New offering · the compliance platform, run by agents

Compliance that does the work, under a record an auditor can verify.

Autonomous Compliance is the privacy, GRC and AI-governance platform rebuilt as a governed agentic workforce. The six suites a compliance program runs on, except the agents fulfil the DSAR, answer the questionnaire and keep the AI inventory current, a credentialed human reviews and commits, and every action is signed into the Operating Record. Self-hosted, air-gapped, or hosted by Daybreak Labs: log in and go.

Scope a migration See the six suites

Private alpha · design partners only 6 suites Evidence generated as the work happens Maker-checker on every action Self-hosted, air-gapped, or hosted by us

01 Why replace the platform

A workflow platform tracks the work. It doesn't do it.

The compliance platforms of the last decade were built for a team that does everything by hand: they give that team forms, workflows, reminders and a dashboard. The team is still the bottleneck, the evidence is still collected before the audit, and the AI governance module is a register someone has to remember to update.

A workflow-based compliance platform

The team does the work. The platform records that it was done.
Evidence is collected by people, on a calendar, before the audit.
AI governance is a register that drifts the day after it's filled in.
One deployment model. Theirs.
Priced per module, per seat. The more you govern, the more you pay.

Autonomous Compliance

Governed agents do the work. A credentialed human reviews and commits.
Evidence is generated as the work happens: signed, hash-chained, verifiable offline.
The AI inventory maintains itself from your model registries, data platforms and agent fleets.
Self-hosted, air-gapped, or hosted by us. Your choice, same gates.
One workforce, six suites. Every agent under the same governance gate and the same record.

02 The six suites

The whole platform, as an agentic workforce.

Each suite is a department of governed agents with fixed jobs, least-privilege tools and a risk ceiling. They draft and recommend; a person with the right credential commits. Nothing state-changing happens without passing the gate.

Suite 01

AI Governance

The inventory that keeps itself current, and the obligations that follow from it.

AI-system inventory and risk tiering, fed by connectors to MLflow, SageMaker, Snowflake, Hugging Face and Agentforce, and by the agent fleets Lightwork already governs
EU AI Act, ISO 42001 and model-risk (SR 11-7) control mappings; serious-incident reporting under Article 73
Review and remediation task lifecycle for every AI entity; policy-pack changes with re-attestation
Scheduled red-team runs with leases, and a regulatory feed that turns new rules into tracked work

Suite 02

Privacy Automation

Rights requests fulfilled, not just tracked.

DSAR intake to delivery: retrieval, deletion and verification across Microsoft 365, Google Workspace, Salesforce and ServiceNow, with encrypted target custody
Assessments (PIA, DPIA, CPPA ADMT) with agent-proposed answers under independent review
Notice publication with double preview, versioned release and verified rollback; California DROP
Encrypted, tenant-private document custody for attachments and evidence

Suite 03

Consent & Preferences

Consent as a record, not a banner.

Consent records with bulk subject actions, custom indexes and bulk export
Web publish settings and application-level Global Privacy Control opt-out
A branded Trust Center on your own domain, with reviewed, encrypted brand assets

Suite 04

Tech Risk & Compliance

Evidence generated as the work happens.

Control frameworks (SOC 2, ISO 27001, DORA, HIPAA and a FedRAMP path) with governed evidence collection and analysis
A no-code GRC studio: objects, fields, forms, rules, collector bindings, report views and runtime projections
Outbound sync to ServiceNow and Archer, so the GRC system of record stays the system of record

Suite 05

Third-Party Management

Vendor risk with a first-class contract lifecycle.

Vendor inventory and questionnaires with agent-proposed answers, independent review and controlled application
Contract and engagement lifecycle as first-class objects
Role-aware executive PDF reporting over exact source manifests, with governed downloads

Suite 06

Data Use Governance

Every use of data has a purpose and a recorded decision.

Data inventory and classification, purpose policies, and a decision recorded for each use
One normalized read model across all six suites, with explicit completeness and provenance for every entity

03 How it's built

Agents, not forms. The same governance as everything else Lightwork runs.

Autonomous Compliance is not a separate product with its own security model. It is a set of governed specialist packs on the Lightwork runtime, which means every capability above inherits the platform's controls without exception.

Capability

Each compliance agent holds attenuate-only rights to exactly the systems its job needs.

Policy

Deletions, disclosures and publications require a credentialed human, by rule.

Shield

Every retrieved document is scanned before an agent reads it; injected instructions never reach a tool.

Budget

Hard caps per request and per suite, so a runaway retrieval stops itself.

Audit

The evidence an auditor asks for is the record the work produced, signed and verifiable offline.

Tenancy: Tenant-exact, encrypted at rest with your keys (KMS / BYOK). One tenant's key never opens another's.
Deployment: Self-hosted, air-gapped, or hosted by Daybreak Labs: log in and go. Your VPC or fully air-gapped, with a one-command readiness check, or infrastructure we host with tenant isolation and your own keys. The same gates and the same record either way.
Data principle: Your usage improves your own isolated workforce. The AI inventory, the evidence and the lessons the suites learn are read from and written to Cortex, the company brain, under audit; nothing is pooled or learned across customers.
Human role: Maker-checker on every state-changing action. Agents draft and recommend; a credentialed person commits.
Interoperability: Read from your registries and platforms; write back to ServiceNow and Archer; export evidence in open formats.

04 What's inside, and what's proven

Built for the whole compliance program, not a module of it.

Autonomous Compliance covers the six suites a compliance program actually runs on, and we describe every capability in our own terms with an honest status: shipped and test-covered; in preview where breadth or live proof is still being completed; or external, where a certification or licensed content is something no software can claim on its own.

Six suites

AI governance · privacy · consent · tech risk · third parties · data use

Shipped

mounted, configurable, covered by focused tests, under the same governance

Preview

the core exists; breadth or live proof is still being completed, and it is labelled so

External

certifications and licensed regulatory content we don't claim, and say so

how we label statusour product, our terms

shippeda locally owned path is mounted, configurable and covered by focused tests

previewa useful core; an adapter, content set, builder or live proof still being completed

externalcertification, licensed content, ecosystem: code alone can't establish it

not a claim we makeparity with, or a line-by-line comparison against, any other vendor's product

Fig. 03 · Status labels describe our own product and nothing else. "Shipped" does not claim live provider interoperability at customer scale, licensed regulatory content, or certification. Design partners get the full capability list with a status on every line.

05 How a migration runs

Shadow the platform first. Cut over when the record proves it.

You keep the incumbent running while the agentic workforce does the same work beside it, in your environment or ours, under the Operating Record. The decision to cut over is made on evidence, suite by suite.

Shadow

Connect your registries, data platforms and agent fleets; the inventories and your existing frameworks land as governed objects, and the workforce does the same work beside your incumbent, every action recorded.

Cut over

Suite by suite, on the evidence in the record, with the humans who sign off already in the loop.

Prove

The next audit is answered from the Operating Record, signed and verifiable offline.