Compliance you can see, for the AI your team already uses.
Tracehold maps what your people send to AI tools to 39 controls across GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2, and exports a report for each framework. It is part of the Governance plan. It supports your audits; it is not legal advice or a certification.
Your regulations didn't change. The way your team works did.
GDPR, NIS2, DORA and the EU AI Act are law; ISO 27001 and SOC 2 are the standards your customers and auditors hold you to. Your people now paste customer data, credentials and internal documents into AI tools every day, outside the controls built for email and file sharing.
Tracehold watches that channel. It checks what is about to be sent, acts according to your policy, and records each detection in the console. The compliance view is built from those detections, not from a questionnaire you fill in.
A view built from detections
Each framework gets a risk score from 0 (best) to 100 (worst), in four bands: Low, Medium, High and Critical. It moves as your detections change.
Reports to hand to your auditor
Export one report per framework as PDF or CSV from the console, or as JSON through the API.
From an incident to the controls it breaches
Each detection and incident is marked with the controls it breaches, so you can follow one event to the article it concerns.
Six frameworks, 39 controls
Each control cites the article or criterion it relates to and the kinds of data whose detection evidences it.
GDPR — 10 controls
Regulation (EU) 2016/679. Data minimisation, lawfulness, special categories, protection by design, processors, records of processing, security, breach notification, impact assessment and international transfers.
NIS2 — 4 controls
Directive (EU) 2022/2555. Risk management, supply chain security, cryptography and incident notification.
ISO 27001 — 6 controls
ISO/IEC 27001:2022, Annex A. Information transfer, access control, cloud services, privacy and PII protection, data loss prevention and monitoring.
SOC 2 — 5 controls
Trust Services Criteria. Risk assessment, logical access, security operations, third-party risk and confidentiality.
EU AI Act — 8 controls
Regulation (EU) 2024/1689. AI literacy, prohibited practices, data governance, record-keeping, human oversight, deployer obligations, transparency and serious incident reporting.
DORA — 6 controls
Regulation (EU) 2022/2554. ICT risk governance, protection and prevention, detection, incident management and reporting, and third-party risk.
From an everyday leak to a report you can trust
No surveys, no guesswork. The compliance view is built from the detections recorded on real activity.
01 · We watch the AI channel
Tracehold checks what is about to be sent to AI tools, in the browser extension or on the endpoint, and acts according to your policy: observe, warn, redact or block.
02 · We map it to each regulation
Each detection has a category, and each control lists the categories that evidence it. When a detection is recorded, the console marks the controls it breaches. Each framework gets a risk score from 0 (best) to 100 (worst).
03 · You export the proof
Export one report per framework from the console: the risk score and band, the trend, each control with the detections behind it, and recommendations. PDF or CSV, or JSON through the API.
Reports for your auditors and your board
Open a framework in the console and export it. Compliance reporting is part of the Governance plan.
Pick any single incident and the console shows which controls it breaches, so you can follow one event to the article it concerns. Reports are built from event metadata plus a masked sample of the value, not from the full prompt. Keeping the content of findings is off by default; if your organisation turns it on, it is encrypted and deleted after 90 days.
One report per framework
Six frameworks (GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2), each with its own report, as PDF or CSV from the console and JSON through the API.
Risk and trend
The framework’s risk score and band, and how it has moved over time.
Control by control
Every control with its status (Covered, Partial coverage or No evidence) and the detections and blocks behind it. Controls with no evidence in the period, or only partial coverage, are flagged for review.
Special-category data
The GDPR report lists detections of special-category data (Article 9) separately.
Groups and subsidiaries
With several organisations in scope, the view averages them and shows the weakest one, so a struggling business unit cannot hide behind a good average.
Compliance that's measured, not assumed
Mapping, not a binder
See what Tracehold detects mapped to the controls of GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2, in a view that moves as your detections change.
Covers shadow AI too
The extension recognises more than 300 AI tool domains, including unapproved ones: in the console you allow each one, leave it under review or block it.
Rolled out with your own tools
The extension’s packages and policy come from the console, and your device management (MDM or GPO) does the deployment; there is a guide for Intune. The Windows and Linux agents are optional extras for AI use outside the browser.
European by design
Built and hosted in the EU, with each organisation’s data separated by row-level security.
What buyers ask about compliance
Can I show this to an auditor?
Which frameworks does it cover?
Where does the mapping come from?
We are a group with subsidiaries: does it roll up?
Do you store our prompts to build the reports?
How do we roll it out?
Does Tracehold certify us for GDPR, ISO 27001 or SOC 2?
Turn AI risk into a report you can show the board
Book a demo and we’ll show you the compliance view built from your own detections, and the report behind it.