Questions we get from IT teams

It reads your clients’ Entra, Intune, Microsoft Secure Score and NinjaOne on a schedule and records what it finds against ISO 27001:2022 and NIST CSF 2.0 at the same time, through a crosswalk between the two — so one collection answers both. Every finding keeps the raw response it came from, so an auditor can see the thing the conclusion was drawn from rather than only the conclusion. Where a source cannot be read, the controls it covers are marked “not checked” rather than left showing last month’s pass.

No. You open a ticket and give it a goal; it reads the tenant freely to find users, groups and available licences, but it stops and asks before every single write, and it refuses to write at all while the ticket’s change request is unapproved. It handles identity and licensing work — creating accounts, group membership, licence assignment, blocking sign-in, revoking sessions, resetting MFA. It does not touch Exchange rules, Teams policies or SharePoint permissions. Its time and API cost are logged against the ticket.

Upload them. The portal reads what each document commits to, extracts the individual promises, and checks each one against what the client’s systems actually do. A promise nothing can verify is recorded as stated, never as met. The finding then reads “your access control policy requires MFA for all administrators, and three do not have it” — which is a harder thing for a client to argue with than a reference to Annex A.

For a small, deliberate set, yes — and only through the approval gate. A Microsoft Secure Score recommendation becomes a drafted change record with the justification, the implementation steps and the user impact already filled in. Applying it needs an approved change and an administrator, and the previous value is written to the audit trail before anything is changed, so it can be put back exactly. Nothing is ever applied by a background job.

On the ticket itself rather than in a separate module. A change is classified Standard, Normal or Emergency on the record. Standard is pre-authorised and needs no approval; Normal and Emergency are gated before work starts, with approval boards that can mix your team and the client’s contacts. Set the threshold to the full board for a veto, or lower it so a change can carry without unanimous sign-off. The gate is enforced server-side, so it cannot be bypassed from the interface.

It can be deployed as a dedicated tenant configured for your data residency requirements. The AI is the usual concern and you control it: run on Anthropic or OpenAI with your own API key, or point it at your own hardware with LM Studio, in which case no client content reaches a third-party API at all. Access is role-based, and every agent action is logged server-side in an audit trail that is hash-chained — so a record that was altered or removed can be shown to have been.

Yes, and they are the same record. An hour is logged against a ticket and a client, out-of-hours and premium rates apply automatically, billable and non-billable are separated rather than hidden, and the monthly invoice is generated from those entries — so every invoice line traces back to a ticket and the person who did the work. The AI’s own hours and API cost are recorded separately from human work.

Freshworks and Freshservice with background sync today, and Zendesk for import, with Jira, HaloPSA and ServiceNow following. It imports clients, contacts, tickets and the full conversation history. Imports are read-only — nothing is ever written back — so running it alongside your existing tool carries no risk to that system. Microsoft Entra ID single sign-on and Microsoft 365 mail over Graph are supported, so no SMTP password is needed.