Compliance
Requirement-by-requirement assessment, linked evidence, maturity score.
- Framework assessments
- Assisted gap analysis
- Regulatory watch and impact
AI-native GRC platform
Compliance, control, audit and risk. An AI that cites its sources.
TOONAH brings your obligations, controls, audits and risks together on one platform. Bernard, the GRC orchestrator, reads the official texts, prepares the work and drafts your deliverables — your teams keep the final say.
- Hosted in France (OVH)
- Human oversight of AI
- Europe & Africa · FR / EN
Built for
- DORA
- NIS 2
- GDPR
- AI Act
- ISO 27001
- COBAC
- BEAC
- GIMAC
- PCI DSS
- SOC 2
The problem
Regulation keeps piling up. Spreadsheets can’t keep up.
DORA, NIS2, AI Act, European and African supervisory requirements: every new text restarts a manual project. TOONAH puts everything back into one chain, from requirement to evidence.
Without a platform
- Requirements scattered across spreadsheets, emails and shared drives.
- Each text re-interpreted by hand, team by team.
- Evidence hunted down the day before the audit.
- Generic AI tools that answer without citing sources.
With TOONAH
- One chain: requirement, obligation, control, evidence.
- Bernard proposes obligations and controls from the text; your teams validate.
- Evidence linked to each requirement, reports ready for the auditor.
- Answers sourced to the article, actions subject to approval.
The requirement
The text that applies to you, in its current version.
The obligations
What must actually be done, worded and validated by your teams.
The controls
The measures covering each obligation, with their frequency.
The evidence
What you show the auditor, linked to the requirement.
The platform
Five GRC domains. One data model.
An audit finding, an incident or a compliance gap feeds the same actions and dashboards. No re-keying, an always up-to-date overview.
Internal control & CCM
Control framework, effectiveness testing and continuous monitoring.
- Control mapping
- Tracked tests and results
- Continuous monitoring fed by your tools
Audit
Engagements, steps, working papers, recommendations and follow-up.
- Assisted audit plan
- Evidence review
- Recommendation tracking
Risk
Risk mapping, inherent and residual scoring, risk indicators and treatment plans.
- Library of typical risks
- KRIs with alert thresholds
- Tracked treatment plans
Strategic diagnostics
Self-assessment of your organisation and strategic analysis of its position.
- 360° diagnostic tailored to your sector
- SWOT, TOWS and maturity axes
- Sector benchmark and costed action plan
Also included Shared findings · My actions · Incidents & CMDB · Business continuity · Governance bodies · Document management · Dashboards
Bernard, the GRC orchestrator
It plans, it executes. You approve.
Bernard is not a generic assistant. It knows your sector, your regulatory zone and your data, works from official texts and acts in the platform with the user’s permissions — never beyond.
- 1
Understands
Your profile (sector, country, EU, CEMAC, WAEMU or DRC zone), frameworks and data put every answer in context.
- 2
Plans
It breaks the request down: gap analysis, audit plan, control or risk mapping, regulatory watch.
- 3
Executes and cites
It reads, cross-checks and drafts — gap reports, policies, procedures — citing sources and exact corpus identifiers.
- 4
You approve
Every creation, change or approval is proposed, then confirmed by a human. Every assisted decision is logged.
A team of virtual experts
Depending on the question, Bernard calls on the right profile, or brings them together as a panel.
V
VictorineSenior auditor
G
GaspardRisk expert
L
LivCorporate lawyer
C
CybelleCISO
Ready deliverables
Gap reports, policies, procedures and action plans in Word or PDF, pitched for the expert, the manager or the board.
AI-provider independent
The language model is configurable, including self-hosted. Bernard is not locked into any provider.
Frameworks & regions
Europe first. Open to Africa. Aligned with international standards.
A catalogue of structured frameworks, with their domain and sector applicability, and a corpus of official texts that Bernard draws on.
European Union
Resilience, cyber, data, AI, finance.
- GDPR
- NIS 2
- DORA
- AI Act
- Cyber Resilience Act
- eIDAS 2
- PSD2
- AML package
- MiCA
- MiFID II
- Solvency II
- CSRD
- DSA
- DMA
France
National authorities and frameworks.
- ANSSI · EBIOS RM
- SecNumCloud
- RGS
- HDS
- CNIL
- ACPR · AMF
- Tracfin
- Sapin II
- SREN law
Africa
CEMAC, WAEMU and DRC zones, precisely distinguished.
- COBAC
- BEAC
- GIMAC
- BCEAO
- WAMU Banking Commission
- OHADA
- DRC · BCC
- Cameroon
- Gabon
- Congo
- Chad
- Côte d’Ivoire
- Senegal
- Benin
International
Standards and reference frameworks.
- ISO 27001
- ISO 27005
- ISO 27017
- ISO 27701
- ISO 22301
- ISO 31000
- ISO 37301
- ISO 42001
- ISO 9001
- ISO 14001
- ISO 45001
- NIST CSF 2.0
- NIST SP 800-53
- COBIT 2019
- COSO ERM
- SOC 2
- PCI DSS v4.0
- SWIFT CSP
- Basel III
- SOX
- HIPAA
- TISAX
- BSI C5
- CyFun
Multi-sector
Sixteen sectors. An experience tailored to each.
The sector and country declared at sign-up steer the 360° diagnostic, recommended frameworks and regulatory watch. TOONAH recommends; you keep access to everything.
- Financial services
- Banking
- Insurance
- Microfinance
- Payments & Fintech
- Healthcare
- Industry & Manufacturing
- Energy & Utilities
- Telecommunications
- Technology & IT
- Retail & Distribution
- Transport & Logistics
- Public sector & Administration
- Education
- Agriculture & Agrifood
- Construction
Security & sovereignty
European by design. Sovereign by choice.
A compliance platform must be compliant first. GDPR and the AI Act are built into the data model itself, not bolted on afterwards.
TOONAH’s AI runs on a configurable language model: an external provider or a self-hosted model, for organisations that require nothing to leave the infrastructure. Let’s discuss it during the demo.
Hosted in France
Platform and databases hosted by OVH, in France.
Per-organisation isolation
Every request is bound to your organisation by a signed token. Bernard acts with your permissions, no more.
Strong authentication
Two-factor authentication with a TOTP app and backup codes.
Least privilege
Roles and permissions by domain (RBAC).
Encryption
TLS in transit; secrets encrypted at rest.
Audit trail
Append-only log: who did what, and when.
Governed AI (AI Act)
AI system register, log of assisted decisions, human oversight.
GDPR by design
Record of processing, timestamped consents, tracked data subject requests.
How it works
Up and running in four steps.
Create your workspace
Choose your plan and enjoy a 14-day free trial.
Describe your organisation
Sector and country: TOONAH infers your regulatory zone and recommends the texts to address.
Run the diagnostic
Your sector’s 360° diagnostic produces scores, a risk map and an action plan.
Steer and prove
Controls, evidence and audits in one place; PDF and Word reports for the board and the auditor.
Business Clinic
A specialist’s eye, when you decide.
Beyond self-assessment, TOONAH specialists can assess your organisation’s health. No access without your explicit consent: you set the scope and duration, you can revoke at any time, and every access is logged.
Talk to usPricing
A plan for every maturity stage.
14-day free trial on every plan. Monthly subscription, in euros or US dollars.
Every business module from Starter, within the quotas. Higher plans raise the quotas and add SSO, SLA, dedicated support, private frameworks, MDM / Intune, custom playbooks and templates, sector benchmark and a dedicated model adapter.
Starter
To get started with compliance
Price shown at sign-up
- All business modules
- Bernard (AI assistant) with quotas
- 360° diagnostic (1 sector)
- PDF reports
Professional
To structure your GRC
Price shown at sign-up
- Everything in Starter, with higher quotas
- Multi-agent (Victorine, Gaspard, Cybelle)
- Full Bernard learning
- All public watch sources
- PDF + Word (.docx) reports
Enterprise
Banks, groups, regulated sectors
Price shown at sign-up
- Everything in Professional, unlimited (fair use)
- Custom playbooks and templates
- Private frameworks and benchmark
- SSO, MDM / Intune
- Dedicated support and SLA
Custom
On request — tailored quote
Quote-based
- Enterprise base with tailored adjustments
- Dedicated IT integrations / connectors
- Negotiated volumes and SLA
- Quote-based pricing
Compare plans
Quotas and features read live from our plan catalogue, for information and subject to change. The 14-day trial gives access to the Professional plan features. Need more? Credit packs can be added at any time.
The detailed quota comparison is temporarily unavailable. It is shown at sign-up, or on request at sales@toonah.io.
Secure payment by Stripe. Up-to-date amounts read live from our plan catalogue.
FAQ
Frequently asked questions
What is TOONAH?
TOONAH is a governance, risk and compliance (GRC) SaaS platform. It brings five domains together — compliance, internal control and continuous monitoring, audit, risk and strategic diagnostics — in one workspace, for any organisation in any sector.
Can we trust Bernard’s answers?
Bernard relies on a corpus of official texts and on your own data, cites its sources and is instructed never to make things up. It proposes; you decide: every creation, change or approval requires confirmation by a human, and every AI-assisted decision is logged.
Where is our data hosted?
The platform and its databases are hosted in France, by OVH. Each organisation is isolated. For AI features, the language model is configurable: an external AI provider, or a self-hosted model for organisations that require nothing to leave the infrastructure. Sub-processors are listed in the privacy policy.
Which frameworks are covered?
European texts (GDPR, NIS2, DORA, AI Act, eIDAS 2, PSD2, AML…), French frameworks (ANSSI, CNIL, ACPR…), African frameworks (COBAC, BEAC, GIMAC, BCEAO, OHADA, DRC) and international standards (ISO 27001, ISO 42001, NIST CSF, COBIT, COSO, PCI DSS, SOC 2…).
Is TOONAH suited to African organisations?
Yes. TOONAH precisely distinguishes the CEMAC, WAEMU and DRC zones, covers COBAC, BEAC, GIMAC, BCEAO and OHADA texts, and tailors its recommendations to your declared country. The interface is in French and English, and plans are offered in euros or US dollars.
How does the free trial work?
Create your account, choose your plan and use the platform for 14 days, with the features and quotas of the Professional plan. Payment, secured by Stripe, only happens when you decide to subscribe. The Custom plan is quote-based.
Can we use our own frameworks?
Yes. Licensed standards such as ISO standards are rephrased by TOONAH or imported by your organisation if it holds the licence. The Enterprise plan includes dedicated private frameworks.
Can we connect our existing tools?
Yes. Your monitoring tools (Zabbix, Datadog, Prometheus, Nagios or a script) feed asset health through a simple HTTP request. TOONAH also analyses IT evidence: directory, firewall, logs.
What is the Business Clinic?
An assessment of your organisation’s health carried out by TOONAH specialists. It only starts with your explicit consent, on a scope and for a period you set, revocable at any time, and every access is logged.
Get started
Let’s see what Bernard makes of your texts.
Pick a framework you must address this year. In a 30-minute demo, you will see the resulting obligations, controls and gap report.
- Sales : sales@toonah.io
- General enquiries : contact@toonah.io