The AI GRC platform built for IT service providers and their client work

Three models coexist and they are not equivalent. Referral, where your client signs directly with the vendor and you invoice your own advisory work. Resale or managed delivery, where you are the one contracting with the vendor, running the platform on your client's behalf and remaining their single point of contact. White labelling in the strict sense, where the tool carries your visual identity. What matters contractually is not the logo: it is who holds the data, who signs the processing agreement the GDPR requires, and what happens to your client's access once the engagement ends. Settle those three points first.

The term covers a ready-made baseline: policy templates, a control library, interview questionnaires, mappings between frameworks. Its real value comes from sharing: one security measure described properly serves several frameworks at once, because ISO/IEC 27001, NIS2 and the NIST CSF largely ask for the same practices in different words. That is where the acceleration sits, not in a report template. An accelerator that stops maintaining those mappings when an edition changes turns back into a folder of files within months.

Your client does. Outsourcing the work does not move the accountability: the regulated organisation answers to its supervisory authority, and NIS2 goes further by requiring its management bodies to approve the cyber risk management measures and oversee their implementation. Your job is to produce a case that stands without you: dated decisions, evidence attached to a requirement, a named internal owner for every measure. A file that only makes sense with your consultant on the phone is a fragile file.

No. An ISO/IEC 27001 certificate is issued by an accredited certification body, and the impartiality rules those bodies work under stop them from certifying a management system they have themselves advised on. The split is clear: you prepare, document, train and run the mock audit; an independent third party audits and decides. Nothing stops you helping your client pick that body and walk into the audit without surprises. Saying so during the sales cycle avoids the most expensive misunderstanding in this business, the client who thought they were buying a certificate.

Five points come up in almost every supplier questionnaire, and all of them are legitimate: where the data is hosted, how their scope is isolated from that of your other clients, which further subprocessors are involved, what the vendor does with the content submitted to the AI, and how they get their data back if the relationship ends. On Vailor's side, as SaaS, data is stored in France (AWS Paris region) and AI processing runs on AWS Bedrock in EU regions; the platform can also be installed in your client's infrastructure, and content is never used to train models: that answers the first and fourth points. The others belong in writing, in the contract, not in a meeting.

Because the cost of spreadsheets never shows up on a single engagement, it shows up across the portfolio. Every client ends up with its own variant of the template, nobody knows which one is authoritative, and a simple question becomes a project: which clients are exposed to this new requirement, which ones have a review running late this month? A shared platform applies the same method everywhere, keeps the history of decisions and avoids re-keying the same evidence. On Vailor, the AI also prefills risk assessments from the client's documents.

In Vailor, it takes on the mechanical part: reading project documents, prefilling the pre-assessment and the risk assessment from excerpts, proposing measures with their effort and cost. Without documents, Vailor organises the collection from business teams with simple questions. What stays with your consultants is exactly what you invoice: choosing the scope, deciding whether to treat or accept a risk, the conversation with the client's leadership, the commitment you sign. AI shifts the effort towards analysis, it does not replace the decision.