For startups selling to enterprise
Answer your enterprise customer's security review from one record.
Your first enterprise customer sends a security questionnaire, or asks how your AI product was reviewed. In Alvor the answers are records: ISO 27001:2022 controls with their evidence, the threat model behind each design, and the names of the people who signed it off.
- 4.2
Do you threat model new systems?
Threat model
Secure by Design
- 6.1
Which Annex A controls are in place?
Statement of Applicability
Compliance
- 6.4
Who approved the architecture?
Sign-off matrix
Secure by Design
- 9.3
Have staff accepted your policies?
Attestation record
Policy
Startups come to us when a customer's security team starts asking.
Enterprise customer
A security questionnaire asking for ISO 27001 and evidence that you develop securely.
Before the contract
Customer security team
A review of your AI product: the threat model, the controls it produced and who approved the design.
Before go-live
Procurement
A contract clause naming the standard your controls must meet.
At signature
With Alvor
What you do with Alvor.
Install ISO 27001:2022 and work every Annex A control
Install the ISO 27001:2022 pack and every Annex A control arrives with its ISO 27002 attribute facets. Decide what applies, name an owner and attach evidence once. The Statement of Applicability comes from the same record, and checks on GitHub or GitLab keep the controls they cover current.
ComplianceShow the customer how each design was reviewed
Describe the system in a paragraph and Design Studio draws it. Promote the shapes into a threat model, map each threat to a control, and four named people sign off. The project exports as a branded PDF with the diagrams, threat tables, controls and the sign-off matrix.
Secure by DesignRecord that staff have read your policies
Publish a policy, send it out for attestation, and each person's acknowledgement is recorded with the time, IP address and session. When a customer asks whether staff accepted the acceptable use policy, the campaign record answers it, down to the IP address.
PolicyWhat you can show
The records a customer's security team asks to see.
Security questionnaires ask the same few things in different words. Each answer below is a record you can open on a call, and the Statement of Applicability and the design review pack also export.
Statement of Applicability
Every ISO 27001:2022 Annex A control, whether it applies, why, and its status, produced from the controls you work in Compliance.
Design review pack
A branded PDF for each Secure by Design project: the business impact analysis, diagrams, threat tables, controls and the sign-off matrix.
Policy attestation record
Who acknowledged which version of each policy, and when.
Where your data lives
A dedicated single-tenant instance with its own database, in the region you choose, including a US region.
Questions
Common questions about Alvor for startups
It keeps the answers as records you can show: ISO 27001:2022 controls with their evidence and Statement of Applicability, the threat model and sign-off for each design, and staff policy acknowledgements. You answer the questionnaire from those records, and export the Statement of Applicability and the design review pack when the customer asks for them.
Get started
See how Alvor works for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.