Compliance governance with engineering evidence

A GO/NO-GO you can prove.

From the work your team already does. Leadership gets the verdict, engineering gets the fix.

Check an AI system freeOr book a demo

The quickest way to see it: 3 minutes, no signup, on your own Jira or GitHub export or on sample data

CV screening assistantHigh risk · Provider
Sample
GO9 of 9 duties evidenced
  • Risk management (Art. 9)
  • Transparency for deployers (Art. 13)
  • Human oversight (Art. 14)
  • Record-keeping (Art. 12)

5 more duties evidenced

Readings: 56% → 78% → 100%

  • Hosted in the EU (Frankfurt)
  • Personal data masked before every AI call
  • Signed, verifiable exports
  • SSO & enforced MFA

Leadership gets a verdict. Engineering gets the fix.

For CTOs and compliance leads

  • A GO/NO-GO per AI system, team or scope, with only the duties that apply
  • Readings over time: each one freezes the result and its evidence
  • Signed exports for your auditor

For engineering leads

  • The ticket or pull request behind each open duty
  • A fix prompt for your coding assistant
  • Re-check in one click

Team-level only. PulseCheck never scores individual developers.

How it works

From a rulebook to a GO, in four steps.

Shown here for the EU AI Act. GDPR, DORA delivery metrics and your own standard follow the same four steps.

  1. Step 1

    Pick a rulebook and a scope

    For the EU AI Act: one AI system and a guided assessment of its risk class and role. GDPR and DORA delivery metrics gates open straight from the picker; your own standard runs on your own rules.

    EU AI ActGDPRDORA delivery metrics
    Risk class: High · Role: Provider
  2. Step 2

    PulseCheck builds the gate

    The gate holds only the duties that apply to this system. Until every required check has an evidence source, it says so instead of showing a verdict.

    9 duties in this gateIn setup
    2 required checks have no evidence source yet
  3. Step 3

    Connect your tools or upload an export

    The rules run on your tickets, pull requests and deployments. No connection needed to start: import files from Jira, Linear, Azure DevOps, GitLab or GitHub.

    47 records syncedSetup complete. This gate now shows its verdict.
  4. Step 4

    Fix, re-check, take a reading

    Each open duty names the ticket or pull request behind it. Fix it, re-check, and take a reading that freezes the result.

    Readings: 56% → 67% → 78%

The same flow works for GDPR: rules and a gate for Art. 25, 32, 33 and 35.

Proof that holds up

The AI drafts. The rule engine decides.

  • Deterministic rules

    The same evidence always gives the same result, and anyone can reproduce it.

  • "Not evaluated", never a silent pass

    When evidence is missing, the result says "Not evaluated". It is never counted as a pass.

  • Signed exports

    CSV and JSON exports, signed with ECDSA P-256. An auditor verifies them offline.

  • Accepted risks with an end date

    An accepted risk shows "Accepted until" its date, reopens on its own when the date passes, and every step is logged.

Expert Review
New

An independent expert's verdict, next to every rule.

Some questions a rule engine should not answer. Expert Review sends a sealed package of your rule results and evidence to an independent expert. Their verdict comes back next to each rule's automated result.

Who reviews

  • DORA delivery metricsAvailableEngineering reviewSenior engineering leadRequest an Expert Review →
  • EU AI Act and GDPRPilotLegal reviewLicensed lawyerYearly Premium includes one review a year; otherwise priced on request.Join the pilot →

  1. Step 1Choose the scope

    Pick the framework and the team or AI system.

  2. Step 2Add the documents

    Upload what the rules in scope need. A link is only a hint.

  3. Step 3Seal and send

    One signed package goes to the expert.

  4. Step 4Get a verdict per rule

    The verdict and the signed opinion come back into PulseCheck.

DORA Metrics reviews are engineering reviews, not legal reviews.

Expert review
CV screening assistant
Sample

EU AI Act · assessment v3 · high risk (Annex III, point 4) · legal review

RuleAutomatedExpert verdict
Human oversight recordArt. 14FAILDisagree
Required change: add a written intervention procedure with test evidence.
Record-keepingArt. 12FAILAgree
Risk managementArt. 9PASSAgree
Risk classification rationaleArt. 6PASSAgree
Overall: Agree with conditionsPackage EXP-0930-01 · SHA-256 e41c7a90… · ECDSA P-256 · signed opinion attached
Sample data.
Security and data

Your data stays yours. Personal data is masked before every AI call.

Before

Anna Huber (anna.huber@acme.eu, +43 660 1234567) approved the oversight test for PR #482.

After (sent to the AI)

[PERSON_1] ([EMAIL_1], [PHONE_1]) approved the oversight test for PR #482.

Names of people in your workspace, e-mail addresses, phone numbers, IBANs, card numbers, IP addresses and credentials are replaced with placeholders before every AI call. The answer comes back with the real values restored.

  • Hosted in the EU (Frankfurt).
  • PulseCheck AI calls go to Anthropic (default) and Google (fallback), unless you bring your own AI key. Personal data is masked before each call.
  • Credentials encrypted with AES-256-GCM; every organization isolated by row-level security.

DPA and sub-processor list available on request. Privacy Policy

What PulseCheck is not

  • Not a GRC tool
  • Not legal advice
  • Not employee monitoring
  • Not an AI that decides compliance

Keep your GRC tool. Add the engineering proof.

GRC platformsEngineering metrics toolsPulseCheck
What it tracksPolicies, controls, risksDelivery speed and flowYour rules, checked on the actual engineering work
EvidenceUploaded by peopleNot compliance evidenceFrom tickets, pull requests and deployments, signed
ResultA status per controlDashboardsA GO/NO-GO per AI system, team or scope
Works with
  • Jira
  • GitHub
  • GitLab
  • Linear
  • Jenkins
  • Azure DevOpsBeta
  • Or upload an export

Measuring delivery performance? DORA delivery metrics →

FAQ

Questions from CTOs, compliance leads and engineering leads

Didn't find yours? Book a demo or write to us.

Does AI decide whether we are compliant?

No. A deterministic rule engine decides, and every result can be reproduced. PulseCheck AI drafts rules and fixes, and nothing applies until you confirm it. PulseCheck is not related to the healthcare EMR called 'PulseCheck' or to the hospitality startup of the same name, 'PulseCheck AI'; on this site, PulseCheck AI is the assistant built into PulseCheck.

Is this legal advice?

No. PulseCheck measures engineering evidence against rules; its percentages show compliance readiness, not a legal conclusion. For a legal judgment, Expert Review's legal review (in pilot) puts the question to an independent, licensed lawyer.

Do we have to replace our GRC tool?

No. PulseCheck adds the engineering proof your GRC tool does not have, and its signed CSV and JSON exports go into the tool you already use.

Do we have to connect our tools?

No. Start with the free check on an export or on sample data, or import files from Jira, Linear, Azure DevOps, GitLab or GitHub.

Where is our data, and what reaches the AI?

Your data is hosted in the EU (Frankfurt). Before every AI call, names of people in your workspace, e-mail addresses, phone numbers, IBANs, card numbers, IP addresses and credentials are replaced with placeholders; the AI providers are Anthropic by default and Google as fallback. The sub-processor list is available on request.

Will this be used to monitor developers?

No. Everything is measured per team. PulseCheck never scores individual developers.

How is it priced?

Pricing is provided on request. PulseCheck is licensed per seat for the people who use PulseCheck, not per developer in your repos. Book a demo or write to we@usepulsecheck.com. You can also start a free 14-day trial.

See a GO/NO-GO on your own data.

Start with one AI system: run the free check on your own export tonight, and forward the result to whoever signs the budget tomorrow.