Empower your business teamsto build with AI.Keep CISO in control.

NEKOD is governance for the applications your business teams build with AI. Your teams keep building. The CISO keeps one portfolio, each application checked against your own policies in proportion to its risk, and a recorded approval.

Enterprise organisations where business teams build applications with AI, outside engineering. The CISO or CIO signs. A head of AI, automation or the Centre of Excellence usually champions it. Risk and compliance approve against your policy. Domain experts in finance, operations, HR and similar teams keep building.

Discover, Control, Approve, Monitor. NEKOD reads the application's repository, summarises what it does, and the owner confirms the scope. It checks the application against your own policies in proportion to its risk, shows the evidence, and records the approval in one portfolio. You can edit a rule and check again.

Each application against your own policies, in proportion to its risk. The checks cover security, reliability, maintainability and commercial readiness, including exposed secrets, known vulnerabilities, sign-in protection, database access and consent. Each finding has a plain-language explanation, a severity and a suggested fix. Results combine into a score from 0 to 100.

They confirm what the application does and read the findings in plain language. They apply the fix in the AI tool they already use, such as Cursor, Claude or Lovable. NEKOD MCP brings findings and fix prompts into those tools. It is read-only. The approval stays with the person your policy names.

A coding agent builds and reviews code for one developer. NEKOD holds your organisation's policies, keeps the approval with the person your policy names, and records the decision across every tool your teams use. It works next to coding agents and next to the security tools you already run.

No. A security scanner looks for vulnerabilities in code. NEKOD is the approval step for applications your business teams build outside engineering. It checks each one against your own policies, shows the evidence, and records the decision. It sits next to the security tools you already run and does not replace them.

A pilot starts with one team and about five applications. NEKOD connects to the repositories you choose, checks each application against your policies, and shows the portfolio to the CISO and the Centre of Excellence. You agree the success test up front, for example applications approved with evidence, without waiting on scarce engineers.

Pricing is shared on request. There are no public prices. Contact NEKOD to scope a pilot for your organisation.

NEKOD has an ISO 27001 and GDPR programme in progress and holds no certification. NEKOD is not a certification body. It checks applications against your own policies and records the evidence.

Yes. NEKOD reads repositories through a GitHub App, and your organisation chooses which repositories to share. Access is read-only, and you can revoke it from GitHub at any time.

No. NEKOD keeps the assessment outputs: findings, scores, scope and metadata. The repository is held only while a check runs.

No. A check does not change your code. Fix pull requests and hands-on help are separate, opt-in engagements.

Only the members of your organisation. NEKOD staff have read-only access to customer data, and privileged access needs approval.

Primarily in the EU, in the Netherlands. Some subprocessors may process data in the US with appropriate safeguards. See the Privacy Policy and the subprocessors list.

Today NEKOD runs in a shared cloud, with customer data hosted in the EU. A dedicated cloud instance per customer is on the roadmap. On premises is not offered.