Naq for small businesses

Compliance software for your growing business.

A buyer has asked for a certificate or an assessment, and nobody on your team owns compliance yet. Naq takes on the job from the week you sign up, and every decision still goes to the right person on your team to approve.

Trusted by regulated companies across the UK and EU
What changes

Win the contract without hiring a compliance manager first.

The problem

The buyer's request lands on a founder or operations lead, on top of the job they already have. Waiting for a compliance hire would leave the request unanswered until someone is recruited and in post.

The outcome

You can tell the buyer where you stand against the standard they asked for, requirement by requirement.

How Naq helps

What to do next

Your dashboard shows how many controls are in place and what still needs work. Next up picks out the three things that most need you.

The next buyer's standard

One control meets requirements in several frameworks. When the next buyer asks for a different standard, you start from the controls you already hold.

One page to send buyers

Choose which controls, documents and FAQs appear on your Trust Centre, and point every buyer to the same public page.

Training and devices on file

Register your staff and devices, and assign courses that expire and prompt a retake. Each record counts as evidence for your controls.

The platform

The record you answer each buyer from.

See the full Naq platform

Next up, your to-do list and every approval waiting on you

Your dashboard shows how many controls are in place and what still needs work. Next up picks out the three things that most need you, and your to-do list collects approvals, reviews and expiries in priority order. Items clear themselves once the work is done.

25 features in Getting started, Collaboration, Organisation and integrations and Platform and security
Included
With clinical frameworks
Onboarding wizard
To do list
Dashboard
CSV bulk import
CSV export
In-app and email notifications
Watch any record
Comments
Activity timelines and audit log
Linked records
Reference IDs
In-app support and feedback
Organisation profile
Branding
Google Workspace integration (early access)
Microsoft 365 integration (early access)
Microsoft Intune integration (early access)
Multiple accounts and reconnect alerts
Request an integration
Sign in with Google or Microsoft
Role-based access
Framework-aware feature access
Organisation data isolation
Hosted in the UK
Account and organisation deactivation

Policies drafted from templates, approved and acknowledged

Start from a template already mapped to your frameworks. Your organisation’s details fill in, you submit it for approval, and the approved version goes to everyone who must read and acknowledge it. Naq reopens it on its review date.

15 features in Documents and policies
Included
With clinical frameworks
Template library
Rich-text document editor
Organisation variables
Semantic versioning
Approval workflow
Scheduled reviews
Upload existing documents
Document classification
Bulk generate from templates
PDF and Word export
Link to frameworks, controls and ROPA
Document assignments
Acknowledgement tracking
Required documents checklist
Archive and duplicate

Staff, training and devices kept as evidence

Register staff, teams and named roles such as Data Protection Officer. Assign courses that expire and prompt a retake. Every device has a custodian and a status from purchase to disposal, and each record counts as evidence for your controls.

17 features in People and access, Training, Devices and Employee Portal
Included
With clinical frameworks
People register
Teams
Responsibilities
Per-person compliance view
Offboarding
User accounts and invitations
Directory sync (early access)
Course builder
Assignments and progress
Quiz results and certification expiry
Device register
Employee self-declaration
Device discovery from Intune (early access)
Personal dashboard
Read and sign documents
My courses
My devices and my access

A Trust Centre buyers can check for themselves

Choose which controls, documents and FAQs appear on your public page. A control shows as in place only while it is implemented. Buyers request restricted documents and you approve each request.

7 features in Trust Centre
Included
With clinical frameworks
Public Trust Centre portal
Choose what to publish
Document access requests
FAQs
Visitor analytics
Custom domain
Trust Centre audit log
Before the hire

Answer the buyer before you decide on a hire.

Most companies selling into regulated buyers need a compliance manager before they can justify hiring one.

The usual routeHiring a compliance manager first
Virtual compliance partner
Starts
After recruiting and notice
The week you sign up
Policies
Written once they are in post
Started from templates mapped to your frameworks
Decisions
Made and remembered by one person
Approved by your team, with a full audit trail
Named roles
Only if the hire holds the role
Your own DPO, or a named expert from Naq's partner network
Naq AI

Naq AI analyses and suggests. Your team decides.

Nothing is written to your compliance record without a person approving it. Every suggestion is reviewed, confirmed by a named team member and timestamped, so your audit trail stays yours.

Ask
Answers from your own registersAsk in plain English. Naq Assistant searches your registers, policies and records and answers with tables you can open.
Answers from your own registersAsk in plain English. Naq Assistant searches your registers, policies and records and answers with tables you can open.
OverviewFrameworksPoliciesProcessing recordPeople
Naq Assistant
Naq AssistantNaq Assistant
Ready for review
Which suppliers hold patient data, and are their DPAs current?
Searching the vendor register · 23 suppliers
Filtering to processing activities with health data · 4 suppliers
Checking each supplier for a signed DPA
4 suppliers hold patient dataSources: Vendor register, ROPA #3, #7, #11
AWSHosting · London region
DPA signed
AccurxPatient messaging
DPA signed
TwilioSMS reminders
DPA signed
MixpanelProduct analytics
DPA expired
Read-only. Nothing in your record was changed.
Open Mixpanel
Suggest where Access Control Policy v2.0 counts as evidence.
Reading Access Control Policy v2.0 · 14 pages
Classified as a policy · access management
Comparing against ISO 27001, NHS DSPT and NHS DTAC
3 suggested mappingsAwaiting your confirmation
ISO 27001 A.5.18 · Access rightsSection 6.3 · high confidence
Confirm
NHS DSPT 4.2 · User access reviewsSection 6.3 · high confidence
Confirm
NHS DTAC C1.3 · Access managementSection 4 · medium confidence
Confirm
Each confirmation is recorded against your name.
Dismiss allConfirm all
Draft a DPIA for ROPA #11, analytics export.
Reading ROPA #11 · analytics export to a US sub-processor
Pulling 2 suppliers and 3 linked controls
Question for you: are direct identifiers removed before export?Yes, at source · answered by Amara
Drafting on the ICO template · 9 sections
DPIA · Analytics exportDraft · ICO template
Description of processingFrom ROPA #11
Drafted
Necessity and proportionalityCites CTL-041, CTL-058
Drafted
International transferIDTA and transfer risk assessment needed
Needs review
Becomes a document only when you approve it.
ImproveApprove
app.meridianhealth.co.uk
Reading the website and App Store listing
Identified a patient-facing triage app that processes health data
Matching the product to frameworks
Meridian Triage · drafted profileReady for review
DCB0129 · Clinical risk managementPatient-facing clinical functionality
Suggested
NHS DTACSold to NHS organisations
Suggested
UK GDPRSpecial category health data
Suggested
Nothing is saved until you review the profile.
Review profile
Read-only assistant
It can read your records. It cannot create, edit, approve or delete them.
Drafts, not decisions
Every draft is approved, sent back or rejected by a named person.
Only when you ask
Nothing runs on its own. Every scan, summary or draft starts from a button a person pressed.
Runs in London
Models run through Amazon Bedrock inside Naq's own AWS London region.
DPOs, CSOs and specialists

Your own DPO and CSO, or a named expert from Naq's partner network.

Some decisions need a person with their name on them: a Clinical Safety Officer signing off a hazard log, a DPO reviewing a transfer clause. Whoever holds the role records their review or sign-off inside your Naq record, so every decision stays in the audit trail.

Already have one

Bring your existing DPO or CSO into Naq

Invite your in-house or outsourced specialist as a user and assign them the named role. Naq routes the reviews and approvals that need them, and their review or sign-off is recorded against the record.

Need one

Access Naq's partner network

Naq partners with specialist firms who take on the named role for you. Meet them before you commit. They work inside your Naq workspace, alongside your team.

Clinical safety · named CSO
Data protection · outsourced DPO
Information security · internal audit
NHS assurance · DSPT and DTAC
Meet our partners→
From customers

ISO 27001, DTAC and DSPT, achieved and kept with Naq.

“Maintaining and demonstrating our credentials in the past has been onerous. The Naq platform makes the whole process remarkably seamless.”

Dr Taz Aldawoud, Founder & CEO, Doc Abode

“Naq has been instrumental in obtaining ISO 27001 certification and shortening our sales cycle by easily demonstrating our compliance to enterprise customers.”

Arnold Bouwman, Co-founder, Vormats

“Naq helped us complete our Cyber Essentials and DSPT toolkit applications. I already know next year’s DSPT Toolkit will be easy with Naq.”

Otesa, NHS supplier

Bring the request your buyer sent.

In 15 minutes we will show you where Naq would start on that request.

PlatformWhy NaqFrameworksPartnersIntegrationsResources