The questions a head of compliance actually asks before the second meeting.

Yes, with honest boundaries. The platform models the Register against the EBA Data Point Model taxonomy, and today the in-product coverage concentrates on entity type, branches, the contract-service-function row bridge, the function-entity row bridge, and the ICT service assessment, plus the supplier-side of the third-party register. The XBRL-CSV submission file is in development. Until it ships, our specialists bridge the platform view into the NCA template.

In limited, specific places, and never as the primary evidence path. Where AI helps, it drafts a mapping or summary that a named person still has to approve. Customer data is not used to train any model. Anything the model produces is stored with the usual evidence fields: asserted by whom, effective from when, review due when.

Supported record sets can be exported, and structured integration is available where it is agreed in scope. Role-based reports are available for activated domains and services. Exit requirements, formats and retention are agreed during procurement so the organisation knows how its records can be taken out before it puts them in.

It covers the hyperscalers, core-banking platforms, and application providers we see most often in EU financial services, with legal identifiers already in place. It is a starter catalogue, not an exhaustive registry. Firms add the providers specific to their operation during onboarding, and those additions are kept under their own tenant.

The platform records and manages ICT incidents today. Packaged DORA classification and initial, intermediate and final regulatory report generation are not presented as available today, and there is no NCA submission channel. Where those outputs are needed, we agree the advisory and platform boundary explicitly before work begins.

The platform connects risks, controls, objectives, assessments, owners and evidence, with framework controls and mappings held as reusable records. That means one operational control can be read through more than one regulatory or assurance context without duplicating it. The exact risk workflow and reporting outputs included in an engagement are confirmed during discovery.

An Excel workbook is a reporting output that happens to hold every supplier, contract, and function a firm uses. It has no link to the underlying data, so the next quarter repeats the exercise. On this platform the supplier is one record, the contract references it, and the regulatory views are generated by reading those records. Amending a contract once updates every view that depends on it.

Yes. Classifications and assessments carry review and source context, so an overdue or incomplete record can be surfaced where the work happens rather than in a separate log. Completeness and health checks can expose gaps before a reporting window rather than after a rejection.

The timing depends on the agreed domain, the quality of the source data and the availability of the organisation's own decision-makers. A focused first scope can move quickly; a group-wide operating model takes longer. We set the sequence, dependencies and acceptance criteria out in writing before work begins.

Both, and the shape of the engagement differs. With an established team we slot under the existing governance and act as a specialist pair of hands on the platform and the regulatory artefacts. With a firm building its function we help design the governance taxonomy as we go, and we stay explicit about which judgements are ours and which belong to the firm.

Yes, on request. A discovery call is a working conversation about your compliance operation, not a pitch, so firms often want cover before describing specifics. Our standard mutual NDA is short and we sign yours if you prefer it.

It stays with you. Every classification, assessment, and mapping on the platform records the person who asserted it, when, and with what source reference. That history is your firm's, not ours. If you move to another adviser, the record of what was decided and why travels with the tenant.

The data model is built for this. Entities, suppliers, and contracts carry ownership and parent references as first-class fields, so a group restructure is a set of record changes rather than a rebuild. For a change of control on our side, the platform data and the advisory work product are the client's, contractually, and the platform has an exit path documented in the master agreement.

Engagements are priced as a defined scope of work with platform access alongside. The activated domains and services, number of entities, seats, integrations and judgement-heavy advisory work shape the proposal. We quote in writing after a discovery call and do not charge for the call itself.

They are separate lines. Platform access covers the tenant, agreed seats, activated domains and services, and product updates. Every tenant begins with a scoped setup. Ongoing advisory is separate and optional once the organisation can run the platform itself.

Yes. User seats, entities in scope, and advisory hours are adjustable within a term. Upgrades take effect at the next billing cycle. Downgrades take effect at the end of the current term, which keeps the platform stable for the firm's audit cycle.

Ariadnah Solutions B.V. is ISO/IEC 27001 certified. The platform enforces tenant isolation at the database layer with forced row-level security on every tenant-scoped table, and every state-changing operation writes to an append-only audit log with tenant, actor, action, resource, outcome, and before-and-after snapshots. The platform's own control posture is published on the security page, including what we are not: not FedRAMP-authorised, not SOC 2 Type II audited, not FIPS 140-3 validated.

The client. The master agreement is explicit: tenant data and advisory work product are the client's property throughout and at termination. On exit the firm takes a full export, and we retain only what retention law requires us to keep, for the period required.

Ariadnah is normally hosted in EU regions. We do not offer a packaged self-hosted product. A customer-environment arrangement, where feasible, requires a separate technical and security assessment rather than being treated as a standard deployment option.

Ariadnah is not bounded by a fixed list of regulation-specific products. The current build demonstrates connected work across organisation and responsibility, risk and control, governance documents, suppliers and contracts, assets, incidents, AML and KYC, fund administration, DORA and AIFMD reporting. The production readiness, reporting outputs and specialist support for the domains relevant to an organisation are confirmed during discovery.

Ariadnah is designed for EU-regulated organisations whose compliance work depends on connected people, entities, assets, products, suppliers, decisions and evidence. It is especially useful where the same records feed several obligations, teams or reporting outputs. Suitability depends on the organisation's operating problem, not on DORA scope alone.

Our regulatory expertise is EU-centred and the platform is built against EU frameworks. We work with non-EU groups that have EU-regulated subsidiaries, and we engage with UK-regulated firms where the regulation maps closely (for example PRA outsourcing alongside EBA guidance). We do not market the platform outside the EU and UK.

A general GRC product typically holds each regulatory framework as its own register, with the same supplier, contract, or control duplicated per framework. Reconciliation is a human process. On this platform the supplier, contract, control, and function exist once as first-class objects, and the regulatory views are generated from those records. You also get specialist advisory alongside, which most horizontal GRC vendors do not provide.

A Big Four engagement gives you senior advisory hours and a deliverable, usually a document. On this platform the deliverable is a live data model on the client's tenant, maintained between engagements rather than rebuilt for each one. Our specialists are regulatory practitioners, and their work sits on the same platform the client's team uses day-to-day, so the engagement leaves an operational substrate behind.

Not publicly. Client discretion is part of how we work, so we do not publish client logos or counts. Any reference discussion is handled case by case during procurement. The public site instead provides the company identity, certification information, security boundaries, platform model and primary regulatory sources that a reviewer can inspect directly.