Help Center

Everything you need to know about using Govantic.

Creating your account

Sign up for Govantic using Google OAuth (one-click) or with an email and password. During registration you'll be asked to accept the Terms of Service and Privacy Policy - this is required before accessing the platform.

After signing up, you'll land on your workspace dashboard. If you're the first user, you'll also be the workspace administrator.

Workspace setup

A workspace is your organization's environment in Govantic. Every workspace comes pre-configured with:

  • Govantic AI framework - an internal compliance framework provisioned automatically
  • Default controls - Chat Monitoring and Continuous Security Training, enabled and in-scope
  • Empty knowledge base - ready for you to upload policies, SOPs, and source documents

Your first steps should be: upload your key documents to the Knowledge Base, configure an LLM provider for the Compiler Agent, and connect your first integration (like Slack).

Dashboard overview

The dashboard is your compliance command center. It shows six stat cards at a glance:

  • Frameworks - number of active compliance frameworks
  • Requirements - total requirements across all frameworks
  • Controls - total active controls in your workspace
  • Knowledge Sources - count with breakdown (policies, SOPs, source documents)
  • Integrations - number of connected integrations
  • Pending Reviews - items requiring your attention

Each framework also has a compliance ring showing your current pass rate. The ring is green at 100%, orange for partial compliance, and red at 0%. Compliance is calculated from controls that have a passing test result, not just controls that exist.

Policies

Policies are your organization's high-level compliance documents - things like your Information Security Policy, Acceptable Use Policy, or Data Classification Policy. Upload them to Govantic and the Knowledge Compiler will extract structured requirements from each one.

Each policy supports revisions. When you update a policy, create a new revision and describe what changed. The compiler will re-extract requirements, and the old revision is preserved with full history. You can restore any previous version with one click (this creates a new revision) or download any version as a PDF.

Policies are authored with a rich text editor featuring a full formatting toolbar: bold, italic, underline, strikethrough, headings, bullet and numbered lists, text alignment (left, center, right, justify), font size, font color, background highlight, tables, links, images, code blocks, blockquotes, and horizontal rules. Copy-pasting from Word, PDFs, and web pages preserves formatting, colors, and tables.

SOPs (Standard Operating Procedures)

SOPs are your step-by-step operational procedures — incident response plans, change management processes, access review procedures, etc. They share the same revision system, compilation, archiving, and PDF export as Policies.

SOPs use a structured step editor with a split-panel layout. The left sidebar shows your numbered step list, and the right panel opens the full rich text editor for the selected step. Each step has:

  • Step number — auto-assigned and displayed prominently. Steps are numbered sequentially starting at 1.
  • Title — a short label for the step, editable inline from the sidebar
  • Content — full rich text body using the same WYSIWYG editor as Policies (formatting, colors, tables, images, etc.)
  • Reorder — drag steps in the sidebar to rearrange them. Step numbers update automatically.
  • Add & remove — add new steps at any position or remove existing ones

Legacy SOPs created before the step editor was introduced continue to work — their content is displayed as a single block. You can restructure them into steps at any time by creating a new revision.

The Knowledge Compiler treats SOPs the same as Policies: it extracts requirements and maps them to the Govantic AI framework. The distinction between Policies and SOPs is organizational — it helps you categorize your knowledge base.

Source Documents

Source Documents are any other reference material that informs your compliance posture — vendor agreements, regulatory guidance, internal memos, training materials, etc. Govantic supports PDF, Word (.docx/.doc), Excel (.xlsx/.xls), and plain text files.

Bulk upload — drag and drop multiple files at once onto the upload area, or click to select them from your file browser. Each file shows individual upload progress, an editable display name, and an auto-detected category based on the filename. Files are uploaded sequentially so you can monitor progress.

Each source document has a processing status: Unprocessed (waiting for the compiler), Processing (currently being compiled), Compiled (requirements extracted), or Failed (compilation error). If a document fails, you can retry it from the grid.

Document revisions

All knowledge base entities (Policies, SOPs, Source Documents) support a full revision system. When you upload a new version:

  • Describe the changes - enter a change description that helps the compiler focus on affected areas
  • Automatic recompilation - the compiler archives old requirements and extracts new ones from the updated content
  • Traceability - every requirement links back to the specific revision it was compiled from
  • History - old revisions are marked as Superseded but preserved for audit trails

The current revision is the active one used for compilation. You can restore any previous revision — this creates a new revision with the old content, preserving the complete history chain.

Archiving documents

Policies and SOPs can be archived (soft-deleted) when they're no longer active. Archived documents are read-only — you cannot create new revisions or edit descriptions.

  • Archive — click the Archive button on the document detail page
  • Unarchive — restore an archived document to Active status at any time
  • Filter by status — the document list lets you filter by Active or Archived
  • Compilation — archived documents are excluded from the Knowledge Compiler

PDF download

Download any Policy or SOP as a branded PDF with the document title, version number, and date. You can download:

  • Current version — from the main document view using the Download PDF button
  • Any historical version — from the Version Control section, click the download icon next to any revision

The PDF preserves all formatting from the rich text editor including text alignment, colors, highlights, tables, and images.

How the Knowledge Compiler works

The Knowledge Compiler is an AI agent that reads your documents and extracts structured, enforceable requirements. Here's the flow:

  1. You upload a Policy, SOP, or Source Document
  2. The document enters the Compiler Queue
  3. The compiler reads the document content (extracting text from PDF, Word, or Excel)
  4. It sends the content to your configured LLM with a specialized prompt that extracts behavioral expectations, guidelines, and compliance requirements
  5. Requirements are created with auto-generated codes (REQ-001, REQ-002, etc.)
  6. Each requirement is mapped to the Govantic AI framework
  7. A consolidated markdown knowledge base is generated and stored - this is what monitoring agents use for evaluation

When you upload a new revision, the compiler archives the old requirements and re-extracts from the updated content, using your change description to focus on affected areas.

Configuring your LLM provider

The Knowledge Compiler (and other agents) need an LLM to operate. Go to Agents → Configure on the Compiler Agent card to set up your provider:

  • OpenAI - uses GPT-4o. Enter your OpenAI API key.
  • Claude - uses Claude by Anthropic. Enter your Anthropic API key.

Each workspace has its own LLM configuration - your API key is stored securely and used only for your workspace's compilations. You can change providers at any time.

Compiler Queue

The Compiler Queue shows all compilation jobs with real-time status. Access it from the Compiler Agent card via View Queue. You'll see:

  • Stats cards - pending, running, completed, and failed job counts
  • Source links - each item shows the source type icon (Policy/SOP/Source Doc) with a clickable link to the original document
  • Status badges - color-coded status for each job
  • Duration & retries - how long each compilation took and how many retry attempts

The queue auto-refreshes every 10 seconds so you can monitor progress in real time.

Compiled requirements

After compilation, requirements appear in the Requirements list with auto-generated codes (REQ-001, REQ-002, etc.). Each requirement includes:

  • Title and description - the structured requirement extracted by the LLM
  • Source traceability - which document and specific revision it was compiled from
  • Framework mapping - linked to the Govantic AI framework (and potentially other frameworks)
  • Control mapping - which controls enforce this requirement

After each compile, a consolidated markdown file is generated and stored. This acts as the AI "knowledge base" that monitoring agents use to evaluate communications and activities.

Framework catalog

Govantic includes a curated catalog of compliance frameworks with 385+ pre-built requirements across:

  • SOC 2 - 61 requirements covering Trust Services Criteria
  • ISO 27001 - 123 requirements covering Annex A controls
  • HIPAA - 201 requirements covering Security, Privacy, and Breach Notification Rules

Frameworks are added from the catalog - you never build them manually. Each framework comes with pre-mapped requirements and controls.

Adding a framework

To add a framework, go to Frameworks → Add Framework. Before committing, you'll see a readiness ring showing how much of the framework you already cover. This percentage is based on controls that are already passing - not just controls that exist.

When you add a framework:

  • All framework requirements are provisioned into your workspace
  • Matching controls are automatically linked
  • Controls default to in-scope (you opt out, not in)
  • Your compliance percentage starts being tracked on the dashboard

GAP analysis

The GAP analysis page shows the difference between your current controls and what a framework requires. Click View Gap on any catalog framework to see:

  • Readiness ring - your current coverage percentage
  • Covered requirements - requirements satisfied by passing controls
  • Gap requirements - requirements you still need to address
  • Contextual messaging - guidance based on your readiness level

This helps you understand your compliance posture before committing to a new framework.

Govantic AI framework

The Govantic AI framework is unique - it's an internal compliance framework that enforces how your organization actually works, based on your own documents. It's auto-provisioned on every new workspace.

Unlike external frameworks (SOC 2, ISO 27001), the Govantic AI framework:

  • Requirements come from your policies, SOPs, and source documents via the Knowledge Compiler
  • Updates automatically as you upload new documents or revisions
  • Auto-syncs the knowledge base — whenever requirements in the Govantic AI framework are added, removed, edited, or archived, the consolidated knowledge base regenerates automatically so monitoring agents always evaluate against the latest rules
  • Controls like Chat Monitoring and Continuous Security Training are virtually linked to all compiled requirements

Compliance progress

Track your compliance progress in multiple places:

  • Dashboard rings - per-framework compliance percentage (green/orange/red)
  • Framework detail - live stat cards showing requirements, controls, and knowledge sources for that framework
  • Pre-add preview - see your progress before adding a new framework from the catalog

Compliance percentage = (controls with passing test results) / (total in-scope controls). Out-of-scope controls are excluded from the calculation.

Understanding requirements

Requirements are the atomic compliance obligations your organization must meet. They come from two sources:

  • Framework requirements - pre-built requirements from SOC 2, ISO 27001, HIPAA, etc.
  • Compiled requirements - extracted by the Knowledge Compiler from your documents, mapped to the Govantic AI framework

Each requirement can be mapped to one or more controls (which enforce it) and one or more frameworks (which require it). Description fields support rich text editing with full formatting. Requirements and Controls are edited on dedicated full-width pages (not modals).

Manual requirements

In addition to compiled and framework requirements, you can create requirements manually from the Requirements page. Manual requirements:

  • Auto-coded — automatically assigned the next available REQ-XXX code in your workspace
  • Editable — title, description, and auditor guidance can be updated at any time
  • Archivable — archive requirements you no longer need (they can be unarchived later)
  • Custom mappings — map or unmap to any control or framework directly from the requirement detail page

Manually edited requirements (whether originally compiled or manually created) are protected during recompilation — the Knowledge Compiler will not overwrite your changes when processing new document revisions.

Requirement categories

Requirements are organized into categories within each framework. Use the category dropdown on the Requirements page to filter — select a framework first, then pick a category.

  • SOC 2 — Security, Availability, Processing Integrity, Confidentiality, Privacy, Other
  • ISO 27001 — Context of the Organization, Leadership, Planning, Support, Operation, Performance Evaluation, Improvement, Annex A Organizational, Annex A People, Annex A Physical, Annex A Technological, Other
  • HIPAA — Breach Notification, Privacy, Security General Rules, Security Administrative Safeguards, Security Physical Safeguards, Security Technical Safeguards, Security Requirements Organization, Security Requirements Policies Procedures Documentation, Other
  • Govantic AI — Access Control, Data Protection, Communication Security, Network Security, Incident Response, Change Management, Risk Management, Governance, Human Resources, Physical Security, Business Continuity, Vendor Management, Asset Management, Monitoring & Logging, Other

Govantic AI categories are automatically assigned by the Knowledge Compiler when it extracts requirements from your documents. The same category filter is available on the Controls page when a framework is selected.

Auditor Guidance

Every requirement includes a "What auditors look for" section on its detail page. This field explains what evidence, processes, and documentation auditors typically expect when evaluating the requirement.

Use this guidance to prepare for audits — it tells you what to have ready before the auditor asks. The guidance is displayed in a highlighted box below the requirement description.

Requirement codes

Every requirement has a unique code within your workspace:

  • Framework requirements - use the framework's native coding (e.g., CC1.1 for SOC 2)
  • Compiled requirements - auto-generated as REQ-001, REQ-002, etc. with sequential numbering

Codes are workspace-scoped and deterministic - recompiling the same document produces the same codes.

Framework & control mapping

On a requirement's detail page, you'll see:

  • Control pills (green) - which controls enforce this requirement
  • Framework pills (purple) - which frameworks include this requirement

You can manually map or unmap requirements to controls and frameworks from the requirement detail page. Adding or removing a requirement from the Govantic AI framework automatically triggers a knowledge base regeneration so monitoring agents stay up to date.

Filter the Requirements list by framework using the dropdown filter. Click from a framework detail page to see only that framework's requirements.

Controls overview

Controls are the mechanisms that enforce your requirements. They're categorized by how they are satisfied, with filter cards at the top of the Controls page showing per-type counts:

  • Monitored — automated controls tested by agents. Includes an additional agent filter to drill into specific agents.
  • Policy — controls satisfied by having a documented policy in place
  • SOP — controls satisfied by following a standard operating procedure
  • Evidence — controls satisfied by providing evidence artifacts (certificates, screenshots, reports)
  • Review — controls satisfied by periodic manual review

Each control card shows a health badge (Passing, Failing, Erroring, or Not Tested) and the control's category and severity. Click any control to see its full detail: linked requirements, frameworks, policies, evidence, responsible person, and monitoring test history.

Control types

Every control has a type that describes how it is satisfied. The Controls page shows filter cards at the top — one per type — with counts so you can quickly focus on a specific category:

  • Monitored — automated controls tested by AI agents on a schedule. When you select this filter, an additional dropdown appears to filter by specific agent. These controls show health badges (Passing, Failing, Erroring) based on their latest monitoring test.
  • Policy — controls satisfied by having a documented policy. Link policies directly from the control detail page; they appear as orange badges.
  • SOP — controls satisfied by following a standard operating procedure.
  • Evidence — controls satisfied by providing evidence artifacts (certificates, screenshots, audit reports). Link existing evidence or create new evidence inline from the control detail page; they appear as teal badges with artifact counts.
  • Review — controls satisfied by periodic manual review and sign-off.

Click any filter card to show only controls of that type. Click again to clear the filter and see all controls.

Control responsible person

Each control can have a responsible person assigned from your personnel register. This tracks who is accountable for the control's compliance posture.

  • Auto-assignment — when controls are imported from Drata/Vanta, activated from the catalog, or seeded with a new workspace, the person holding the highest-priority security role (lowest ordinal) is automatically assigned as responsible
  • Bulk assignment from security roles — when creating a security role, a toggle (on by default for top-level roles) lets you bulk-assign all currently unassigned controls to the first person in that role
  • Manual assignment — edit any control to set or change the responsible person from a dropdown of your personnel
  • Unassigned by default — controls are left unassigned until a security role or manual edit assigns someone

Integrations

Integrations connect Govantic to your tools. The architecture is integration-first: you connect an integration once, and it unlocks the controls that use it.

Currently supported integrations:

  • Slack - enables Communication Agent monitoring, Q&A, reminders, and quizzes
  • Gmail - email communication monitoring
  • Microsoft Teams - Teams communication monitoring
  • Zoom - meeting and call monitoring

Go to Integrations in the sidebar to connect. Each integration has a configuration panel where you enter credentials and adjust settings.

In Scope vs Out of Scope

All controls are in-scope by default when provisioned. If a control doesn't apply to your organization, mark it as Out of Scope:

  • Click Out of Scope on the control detail page
  • Enter a reason (required) - this is displayed in an orange box on the control page
  • The control card turns gray with reduced opacity in the list view
  • Out-of-scope controls are excluded from compliance calculations

To bring a control back, click Include - the exclusion reason is cleared. Use the status filter (Active / Out of Scope / All) to switch between views.

Control health

Every control tracks its health based on monitoring test results:

  • Passing (green) - the last test result was a pass
  • Failing (red) - the last test result was a failure
  • Erroring (gray) - the last test encountered an error
  • Not Tested - no tests have been run yet

Health badges appear on both the controls list and the control detail page. The health status is updated automatically every time an agent runs a monitoring test.

Monitoring Tests page

The Monitoring Tests page shows every agent test run across all controls. Access it from the sidebar. You can filter by:

  • Agent - which agent ran the test
  • Control - which control was tested

Each row shows the agent type icon, control name, result badge, and timestamp. Click any row to open a structured detail modal with the full test information.

Retesting controls

You can trigger a retest on any control from the control detail page by clicking the Retest button. This sends a signed request (HMAC-SHA256) to the appropriate agent asking it to re-evaluate the control.

The retest runs asynchronously - refresh the page or check the Monitoring Tests tab to see the result once it completes.

PDF test reports

Every monitoring test result can be downloaded as a branded PDF report. The report includes structured sections:

  • Control information - name, category, and agent
  • Test summary - pass/fail result with timestamp
  • Statistics - detailed metrics from the test run
  • Detailed results - full JSON data from the agent evaluation

You can also download the raw JSON. PDF reports are useful for sharing test evidence with auditors.

Uploading evidence

The Evidence Library is where you store all compliance artifacts - screenshots, reports, certificates, audit logs, etc. To upload evidence:

  1. Go to Evidence in the sidebar
  2. Click Add Evidence and fill in the details
  3. Upload one or more artifacts (files)
  4. Optionally set Implementation Guidance - a text field explaining what this evidence demonstrates
  5. Set a Creation Date - defaults to today, but you can backdate for pre-existing artifacts

Implementation guidance is shown as a collapsible section on the evidence detail page.

Renewal schedules

Each artifact can have its own renewal schedule:

  • 3 months
  • 6 months
  • 12 months
  • Custom - set your own renewal date

Renewal dates are auto-computed from the creation date plus the cadence. When an artifact's renewal date passes, it's flagged for renewal. All artifacts must have a renewal schedule.

Version history

When you renew an artifact, the old version is archived and a fresh artifact is created. This preserves a full history of every version - useful for demonstrating ongoing compliance to auditors.

You can also delete an artifact and upload a replacement if you don't need to keep the historical record.

Agent overview

Govantic agents are AI-powered workers that continuously monitor your organization for compliance. Each agent is a long-running service with its own repository and deployment. The Agent Status page shows all agents with their configuration, health, and queue status — including the Knowledge Compiler queue with pending, running, completed, and failed jobs.

Current agents:

  • Knowledge Compiler - extracts requirements from your documents (see Knowledge Compiler section)
  • Communication Agent - monitors Slack for policy violations, answers questions, sends reminders, and runs quizzes

Each agent needs an LLM provider configured. Go to the agent card and click Configure to set your API key and choose between OpenAI or Claude.

Communication Agent

The Communication Agent monitors your Slack workspace in real-time. It evaluates every message against your compiled requirements using a two-pass system:

  1. First pass - each message batch is evaluated against your requirements. Potential violations are flagged.
  2. Confirmation pass - flagged violations are re-evaluated with the last 24 hours of channel history as context. This catches false positives where earlier conversation makes the flag irrelevant.

Only confirmed violations create incidents. The agent uses rich context including channel topic, company name, user job titles, and bot message detection to minimize false positives.

Slack setup

To set up the Communication Agent with Slack:

  1. Go to Integrations and connect Slack
  2. Configure the Communication Agent with an LLM provider
  3. The agent will auto-join all public channels with rate-limited pacing
  4. For private channels, manually invite the bot

The agent processes messages in a 10-minute window - it only evaluates recent messages. If the agent was offline, messages older than 10 minutes are skipped to avoid stale alerts.

Use a dedicated test channel to safely test the agent end-to-end without creating real incidents.

Compliance Q&A

Mention the Govantic bot in any Slack channel or thread to ask compliance questions. The bot uses your compiled requirements to answer in context. This works in both public channels and private channels where the bot has been invited.

Friendly Reminders

The Communication Agent can send proactive reminders about policies before issues happen. When the agent detects a conversation that could lead to a violation, it posts a friendly nudge as a thread reply instead of flagging it as an incident.

Reminders are also posted to a dedicated reminders channel for managers to review.

Compliance Quizzes

Keep your team sharp with fun, LLM-generated compliance quizzes. Configure quizzes in the Slack integration settings:

  • Quiz Channel - which channel's members receive quizzes
  • Frequency - how often quizzes are sent (in days). Set to 0 to disable.
  • Delivery Time - when quizzes are sent (default: 10:30 AM ET)

Quizzes are delivered as DMs to all channel members with multiple-choice answers. Users can choose A, B, C, or "Teach me!" to get an explanation. The quizzes use light humor and quirky scenarios - they're designed to be engaging, not boring corporate training.

PII detection

The Communication Agent automatically detects personally identifiable information (PII) in Slack messages, including:

  • Social Security Numbers (SSNs)
  • Credit card numbers
  • Other sensitive data patterns

PII violations are flagged through the same two-pass evaluation system as other compliance violations.

Business Units

Under Settings → Organization, create Business Units to represent your organizational structure (Engineering, Sales, Finance, etc.). Each unit has:

  • Name and description
  • Responsible personnel - the unit lead
  • Members - personnel assigned to the unit

Personnel can belong to one or many business units.

Organization Chart

The Organization Chart is auto-generated from your Business Units and personnel assignments. It provides a visual hierarchy of your organization. This view is useful for auditors who need to understand your reporting structure and personnel security controls.

Security Roles & Skills Matrix

Define Security Roles to track who in your organization is qualified for specific security functions. The Skills Matrix tab provides a cross-reference view of:

  • Which roles exist in your organization
  • Which personnel hold each role
  • Competency tracking mapped to personnel security requirements

When creating a security role, a "Assign as responsible for unassigned controls" toggle (on by default for top-level roles) lets you bulk-assign all currently unassigned controls to the first person in that role. The role with the lowest ordinal is used for auto-assignment when controls are imported or activated.

This is essential for SOC 2 and ISO 27001 personnel security controls.

Personnel

The Personnel register tracks everyone in your organization relevant to compliance. Each person can be linked to:

  • Business Units - one or many
  • Security Roles - from the Skills Matrix
  • Controls - as the responsible person accountable for compliance
  • Computers - assigned devices
  • Locations - office/work location

Cloud resources

Register your cloud infrastructure by category:

  • Containers - ECS, EKS, Docker, etc.
  • Buckets - S3, GCS, Azure Blob
  • Servers - EC2, VMs, Compute Engine
  • Databases - RDS, DynamoDB, Cloud SQL
  • Network - Load balancers, CDNs, DNS
  • VPCs - Virtual private clouds and subnets

Each resource has a name, category, and assigned administrator from your personnel records.

Physical resources

Track on-premise infrastructure: servers, routers, switches, firewalls, and other networking equipment. Physical resources are linked to locations and administrators for complete asset tracking.

Computers

Register company laptops, desktops, and other endpoint devices. Each computer is associated to a personnel record, creating a clear chain of custody for device management and endpoint security controls.

Locations

Track your offices and work locations. Locations are linked to personnel records so you can see who works where. This supports physical security controls required by SOC 2 and ISO 27001.

Asset Inventory & CSV export

The Asset Inventory provides a unified view of every entity in your workspace: documents, evidence, personnel, computers, cloud resources, physical assets, vendors, and customers.

  • Filter and sort across all entity types
  • CSV export - one click, respects your current filters. Hand it directly to auditors.
  • Knowledge sources breakdown - shows policies, SOPs, and source document counts

This page is essential for SOC 2 and ISO 27001 asset management controls that require a complete inventory.

Vendor register

Track your third-party vendors with contact details and risk classification. The vendor register helps you meet SOC 2 vendor management requirements by maintaining a central record of all third parties with access to your systems or data.

Customer management

Track your customers and the commitments you've made to them. Each customer entry can include contracts, SLA terms, and specific obligations.

Contracts & SLAs

Manage contracts with SLA obligations for both vendors and customers. The obligations column is surfaced directly in the contracts grid with full filtering and sorting, making it easy to review commitments during audits.

Importing from Drata

If you're migrating from Drata, Govantic can import your entire compliance program — evidence, frameworks, requirements, controls, and mappings. Enter your Drata API key and workspace ID once, then use either import action:

  • Evidence import — fetches all evidence from Drata, transfers files to Govantic storage, matches personnel by email, and links to controls by code
  • Framework import — select a Drata framework and import all its requirements, controls, and requirement-to-control mappings in one click. The importer enriches imported data with curated titles, categories, auditor guidance, and control metadata from the Govantic catalog.
  • Idempotent — both imports are safe to run multiple times without creating duplicates

Combined, these two imports give you a complete one-click migration from Drata. Access the import page from the sidebar (internal tools, available to workspace administrators).

Other platforms

Support for importing from Vanta, Sprinto, and other GRC platforms is in progress. Contact us if you need help migrating from a specific platform.

Can't find what you're looking for?

Our team is here to help.