Vailor: the sovereign AI-native GRC alternative to CISO Assistant

The licence line is one item among several. Measured over a year at constant scope, the real figure adds hosting, backups whose restoration is actually tested, monitoring, version upgrades, data migration, training and the internal time spent running the tool. The licensing model, open source or proprietary, does not on its own settle either that total or the operating workload: what it changes is who carries each item. On the usage side, the time your teams spend on risk assessments is counted in person-days too, and that is where Vailor's AI steps in, prefilling the analysis from your documents.

An instance holding your risk register, remediation plans and evidence is a sensitive asset in its own right. Running it means tracking vulnerabilities and applying patches, keeping backups whose restoration is verified, encryption, access control with multi-factor authentication, logging and a recovery plan. Those controls are yours to operate: ISO/IEC 27001:2022 covers them through technical vulnerability management and information backup, among others. You also need an answer for continuity when the person who knows the installation moves on.

You do. Under data protection law the controller stays the controller whatever the hosting model: the GDPR requires security measures appropriate to the risk (Article 32) and notification of a personal data breach to the supervisory authority within 72 hours (Article 33). What changes is how you demonstrate it. Self-hosted, you produce the technical evidence yourself. With a vendor acting as processor, Article 28 requires a contract covering instructions, security, sub-processors and assistance during an incident. NIS2 also lists supply chain security among the expected measures (Article 21).

Location matters, but on its own it settles little. Four questions go together: where the data sits, which law applies to the provider, who can technically access it, and which AI models process the content of your assessments. Hosting it yourself answers the first; the other three still need answering, particularly as soon as an external service is called. Vailor is built in France and hosts data in France by default. You choose the AI model, including one self-hosted on your premises, and your data is never used to train models.

Yes. Two deployment modes exist: SaaS, with data stored in France, and installation in your own infrastructure. The decision follows the sensitivity of the data and your regulatory obligations rather than a technical preference. What then differs is who operates the platform and how quickly updates are applied. AI processing follows the same logic: you choose the model, including a self-hosted one.

By extraction rather than re-keying. You retrieve the control framework, the risk register, remediation plans and the evidence attached to them, then rebuild the link between a risk, the control that reduces it and the evidence supporting it: that link is what makes a history worth keeping, not the number of records. Start with the scope genuinely under management and bring the rest across afterwards. A sound test is to re-run an assessment you have already produced and compare the results before switching, keeping read access to the previous tool for one review cycle.