Why we built it

Compliance is not a category. It is how a business operates.

Our families are part owners of a large New Zealand composting business, and we are farmers. We know compliance is not a tidy list in a system. It is the plans, SOPs, consents, records, checks, and decisions that have to work on the ground every day.

When a business adds a customer, market, certification, site, or regulation, much of that work is repeated. The same controls and evidence are checked, adapted, and submitted again, even when they already meet much of the new requirement.

The experience behind Porticus

We have helped software clients through ISO/IEC 27001 certification and advised organisations on AI governance controls aligned with the EU AI Act.

We have also used existing tools first-hand. They are strong at the problem they are built to solve. But most operators do not manage a single information-security programme in isolation. They manage multiple, overlapping compliance programmes, plus the custom processes that make their business work.

That is the problem Porticus is designed for.

What Porticus does

Understand the operation. Connect the requirements. Focus the effort.

Porticus uses AI to understand the requirements that apply to a business and the controls, procedures, and evidence it already has.

• filter out requirements that do not apply;
• identify where one control or record supports several obligations;
• highlight genuine gaps, conflicts, or outdated work; and
• keep policies, checks, and evidence current as requirements change.

The aim is simple: less repeated compliance work, clearer priorities, and a programme that reflects how the business actually operates.