ISO 27001:2022 Gap Analysis Software — What aileth thee?

Compliance gap analysis that actually works. Upload your documentation, and Aileth reveals exactly where you fall short — and where you're already compliant.

ISO 27001:2022 NIS2 — coming soon

Request early access See how it works →

A.5.12 — Classification of information 6 criteria

Classification scheme ≥3 levels MET

Handling requirements for storage MET

Handling requirements for transfer MET

Guidelines for new classification PARTIAL

Destruction requirements per level MISSING

Cross-referenced in related policies MISSING

Recommendation Action required

Add secure destruction methods per classification level (shredding, wiping, cryptographic erasure)

Approach

Compliance is not a checkbox.
It's a continuous state of awareness.

Most organisations discover their security gaps during the audit — the most expensive moment possible. Aileth shifts that discovery to the earliest stage, analysing your existing documentation against every Annex A control with atomic precision.

Document ingestion

Upload policies, procedures, and evidence. Aileth classifies each document and routes it to the relevant controls automatically.

Gap analysis

Each acceptance criterion is assessed individually. No bundled checks, no yes-bias — just a clear PRESENT, PARTIAL, or MISSING verdict with confidence scoring.

Actionable roadmap

Aileth doesn't just find gaps — it distinguishes true compliance deficiencies from quality recommendations, so you know exactly what to fix first.

Coverage

All 93 Annex A controls.
Every criterion assessed individually.

ISO 27001:2022 Annex A contains 93 controls across four themes: organisational, people, physical, and technological. Aileth assesses each one against explicit acceptance criteria — no aggregated scores, no hidden assumptions.

Annex A controls

Full coverage of the ISO 27001:2022 control set. Every control assessed with per-criterion precision: PRESENT, PARTIAL, or MISSING.

Assessment phases

Substantive LLM analysis of document content, deterministic structural checks against your IAM and role data, and cross-control contextual reasoning.

∞

Document types

Policies, procedures, risk registers, role matrices, access reviews, audit reports — Aileth classifies and routes each document to the relevant controls automatically.

Data sovereignty & compliance

Your data stays in Europe.
And out of our hands.

Aileth runs entirely on European infrastructure — no US cloud providers, no CLOUD Act exposure, no transatlantic transfers.

More importantly: we process your compliance documentation, but we never see it. Analysis is fully automated. No Aileth employee has access to your uploaded documents or your results. Your sensitive internal policies stay exactly that — internal.

The AI that powers the gap analysis is a small language model running on Scaleway's European infrastructure — not OpenAI, not Microsoft, not Google. Your documents never leave the EU, and are never used to train any model.

Zero operator access — your documents are processed by the system, never read by people
EU-only hosting — Scaleway, Paris datacenter
Per-tenant isolation — your data is never co-mingled with other clients
EU-only AI processing — small LLM on Scaleway, not a US-based AI provider; no data sent to OpenAI, Anthropic, Google, or Microsoft
No model training — your documents are never used to train any AI model
Short retention — all data deleted within 30 days of contract end
GDPR by design — data minimisation, purpose limitation, right to deletion

EU data sovereignty compliant

EU AI Act compliant

Consultancy

Need a hand getting started?

Aileth is a tool — but sometimes you need more than a tool. If you'd like us to help you structure your compliance documentation, review your existing policies together, or advise on your specific situation, that's available as a single consultancy day.

We work through your documentation set with you, identify the quickest wins, and make sure you're uploading the right material to get the most accurate gap analysis.

Enquire about a consultancy day