Meet Naq: your virtual compliance partner.
Intelligent compliance, without the hire. Naq reads your policies, maps your controls and flags what is slipping, so you are ready whenever a buyer or auditor asks.
.png)
.png)
Evidence mapped once, policies reviewed on time, every owner followed up.
Next up, your to-do list and every approval waiting on you
Your dashboard shows how many controls are in place and what still needs work. Next up picks out the three things that most need you, and your to-do list collects approvals, reviews and expiries in priority order. Items clear themselves once the work is done.
Frameworks, scopes and controls that share evidence
Choose the frameworks you are measured against and the scope each one covers. One control meets requirements in several frameworks, so the work is done once. Evidence checks run on a schedule, and a control drops back to needs review when its evidence expires.
Policies drafted from templates, approved and acknowledged
Start from a template already mapped to your frameworks. Your organisation’s details fill in, you submit it for approval, and the approved version goes to everyone who must read and acknowledge it. Naq reopens it on its review date.
Staff, training and devices kept as evidence
Register staff, teams and named roles such as Data Protection Officer. Assign courses that expire and prompt a retake. Every device has a custodian and a status from purchase to disposal, and each record counts as evidence for your controls.
Suppliers, risks, incidents and corrective actions
Track suppliers and who has access to each one. Score every risk before and after treatment and set its review date. Log incidents with what happened, then follow each corrective action through to closed.
Answers from your records, drafts for your approval
Ask a question and Naq Assistant looks up your own records before it answers. It suggests which controls a policy supports and drafts DPIAs from your workspace. It only works when someone asks, and nothing is applied until a person approves it.
A Trust Centre buyers can check for themselves
Choose which controls, documents and FAQs appear on your public page. A control shows as in place only while it is implemented. Buyers request restricted documents and you approve each request.
Cover from week one, through holidays and leavers.
Most companies selling into regulated buyers need a compliance manager before they can justify hiring one. Naq takes on the job from the week you sign up, and every decision still goes to the right person on your team to approve.
Virtual compliance managerNaq AI analyses and suggests. Your team decides.
Nothing is written to your compliance record without a person approving it. Every suggestion is reviewed, confirmed by a named team member and timestamped, so your audit trail stays yours.
OverviewFrameworksPoliciesProcessing recordPeopleThe standards regulated buyers ask for.
Your first framework builds the foundations for the rest.
NHS DSPT
The Data Security and Protection Toolkit every NHS supplier publishes against each year. Naq keeps the standards met between submissions.
NHS DTAC
The assessment criteria for any digital product entering the NHS. Version 2 went live in February 2026; Naq holds the current form complete.
DCB 0129
The clinical safety standard for health IT manufacturers. Hazard log and safety case in one record, flagged for CSO sign-off on every change.
ISO 27001
The information security standard enterprise procurement asks for first. Ready for every surveillance audit, not just the first one.
ISO 9001
Quality management, built on the controls you already hold for 27001. Shared clauses count once.
Cyber Essentials
The NCSC baseline for UK public-sector contracts. Renewed before it expires, with Plus when the buyer asks.
UK and EU GDPR
A living Article 30 record, DPIAs drafted from it, and a DSAR register your Assistant can answer from.
SOC 2
The security report US enterprise buyers ask for. Naq keeps the controls running and the evidence ready for the CPA firm that signs it.
HIPAA
The US rules for protecting patient health data, binding on suppliers to American providers and insurers. Naq keeps your safeguards documented and evidenced.
Custom frameworks
A buyer's own standard, a sector code or an internal policy set. Scoped with you, mapped to the controls you already hold.Your own DPO and CSO, or a named expert from Naq's partner network.
Some decisions need a person with their name on them: a Clinical Safety Officer signing off a hazard log, a DPO reviewing a transfer clause. Whoever holds the role signs off inside your Naq record, so every decision stays in the audit trail.
Bring your existing DPO or CSO into Naq
Invite your in-house or outsourced specialist as a user and assign them the named role. Naq routes the reviews and approvals that need them, and their sign-off is recorded against the record.
Access Naq's partner network
Naq partners with specialist firms who take on the named role for you. Meet them before you commit. They work inside your Naq workspace, alongside your team.
ISO 27001, DTAC and DSPT, achieved and kept with Naq.
“Maintaining and demonstrating our credentials in the past has been onerous. The Naq platform makes the whole process remarkably seamless.”
Dr Taz Aldawoud, Founder & CEO, Doc Abode
“Naq has been instrumental in obtaining ISO 27001 certification and shortening our sales cycle by easily demonstrating our compliance to enterprise customers.”
Arnold Bouwman, Co-founder, Vormats
“Naq helped us complete our Cyber Essentials and DSPT toolkit applications. I already know next year’s DSPT Toolkit will be easy with Naq.”
Otesa, NHS supplierLearn more from our security & compliance experts
.png)
What You Need to Know About DTAC Version 2
NHS England introduced an updated Digital Technology Assessment Criteria form on 24 February 2026. Manufacturers and NHS organisations must transition to DTAC version 2 before 6 April 2026, when the previous version will no longer be accepted.
Bring the frameworks you hold and see Naq run them.
In 15 minutes we will show you the work Naq would take on this week.
