An agent that works inside your program.
Tell TruPilot what you need done: get ready for an audit, map your controls to a new framework, review a vendor. It does the work across your program, cites every source, and waits for your approval. It's also on every screen, next to the table you're working in.
TruPilot is the AI built into every TruOps screen. It answers GRC questions from your live program data and lists the records it used. It can also create, map, filter, and draft in your registers and tables. A person accepts, edits, or rejects every change, and TruPilot only has the permissions of the person asking.
The challenge
AI in GRC should do the work. Open an assessment: it should already be filled in, with every answer listing the records it used.
What you're probably using today
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| ChatGPT or Copilot on the side | Useful for drafts, but it has no permissions, no audit log, and no links to your program records. | TruPilot runs with each user's permissions, drafts the work, cites its sources, and waits for approval. Every action goes in the audit log. |
| A GRC chatbot added onto a suite | It can chat, but it can't pre-fill, map, or group findings in the tables you work in. | TruPilot works directly in your registers and tables. Chat is just how you talk to it. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
Your tables, with an AI teammate
Your risk registers, controls, assessments, and findings are tables your team works in directly, and TruPilot sits right beside them. Ask it to map a questionnaire to ISO 27001, draft risks from a SOC 2 report's exceptions, or filter the register to your biggest exposures, and it does the work in the table you're looking at.
One question, three parts of your program
Ask "Which critical vendors had a SOC 2 exception on a control we failed this quarter?" TruPilot reads your vendor tiers, the exceptions pulled from each report, and this quarter’s control results. It answers with four vendors and the records behind each one. In a spreadsheet that question is an afternoon. Here it is one sentence.
Answers you can verify
Ask "How ready are we for the NIST AI RMF?" and TruPilot answers from your framework map, risk register, and control monitoring, then lists those sources under the answer. If it can't find a source, it says so.
- Answers based on your own documents and records
- Sources listed with every answer
- Requests that span modules handled in one go
- Asks before making any change and shows the steps it took
Same rules as your team
TruPilot can only see and do what the person asking can. Every action, whether a person or TruPilot takes it, follows the same access rules and goes into the same audit log. Over time, Claude, Copilot, and your own agents will be able to take the same actions through MCP.
How TruOps helps
- Works in your tables
- Creates, maps, filters, and drafts right in your registers and tables.
- Sourced answers
- Every answer lists the documents and records it used.
- You approve every change
- A person accepts, edits, or rejects each change.
- Same permissions as you
- TruPilot can only see and do what the person asking can.
- Builds views on request
- Ask for a chart or report and it builds one from live data.
- Remembers context
- Picks up where your last conversation left off.
Questions
Is TruPilot a chatbot?
It's an AI assistant built into the product. It works in the same tables and records as your team and can take action there, with a person confirming each change.
Can TruPilot make changes without approval?
No. TruPilot suggests and a person accepts, edits, or rejects. Every action goes into the same audit log as your team's actions.
What data can TruPilot see?
Only what the person asking can see. It follows the same role- and attribute-based permissions as your users.
Can I use TruOps from my own AI tools?
That's where we're headed. We plan to offer TruOps as an MCP server so Claude, Copilot, and your own agents can work in your GRC program with each user's permissions. It isn't available yet, and we haven't set a date.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Related
Upload what you have. Agents classify it and map it to your controls.
→PlatformReporting & dashboardsDescribe a chart in plain language and click into any number to see its source.
→LearnWhat is AI GRC?When AI does the work of governance, risk, and compliance.
→LearnHuman-in-the-loop AI in GRCWhy AI should draft and people should decide.
→CompanyCommitmentsHow TruOps' AI behaves and how to check it in a demo.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.