Evidence and reconstruction above existing GRC
Dossier Secure Enterprise is the evidence and reconstruction layer above the systems you already use. It preserves the decision route: what the board knew, decided and relied on, tied to the versioned rule that applied at that time.
If you can’t prove it, you can’t defend it.
Where the evidence earns its value
Reconstruction, pre-submission validation and incident reporting determine whether a record can carry a decision when scrutiny arrives. In the Netherlands, the Cybersecurity Act has applied since 15 August 2026 to more than 8,000 organisations.
Forensic reconstruction
The historic rule, event, authority and recorded outcome are replayed together. Each verdict is append-only, separately hashed and RFC 3161-timestamped; an earlier verdict remains intact.
PASSED means replaymatch: the stored and replayed outcomes match. It is not legal approval.
DORA Register of Information
The official 120-rule registry is structured across technical, DPM technical, DPM business and LEI/EUID layers. Nineteen rules are mechanically executed today; every remaining rule is explicitly marked, never assumed passed.
Incident reporting
Classification, evidence and the filed report stay together while the product shows the three DORA clocks separately. What happened and what was reported remain reviewable afterwards.
One reviewable chain
Every layer answers a different reviewer question. Together they preserve the route from the rule that applied to the verdict a reviewer can independently inspect.
A missing link is not hidden or inferred. It remains visible until the record can support it.
The questions that change a review
The point is not to make uncertainty disappear. The point is to make it inspectable.
Proof in the product
These anonymised live screens show the working record: rule, obligation, control, evidence and reconstruction. No simulated interface.
Evidence at work
Evidence should be ready before the review begins.
The product keeps operational context close to the decision. It remains visible, structured and ready to inspect.
What the record says
ConnectedRule, authority, measure and evidence remain linked for review.
Visible gapA missing element stays visible; it is not treated as resolved.
ReplaymatchPASSED means the stored and replayed outcomes match, not legal approval.
The enterprise distinction
Operational systems retain documents and workflows. Dossier Secure Enterprise links the historic rule, authority, evidence and recorded outcome, so a later review begins with a reproducible route rather than a manual reconstruction.
ROI calculator
A planning aid, not a claim: estimate reviews × hours × internal hourly rate.
Live jurisdictions
Operating boundary
Choose Netherlands, Belgium · NBB or Belgium · FSMA. Each legal entity or business division has an isolated tenant; its data is not visible to another tenant. Dutch, English, French and German are supported. Expansion to the UK, Ireland, Canada, Australia and the United States is in preparation.
Read the Trust page→The operating model
The live foundation connects versioned legal sources, obligation routes, controls and evidence; exposes implemented register checks and incident clocks; and replays recorded outcomes. No AI takes part in derivation, weighting or execution: an outcome that cannot be reproduced proves nothing later. End-to-end automation is presented only where it is proven.
ICT providers, contracts, functions, assessments and the organisational profile become the institution’s factual input.
Applicable obligations are derived from versioned sources where the mechanism is live; every unsupported link remains explicit.
Nineteen of the 120 registered RoI rules execute mechanically today. All remaining rules stay visibly unexecuted, never assumed passed.
Incident clocks, validation findings, ownership and remediation remain connected in the reviewable record.
The recorded outcome can be replayed against the policy and authority of that moment, then stored in a separate hashed, RFC 3161-timestamped verdict. The timestamp is not qualified under eIDAS until a QTSP upgrade.
Private proposal
Before a commercial proposal, one consequential decision is reviewed for traceability, missing context and reconstruction. The next scope follows privately from what the record can and cannot support.
Define the evidence scope→FAQ
The evidence route keeps the source version, authority, decision, controls and supporting records connected for review.
The gap remains reviewable until it is addressed; it is not presented as resolved or compliant.
The GRC route connects source, obligation, control, evidence and reconstruction as one inspectable chain.
It means stored and replayed outcomes match: replaymatch, not legal approval.
No. The implementation route starts with one consequential decision and its records; the next scope follows after that route is reviewable.
The Trust page separates technical product evidence, partial implementation evidence and items that are still unestablished or on the roadmap.
A confidential first review
We review which rule applied, who held authority, what information was available, what evidence is missing and whether the recorded outcome can be reconstructed. You receive a clear scope for the next step. It is not a public assessment.