe, and do we still need ASV scans?
A processor's iframe loaded directly is exactly what qualifies you for SAQ A. But ASV scans are still required: SAQ A keeps the quarterly external scan requirement for merchants using embedded iframes, and the 2025 version adds a script-attack eligibility criterion.
SAQ A r1 (v4.0.1), Req 11.3.2 Read the full answer → NIS2What are the reporting deadlines for a significant incident?
From the moment you become aware: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of that notification, each with its own required content.
Art. 23(4) NIS2 Read the full answer →Each answer was generated by Compliance Colleague from the standard's own text and checked against it. Research aid, not legal or audit advice.
The slow parts of compliance work, done in minutes.
These are the jobs that eat an assessor's week. Compliance Colleague does the reading and the cross-referencing; you keep the judgment and the sign-off.
"Without" reflects the founder's experience across 14+ years of PCI DSS and GRC assessments; it is not a measured benchmark.
Four ways to move faster through a standard.
Policies, spreadsheets and diagrams, reviewed
Hand over a policy or procedure (PDF or Word), a risk register or control matrix (Excel or CSV), or a network or data-flow diagram (Visio, draw.io or a screenshot). Get it checked against the standard: what's covered, what's missing, and the clause behind each finding.
Crosswalk your standard to any other
"How do ISO 27001's access controls differ from PCI DSS 4.0.1 Requirement 7?" Start from the standard you work in and see where any other framework aligns — and exactly where it doesn't.
Skip the search
Ask a plain-language question, get a direct answer pulled from the standard itself — faster than digging through a PDF you already know by heart.
A fix list you can hand over
Choose a full review, a prioritized fix list (each gap with its fix and the evidence an assessor will expect) or a one-page summary. Download it as Word or PDF for your workpapers.
Built for the people who own the standard.
QSAs, auditors and assessors
Pre-read the client’s policies, diagrams and registers before fieldwork, and walk in knowing where the gaps are.
PCI DSS · ISO 27001 · SOC 2 · SWIFT CSPGRC managers, CISOs and vCISOs
Keep policies, registers and control matrices current across every framework you carry, and hand the board a prioritized fix list instead of a week of analyst time.
ISO 27001 · NIST CSF · SOC 2 · NIS2 · DORA · HIPAAPrivacy teams and DPOs
Notices, DPIAs and data maps checked article by article, from the GDPR and CCPA/CPRA to India’s DPDPA and Brazil’s LGPD.
GDPR · CCPA/CPRA · DPDPA · LGPD · ISO 27701AI governance leads
Classify AI systems under the EU AI Act, spell out provider and deployer duties, and map them to ISO 42001 and the NIST AI RMF.
EU AI Act · ISO 42001 · NIST AI RMFDefense and federal contractors
CMMC practices, NIST SP 800-53 controls, FedRAMP and export controls, cited by practice, control and section.
CMMC 2.0 · NIST SP 800-53 · FedRAMP · ITAR · EARTeams in the Arab Gulf States
Data protection, national cybersecurity controls and central-bank rules in Saudi Arabia, the UAE, Qatar, Bahrain, Oman and Kuwait, onshore and in the financial free zones.
Saudi PDPL · NCA ECC · SAMA · DIFC · ADGM · QFC30+ standards — security, privacy and AI governance, country by country.
Information security, personal data protection and AI governance for the US, the EU and UK, India, Australia and New Zealand, Vietnam, Brazil, and the six Arab Gulf States: Saudi Arabia, the UAE, Qatar, Bahrain, Oman and Kuwait. Pick one, two, or five, depending on your plan, and crosswalk them against any other. (We say “standard” for all of them — standards, frameworks, and regulations alike.)
See every standard and what you can ask and upload for each →
Saudi Arabia, the UAE and the other Arab Gulf States. All six Gulf Cooperation Council countries — Saudi Arabia, the UAE, Qatar, Bahrain, Oman and Kuwait — each its own standard, and each starts by working out which rules apply: onshore or a financial free zone (DIFC, ADGM, QFC), which sector regulator (SAMA, CBUAE, QCB, CBB, CBO, CBK), and what kind of data. Data protection law, national cybersecurity controls, central-bank cyber and cloud rules, and AI guidance, cited article by article. Saudi Arabia’s PDPL is carried in official text; the other five work from our own article-referenced summaries while the official texts are added.
Your standard, mapped to any other. Start from a standard in your plan and compare it against any framework on the shelf — see exactly where they align and where they don't, organized around the one you work in. No separate crosswalk spreadsheet.
Free tools for compliance teams.
Useful on their own, and a fair way to see how we work before you try the product.
Compliance deadline calendar
EU AI Act, India DPDP, CCPA automated decision-making, the EU Cyber Resilience Act and more, in your Google, Outlook or Apple calendar. Updates itself.
Subscribe free → ToolArab Gulf States breach clock
Who to notify, and how fast, after a breach in Saudi Arabia, the UAE, Qatar, Bahrain, Oman or Kuwait, regulator by regulator.
Open the clock → GuidesPractitioner guides
What changed in PCI DSS 4.0.1, what ISO 27001 actually requires, and breach-notification clocks compared.
Read the guides → AnswersAnswers library
Cited answers to the questions practitioners ask most, each with the clause it comes from.
Browse answers →What this is — and, just as importantly, what it isn't.
What it is
A reference and research tool for the people who interpret, apply, audit or assess standards — built to review a document fast, compare frameworks, and answer questions, with the clause behind every answer.
A productivity aid for the work you're already qualified to do.
What it isn't
An audit opinion, attestation or certification — and it doesn't satisfy any requirement to complete a formal audit or assessment. It isn't legal advice.
Every finding cites the clause it comes from, so you can verify it in seconds. Your professional judgment and sign-off stay with you.
Built for people who read the privacy policy.
Nothing you submit trains a model. By our AI provider's own default policy, none of your inputs or outputs are used to train the underlying model — and we haven't opted into anything that would change that.
Multi-factor authentication is required on every paid account — not an optional setting.
Answers are checked against the source, not memory. For laws, regulations and government frameworks — GDPR, the EU AI Act, HIPAA, CMMC, NIST, FedRAMP and more — Compliance Colleague carries the official published text and checks its answer against it. For licensed standards such as ISO/IEC, PCI DSS, SOC 2, CIS and SWIFT, it works from our own clause-referenced material, reviewed against the published standard or authoritative public sources, and cites the clause so you can check your own copy.
Re-checked for changes every month. Deadlines, penalty amounts and new versions are tracked on a watch list, and a set of test questions for every standard is re-run after each update.
A Data Processing Agreement is available on request for teams that need Article 28-style protection — see About → Request a DPA.
Built by a practitioner, for practitioners.
Hi, I'm Edward. I've spent 14+ years in PCI DSS and GRC: as a QSA, leading compliance programs, and advising CISOs. Most of that time went into one slow job: finding the exact clause that answers the question in front of you, and proving it.
I built Compliance Colleague to do that part fast. Every answer is grounded in the standard's own text and cites the clause, so you can check it in seconds. Your judgment and your sign-off stay with you.
Priced by how much of the shelf you need.
Choose how you pay — tap to see your price
Solo
For a single-framework practitioner — a QSA on a PCI DSS engagement, an ISO lead auditor, a privacy specialist living in GDPR.
Practitioner
For split responsibilities — SOC 2 and HIPAA, PCI DSS and ISO 27001, whatever your desk actually covers.
Virtual CISO
For consultants and fractional leaders working across a full client roster.
- Billing. Plans are billed monthly by default, with no minimum term. Switch to Annual above to pay once a year and get two months free: $300, $500 or $1,000 depending on plan.
- 14-day money-back guarantee. Ask within 14 days of any payment, first or renewal, and you get a full refund.
- Cancel anytime. No minimum term on any plan. You keep access through the end of the month (or year) you have paid for, and you are not charged again.
- Changing standards. Once a year on Solo, twice on Practitioner, five times on Virtual CISO, with the allowance resetting on your subscription anniversary. A change takes effect immediately and can't be undone, so switching back later uses another change; changes made in your first 14 days don't count against the allowance.
- What your plan covers. Every plan can compare any of its own standards against any standard in the library; asking about a standard on its own, or reviewing a document against it, needs it in your plan.
- Usage. Each plan includes a monthly usage allowance sized for real work. You’re never charged for usage beyond it.
For consultancies and builders
Two options we’re opening to a small group first. Tell us what you need and we’ll shape the pilot with you.
Consultancy plan
For GRC, audit and advisory consultancies that want Compliance Colleague across the whole team and client roster.
- Several seats on one subscription, managed by your consultancy
- $30 of usage per seat each month, pooled across the team
- All 30+ compliance standards, every finding cited to the clause
- Free 30-day team pilot for up to 5 consultants, no card required
API access
For teams that want cited answers and document reviews inside their own tools: GRC platforms, ticketing, internal portals.
- Ask a question, get an answer cited to the clause
- Send a document, get the findings back as structured data
- Pay for what you use; no seats needed
- The same 30+ compliance standards and source library as the app
The API waitlist button opens your email app with a short message to fill in. No email app? Write to support@compliancecolleague.ai. We reply to every request.