Feature · Govern · Written by Yobel Tzegai · Last checked 19 October 2026

How do we keep the security records a customer's review asks for?

In Complipath (complipath.io), a security list holds every tool and system the company uses, AI or not. Once a day, new entries in CISA's public catalog of known exploited vulnerabilities whose vendor matches a tool go to Review. Beside it: an AI security policy per AI system confirmed by a person, training per person and a leaver checklist per tool.

Check your AI systems, free

What the app says it does

A list of the systems and tools the company adds, AI or not; once a day, new entries in CISA's public catalog of known exploited vulnerabilities whose vendor name matches a tool or AI system go to Review. An AI security policy per AI system drafted from the register and confirmed by a person, training per person and a leaver checklist with one line per tool.

Illustration · not your dataTool Slack · vendor SalesforceAlert New entry in CISA's catalog for this vendor · in ReviewLeaver Access ended for 4 of 5 tools · 1 to confirm

What it keeps

Tools: every system and tool the company uses, AI or not, added by hand with its vendor.
Alerts: once a day, new entries in CISA's Known Exploited Vulnerabilities catalog whose vendor name matches a tool's vendor, or the tool's own name where no vendor is given, go to Review.
Policies: an AI security policy per AI system, drafted from the register and confirmed by a person.
Training: who has done which security training, per person.
Leavers: when someone leaves, one line per tool to confirm that their access ended.

What it does not do

It does not find your tools. You add them; nothing discovers them.
It has one source of alerts, CISA's catalog, matched on the vendor's name. It does not read other advisories or your own systems.
It does not map ISO/IEC 27001 or SOC 2 controls. It keeps the records a review asks for; it is not a framework.

Which plan

Starter and up. In the app it is a Growth feature, included in Starter until Growth launches.

Where it sits in the law

It is not an EU AI Act duty. It sits beside the AI register because a customer's security review asks about every tool, not only the AI ones; the AI security policy per system is drafted from what the register already holds.

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

Where do the security alerts come from?

From one public source: CISA's Known Exploited Vulnerabilities catalog. Once a day, a new entry whose vendor name matches a tool's vendor on your list, or the tool's own name if it has no vendor, goes to Review. Nothing else is read, and no tool is found for you.

Does it cover tools that are not AI?

Yes. The list holds every system and tool the company uses, AI or not, because a customer's security review asks about all of them. The AI security policy is drafted only for AI systems, from what the register already records, and a person confirms it.

Is this an ISO 27001 or SOC 2 tool?

No. It keeps the records a security review asks for: the tools, the alerts, a policy per AI system, training and leavers. It does not map controls to ISO/IEC 27001 or SOC 2, and it does not prepare a certification audit.

Which plan includes it?

Starter, at €499 a month for up to 20 AI systems, and the trial. Prices exclude VAT. In the app it is a Growth feature, included in Starter until Growth launches: Growth is not available yet, so Starter is the plan to buy.