Platform
Modules
Services
Solutions
By role
Resources
Library
Why Violet
This page does not ask for trust: it lists what we claim and how to verify it. Everything here can be tested during the proof of concept, before you contract the platform.
The four claims
Scope
Audit, GRC, cloud posture, incident response and third-party risk use the same asset inventory and the same evidence repository. A technical finding knows which control it hits.
How to check it
Import your inventory and check that the same asset shows up in all five modules without duplicating.
Regulation
NIS2, DORA, ENS, ISO 27001 or SOC 2 are not templates bolted on at the end: they are the reason every status change is recorded with a date and an owner.
How to check it
Ask for the control-by-control mapping of your framework and look at the denominator: how many of its controls are actually assessed.
Economics
The report is built while you audit, not afterwards. The weeks that go into writing up and chasing fixes go back to the technical team.
How to check it
Time the last report you delivered and compare it with the same scope inside the platform.
Architecture
Schema separation in Postgres with Row-Level Security and encryption keys segregated per tenant: two independent controls, and neither of them lives in application logic. A bug in the code is not enough to cross from one client to another.
How to check it
Ask for the architecture summary under NDA and the segregation evidence in the procurement documentation: the Row-Level Security policy, key management, and the completed security questionnaire.
Against the alternatives
We are not good for everything. Here is what we replace, what we sit alongside, and what we deliberately do not do.
What it replaces
What it lives alongside
What it does not do
Who is behind it
Violet Security is written by people who have handed in audit reports at three in the morning. That is why the product has the shape it has.
Frequently asked
No. Violet Security does not run the test: it imports what your tools produce — more than a hundred built-in parsers — deduplicates across them and turns those findings into a case file with its evidence, its owner and its verification. Your Burp, your Nessus and your ZAP stay where they are.
The boundary is enforced by the database engine — schema separation in Postgres and Row-Level Security — not by the application layer, so it does not depend on every query being written correctly. Encryption follows the same line: keys are segregated per tenant. If your team wants to review it, the architecture summary and the completed security questionnaire are handed over under NDA.
NIS2, DORA, ENS, ISO/IEC 27001, ISO 22301, NIST CSF 2.0, CIS Controls, GDPR, SOC 2, PCI DSS, MITRE ATT&CK, OWASP and CRA. You can add your own or sector-specific frameworks, and Violet AI proposes the mapping between them for a person to review.
In the region the DPA states, with the specific provider named before any data is loaded. The sub-processor list is short and is handed over with the DPA before you start the proof of concept. On-premise and private cloud deployment also exist for those who need them.
Violet AI proposes: finding write-ups, remediation guidance, mapping between frameworks and document review of suppliers. It approves nothing. Every accepted suggestion is recorded with who accepted it and when, precisely because an audit report has to be defensible.
Yes. Natively multi-tenant, with your own brand, palette and domain per client. The end client signs into a portal carrying your identity and never sees the word Violet anywhere.
A small team can be operating in a day. An MSSP with history to migrate and several tenants to configure usually needs one to two weeks. The proof of concept is stood up in 48 hours.
It is exported in full in an open format — findings, evidence, reports and activity log — and deleted from our systems within the period agreed in the DPA. We do not hold the case file hostage to a renewal.
Proof of concept
We stand up an environment with your real scope, your findings and your frameworks. No cost, no card, no commitment to continue.
