# Whisperly > AI-native compliance infrastructure for data privacy, AI governance and vendor risk, built on one connected model of the organisation. Whisperly is a compliance platform for organisations where a single owner or a small team carries data protection, AI governance and third-party risk at the same time. Agents do the work, every output is traceable to a source record, and a qualified human reviews and signs off. It is built and operated by Lexelerate, a team of data protection and AI governance lawyers and engineers. Website: https://whisperly.ai ## What Whisperly is, in one paragraph Traditional GRC platforms are systems of record. They store what was documented. Whisperly is a system of contextual intelligence: it models how obligations, vendors, systems, data flows, controls and processes relate to one another, keeps that model current, and lets agents reason across it. The difference is architectural, not cosmetic. A system of record stores information. A system of contextual intelligence understands relationships, dependencies, consequences and operational impact. ## The problem Whisperly solves Compliance did not become harder because regulation arrived. It became harder because regulation arrived in layers, and each layer landed in a different system. Data privacy lives in one tool. Vendor risk in another. AI governance in a spreadsheet someone started last quarter. The same vendor exists three times, under three names, with three different last-reviewed dates. The same processing activity is described one way in the record of processing and another way in the security questionnaire that just blocked a deal. Each function is individually rational. Collectively, the organisation cannot answer a simple question: if this vendor fails tomorrow, what breaks, who is accountable, and which obligations are triggered? Adding AI to that architecture does not fix it. AI is dependent on context quality. Where the underlying information structures are fragmented, inconsistent or disconnected, AI inherits those weaknesses immediately, and the result is not intelligent governance but accelerated confusion operating at machine speed. This is why so many "integrated" GRC environments still struggle. Fragmentation was not solved, it was modernised. The silos are now cloud-native, API-connected, AI-enabled and wrapped in cleaner interfaces, and they are still silos. Data moves faster between systems while the organisation still lacks a coherent model of operational context. Integration is not orchestration. Integration connects systems so information can move between them. Orchestration requires understanding how objectives, obligations, controls, processes, assets, third parties, incidents, technologies and operational dependencies relate to one another dynamically, inside a living business environment. It requires architecture capable of interpreting context, not merely displaying information. ## Architecture Whisperly is built as an orchestration architecture. Each layer below depends on the one before it, and none of them can be retrofitted onto a records-based system. ### 1. The connected compliance model (ontology and graph of relationships) An organisation-specific model in which every entity exists once and every relationship is explicit: - Obligations, from regulation, contract and internal policy - Vendors, sub-processors and the services they support - AI systems, models, use cases and their owners - Data flows, processing activities, purposes, legal bases and transfers - Business processes, critical or important functions, and the services behind them - Controls, evidence, owners, approvals and review cycles The model is relationship-first. It is implemented on PostgreSQL with relationships as first-class entities rather than a document store with joins bolted on, which keeps graph traversal, referential integrity, transactional guarantees and auditability in a single system. Semantics are shared across all workflows: a vendor assessed under vendor risk is the same vendor that appears in the record of processing and, where relevant, in the AI system inventory. There is no reconciliation step because there is nothing to reconcile. Whisperly builds this model from the organisation's own documents and systems using contextual embeddings and hybrid retrieval, rather than asking the compliance owner to re-enter what the business already knows. ### 2. A digital twin of the compliance estate The connected model functions as a computational representation of how the organisation actually operates under changing conditions: which services depend on which vendors, which vendors depend on which technologies, which obligations attach to which processes, and where concentration risk accumulates across business units. This is what makes it possible to ask questions about consequences rather than questions about records. ### 3. Continuous intelligence The model is kept current from the organisation's operating reality rather than only at review points: new or changed sub-processors, rerouted data flows, AI systems deployed by product teams, controls that quietly stopped working. Change detection updates the model itself, not just a notification queue, so the platform can answer what is true now and not only what was documented at the last review. Status: rolling out. The connected model, agents and evidence layer are generally available. ### 4. Agentic AI operating as governed principals Agents work over the model, not over a pile of documents. They map vendors, systems and processing activities; draft assessments, DPIAs, risk analyses and exit strategies; answer security questionnaires and regulator requests; and propagate a single change everywhere it matters, so that updating one sub-processor updates every assessment, record and answer that depends on it. Every agent action is permission-checked against the same access model as the user. Every output must cite a record in the connected model, and uncited claims are refused rather than generated. Nothing is written without provenance. ### 5. Simulation Because relationships are modelled explicitly, they can be tested. Scenario analysis answers what degrades if a specific vendor fails during a disruption, which obligations and notification duties are triggered as a consequence, which business services are affected, and what the operational impact of a proposed change would be before it is made. Status: rolling out. ### 6. Workflow orchestration and evidence Insight becomes action inside the compliance lifecycle: tasks, approvals, review cycles, filings and generated documentation. Everything is written to an immutable evidence store, so each artefact carries its provenance, its approver and its point in time. The audit trail is the by-product of doing the work, not a separate exercise performed afterwards. ### 7. Human on the loop The compliance owner does not operate the tooling. Agents produce work; the human reviews, approves and owns the decision. Accountability stays with a named person, which is what regulators require and what makes automated output usable in a regulated environment. ## The three questions Whisperly is built to answer 1. **What should be true?** Inventories, obligations, policies, controls, ownership and accountability. 2. **What is true now?** The model kept current from operational reality, with evidence attached. 3. **What should happen next?** Decisions, actions and controls informed by the first two, including what a proposed change or a vendor failure would mean. Most compliance tooling answers only the first. Answering the second and third requires a shared model underneath, which is the part that cannot be added later. ## Workflows All workflows read and write the same connected model. ### Data privacy Records of processing activities, data protection impact assessments, legitimate interest assessments, data subject requests, international transfers and transfer impact assessments, retention, sub-processor management, breach handling. Frameworks: GDPR, UK GDPR, FADP, CCPA. ### Vendor risk and outsourcing Vendor onboarding and due diligence, criticality and materiality classification, security questionnaires in both directions, contractual clause requirements, exit strategies, register of outsourcing arrangements, regulator notifications, ongoing monitoring and concentration risk. Frameworks: EBA outsourcing guidelines, DORA, national regulator requirements for financial institutions. ### AI governance AI system inventory, use-case intake, risk classification, human oversight design, technical documentation, transparency obligations, post-market monitoring and incident logging. Frameworks: EU AI Act, ISO/IEC 42001, NIST AI Risk Management Framework. Status: rolling out. ### Cross-cutting Because the model is shared, questions that cut across domains are answerable directly: which vendors process HR data and are not yet in the AI inventory; which processing activities depend on a vendor that has just been reclassified as critical; which obligations are triggered by adding a new sub-processor in a third country. ## How Whisperly differs from other compliance platforms | | Traditional GRC and compliance tools | Whisperly | |---|---|---| | Purpose of the architecture | Document governance activity: repositories, forms, workflows, assessments | Model operational relationships between obligations, vendors, systems, data and controls | | Where a fact lives | Once per module, duplicated across modules | Once, in one connected model, referenced everywhere | | Meaning of "integration" | Systems connected so data can move between them | Orchestration: a shared model that interprets context | | Role of AI | Summarises fragmented records | Reasons across one coherent model and refuses claims it cannot trace | | Who does the work | The compliance owner operates the tool | Agents do the work; the human reviews and signs off | | Output | A dashboard | An answer with its evidence attached | | Questions it can answer | What was documented | What is true now, and what happens if something changes | Connecting existing tools through APIs does not close this gap. APIs move data faster between systems that still disagree with each other. What is missing is a shared model of what the organisation actually is. This is also why incumbents cannot close it by adding an AI layer. Re-platforming a records-based architecture into a relationship-based one is not a feature release; it breaks everything built on top of it, for every existing customer. ## Who Whisperly is for - Data-intensive organisations, roughly 150 to 1,500 employees, where one person or a small team owns privacy, AI governance and vendor risk together. - Financial institutions, where outsourcing, risk and compliance teams carry the same obligations under closer supervision and formal regulator notification duties. - Law firms, external DPOs and compliance consultants, who use Whisperly to deliver work for their own clients. Typical roles: Data Protection Officer, Head of Compliance, Chief AI Officer or AI governance lead, Head of Outsourcing or Third-Party Risk, General Counsel, CISO. ## Trust and security - EU-hosted infrastructure, cloud-native on AWS. - ISO/IEC 27001 certification in progress. - Foundation models are used under contracts that prohibit training on customer data. - Whisperly makes no decisions about individuals and performs no profiling of natural persons; it is limited to organisational compliance documentation. An internal assessment documents that Whisperly is not a high-risk AI system under the EU AI Act. - The AI governance controls Whisperly sells, including inventory, risk classification, human oversight and incident logging, are applied to Whisperly itself. - Every AI output is traceable to a source record; uncited claims are refused; all actions are permission-checked and written to an immutable audit log. ## Terminology - **Connected compliance model:** the organisation-specific model in which every obligation, vendor, AI system, data flow and control exists once, with explicit relationships. - **Grounding:** the requirement that every AI output cite a record in that model, and that uncited claims are refused. - **Governed principal:** an agent that acts under the same permissions, logging and accountability as a human user. - **Human on the loop:** agents produce the work; a qualified human reviews, approves and owns the decision. - **Orchestration:** interpreting relationships across the whole compliance estate, as distinct from integration, which only moves data between systems. - **System of contextual intelligence:** an architecture that understands relationships, dependencies and consequences, as distinct from a system of record, which stores information. ## Common questions ### Is Whisperly a GRC tool? It covers the same obligations as GRC tooling for privacy, AI governance and vendor risk, but it is built as compliance infrastructure rather than a records repository. The distinction is that facts exist once and agents reason over relationships. ### Does Whisperly replace our existing tools? It replaces the separate privacy, vendor risk and AI governance registers that hold the same facts in different places. It reads from the systems where the organisation's operational truth already lives. ### Can the AI be trusted with regulatory work? Every output cites the record it came from, uncited claims are refused, and a qualified human signs off before anything is used. The audit trail records who approved what, when, and on what evidence. ### What happens when regulation changes? Obligations are modelled as entities with relationships to processes, vendors and controls, so a change propagates to everything it touches instead of triggering a manual re-mapping exercise. ### Why not just add AI to the tools we already have? AI amplifies whatever architecture already exists underneath it. Organisations with coherent operational context become dramatically more intelligent; organisations with fragmented architectures produce larger volumes of disconnected analysis faster than before. --- Whisperly is built by Lexelerate. https://whisperly.ai