Naq for compliance teams

Compliance software for teams holding several frameworks.

You hold more than one framework and know what each asks of the business, yet every review and expiry behind them still runs through you. Naq maps each control once and counts it in every framework it meets, and each decision comes to a named person to approve.

Trusted by regulated companies across the UK and EU
Your week

Run every framework you hold from one set of controls.

The problem

Every hire adds courses to track and policies to acknowledge, and each framework wants the same evidence collected again. When the one person running it all takes leave, reviews stop until they return.

The outcome

Your team keeps the judgement calls across your frameworks, with the routine work taken on by Naq.

How Naq helps

Every framework in one view

A readiness overview shows where each framework you hold stands, and each one is tracked requirement by requirement.

Reviews that come due

Policies reopen on their review date, and courses prompt a retake when they expire.

Cover while you are away

Reviews and expiries still reach their owners while you are on leave.

A record that survives handovers

Every record and decision stays on file with an activity timeline, so whoever picks up the work can see what was decided and when.

Inside Naq

The work around your people, documents, suppliers and devices.

See the full Naq platform

Next up, your to-do list and every approval waiting on you

Your dashboard shows how many controls are in place and what still needs work. Next up picks out the three things that most need you, and your to-do list collects approvals, reviews and expiries in priority order. Items clear themselves once the work is done.

25 features in Getting started, Collaboration, Organisation and integrations and Platform and security
Included
With clinical frameworks
Onboarding wizard
To do list
Dashboard
CSV bulk import
CSV export
In-app and email notifications
Watch any record
Comments
Activity timelines and audit log
Linked records
Reference IDs
In-app support and feedback
Organisation profile
Branding
Google Workspace integration (early access)
Microsoft 365 integration (early access)
Microsoft Intune integration (early access)
Multiple accounts and reconnect alerts
Request an integration
Sign in with Google or Microsoft
Role-based access
Framework-aware feature access
Organisation data isolation
Hosted in the UK
Account and organisation deactivation

Frameworks, scopes and controls that share evidence

Choose the frameworks you are measured against and the scope each one covers. One control meets requirements in several frameworks, so the work is done once. Evidence checks run on a schedule, and a control drops back to needs review when its evidence expires.

17 features in Compliance frameworks and Controls and evidence
Included
With clinical frameworks
Naq-managed framework catalogue
Compliance instances
Requirement-by-requirement tracking
Compliance scopes
Cross-framework control mapping
Readiness overview
Custom frameworks
Framework version upgrades
DTAC evidence pack download
Standards library
Control library
Evidence attached to controls
Requirement coverage view
Evidence expiry tracking
Suggested evidence coverage
Evidence Library
Control activity history

Policies drafted from templates, approved and acknowledged

Start from a template already mapped to your frameworks. Your organisation’s details fill in, you submit it for approval, and the approved version goes to everyone who must read and acknowledge it. Naq reopens it on its review date.

15 features in Documents and policies
Included
With clinical frameworks
Template library
Rich-text document editor
Organisation variables
Semantic versioning
Approval workflow
Scheduled reviews
Upload existing documents
Document classification
Bulk generate from templates
PDF and Word export
Link to frameworks, controls and ROPA
Document assignments
Acknowledgement tracking
Required documents checklist
Archive and duplicate

Staff, training and devices kept as evidence

Register staff, teams and named roles such as Data Protection Officer. Assign courses that expire and prompt a retake. Every device has a custodian and a status from purchase to disposal, and each record counts as evidence for your controls.

17 features in People and access, Training, Devices and Employee Portal
Included
With clinical frameworks
People register
Teams
Responsibilities
Per-person compliance view
Offboarding
User accounts and invitations
Directory sync (early access)
Course builder
Assignments and progress
Quiz results and certification expiry
Device register
Employee self-declaration
Device discovery from Intune (early access)
Personal dashboard
Read and sign documents
My courses
My devices and my access

Suppliers, risks, incidents and corrective actions

Track suppliers and who has access to each one. Score every risk before and after treatment and set its review date. Log incidents with what happened, then follow each corrective action through to closed.

29 features in Vendors and suppliers, Risks, hazards and incidents, Corrective actions, Privacy and ROPA and Products and clinical safety
Included
With clinical frameworks
Vendor register
Vendor access tracking
Link vendors to processing activities
Vendor discovery from SSO (early access)
Publish sub-processors
Risk register
Risk matrix scoring
Treatment plans linked to controls
Risk reviews and approvals
Risk register export
Clinical hazard log
Hazard log versions and export
Hazard import
Incident register
Clinical, security, privacy and quality profiles
Incident export
CAPA register
Action workflow
CAPA activity and archive
Record of processing activities
Controller and processor registers
Processing intake questionnaire
Exemptions and reviews
ROPA import and export
Record versions and links
DPIA drafting agent
Product register
Clinical product profile
Analyse a product from a link
Against the tracker

The work on a shared control is done once.

With a tracker for each framework, the same control is kept up in several places.

See multi-framework management
The usual routeA tracker for each framework
Virtual compliance partner
A new framework
Set up from a blank sheet
Started from the controls you already hold
Staff and devices
Copied in by hand
Staff directory and two-factor status synced from Microsoft 365 or Google Workspace, and devices found by Microsoft Intune
Out-of-scope requirements
Explained in a cell comment
Marked not applicable with a written justification, and the decision logged
Approvals
Chased by email
Collected with reviews and expiries on your to-do list in priority order, and cleared once the work is done
Naq AI

Naq AI analyses and suggests. Your team decides.

Nothing is written to your compliance record without a person approving it. Every suggestion is reviewed, confirmed by a named team member and timestamped, so your audit trail stays yours.

Ask
Answers from your own registersAsk in plain English. Naq Assistant searches your registers, policies and records and answers with tables you can open.
Answers from your own registersAsk in plain English. Naq Assistant searches your registers, policies and records and answers with tables you can open.
OverviewFrameworksPoliciesProcessing recordPeople
Naq Assistant
Naq AssistantNaq Assistant
Ready for review
Which suppliers hold patient data, and are their DPAs current?
Searching the vendor register · 23 suppliers
Filtering to processing activities with health data · 4 suppliers
Checking each supplier for a signed DPA
4 suppliers hold patient dataSources: Vendor register, ROPA #3, #7, #11
AWSHosting · London region
DPA signed
AccurxPatient messaging
DPA signed
TwilioSMS reminders
DPA signed
MixpanelProduct analytics
DPA expired
Read-only. Nothing in your record was changed.
Open Mixpanel
Suggest where Access Control Policy v2.0 counts as evidence.
Reading Access Control Policy v2.0 · 14 pages
Classified as a policy · access management
Comparing against ISO 27001, NHS DSPT and NHS DTAC
3 suggested mappingsAwaiting your confirmation
ISO 27001 A.5.18 · Access rightsSection 6.3 · high confidence
Confirm
NHS DSPT 4.2 · User access reviewsSection 6.3 · high confidence
Confirm
NHS DTAC C1.3 · Access managementSection 4 · medium confidence
Confirm
Each confirmation is recorded against your name.
Dismiss allConfirm all
Draft a DPIA for ROPA #11, analytics export.
Reading ROPA #11 · analytics export to a US sub-processor
Pulling 2 suppliers and 3 linked controls
Question for you: are direct identifiers removed before export?Yes, at source · answered by Amara
Drafting on the ICO template · 9 sections
DPIA · Analytics exportDraft · ICO template
Description of processingFrom ROPA #11
Drafted
Necessity and proportionalityCites CTL-041, CTL-058
Drafted
International transferIDTA and transfer risk assessment needed
Needs review
Becomes a document only when you approve it.
ImproveApprove
app.meridianhealth.co.uk
Reading the website and App Store listing
Identified a patient-facing triage app that processes health data
Matching the product to frameworks
Meridian Triage · drafted profileReady for review
DCB0129 · Clinical risk managementPatient-facing clinical functionality
Suggested
NHS DTACSold to NHS organisations
Suggested
UK GDPRSpecial category health data
Suggested
Nothing is saved until you review the profile.
Review profile
Read-only assistant
It can read your records. It cannot create, edit, approve or delete them.
Drafts, not decisions
Every draft is approved, sent back or rejected by a named person.
Only when you ask
Nothing runs on its own. Every scan, summary or draft starts from a button a person pressed.
Runs in London
Models run through Amazon Bedrock inside Naq's own AWS London region.
DPOs, CSOs and specialists

Your own DPO and CSO, or a named expert from Naq's partner network.

Some decisions need a person with their name on them: a Clinical Safety Officer signing off a hazard log, a DPO reviewing a transfer clause. Whoever holds the role records their review or sign-off inside your Naq record, so every decision stays in the audit trail.

Already have one

Bring your existing DPO or CSO into Naq

Invite your in-house or outsourced specialist as a user and assign them the named role. Naq routes the reviews and approvals that need them, and their review or sign-off is recorded against the record.

Need one

Access Naq's partner network

Naq partners with specialist firms who take on the named role for you. Meet them before you commit. They work inside your Naq workspace, alongside your team.

Clinical safety · named CSO
Data protection · outsourced DPO
Information security · internal audit
NHS assurance · DSPT and DTAC
Meet our partners→
From customers

ISO 27001, DTAC and DSPT, achieved and kept with Naq.

“Maintaining and demonstrating our credentials in the past has been onerous. The Naq platform makes the whole process remarkably seamless.”

Dr Taz Aldawoud, Founder & CEO, Doc Abode

“Naq has been instrumental in obtaining ISO 27001 certification and shortening our sales cycle by easily demonstrating our compliance to enterprise customers.”

Arnold Bouwman, Co-founder, Vormats

“Naq helped us complete our Cyber Essentials and DSPT toolkit applications. I already know next year’s DSPT Toolkit will be easy with Naq.”

Otesa, NHS supplier

Pick a control your frameworks share.

Ask to see one control counted in several frameworks.

PlatformWhy NaqFrameworksPartnersIntegrationsResources