Certification and compliance
ISO 27001 and GDPR programme in progress. EU hosted.
Backed and supported by
Rijksoverheid
Four steps toa recorded approval
Discover
See the apps your teams build with AI from the repos they already use, with owners and status in one place.
Control
Checks against the rules you define, with evidence of findings ready for review, and a fix prompt to paste into Cursor, Claude or Lovable.
Approve
A clear decision for each application that needs sign-off, with a record for risk, audit or the board, while teams keep building.
Monitor
Edit your rules and check again. The latest evidence stays with each app, so status stays clear after the first review.
Your teams already build with AI, but you cannot see or approve them
One product for the people who build and the people who approve
Know what to fix, fix it in your own AI tool, and get a clear approval
- Findings in plain English, ranked by severity
- A fix to paste into Cursor, Claude or Lovable
- No change to the tools your team already uses
NEKOD - Findings
Findings
What to fix first, with the evidence behind it.
The number in this view is an example. It shows the findings that block approval, and what to fix first.
72Score
By pillar
5 pillarsFindings
28 controls2 Critical3 High5 Medium18 Passed
Not every application needs the same checks
Fix where your teams already build
Explanation
Secrets in the repository keep this app at medium risk. Paste the ranked fix in Cursor to bring the score into the green.
Trust, by design
Data handling and AI safety
Data stays read-only by default. Customer data is hosted in the EU.
Granular access control
Scoped, read-only access by default. Single sign-on is on the roadmap.
Audit and oversight
Evidence for each check, with a recorded approval you can show to risk, audit or the board.
“I got hacked. That's a good thing. They found nothing on DoneThat.”
Christoph Hartmann
Founder, DoneThat
From unreviewed applications to a recorded approval
No list of the applications your business teams have built
Each application reviewed by hand, when someone remembers to ask
Every application treated the same, so real risks wait behind harmless ones
Approval takes months, so applications go live without it
Evidence assembled from scratch each time audit asks
Before
Without NEKOD
Applications reach production one at a time, and nobody holds the whole picture.
Every application your teams register, in one place
Each application checked against your policy
Findings in plain language, with a fix prompt for the person who built it
A recorded decision for every application
A named approver per risk level
A record you can hand to risk, audit or the board
After
With NEKOD
One view of every application, checked against your own rules, with a recorded approval.
See where your organisation stands
- A short maturity assessment of how your organisation manages AI-built software
- Clear next steps on governance, training and data security
NEKOD - Maturity Score
Org maturity score
Recognized
You see the apps. Rules and ownership are catching up.
18
/ 36 pts
Levels
12 Q · 0–3 pts each
- 1Experimental0–11
- 2Recognized12–23You are here
- 3Innovating24–36
How to reach Innovating
- Governance. Name an owner for every AI-built app.
- Training. Onboard builders on secure patterns.
- Data security. Classify data each app touches.
This is what businesstransformation looks like
RijksoverheidFrequently Asked Questions
NEKOD lets your business teams build with AI while the CISO stays in control. It brings the applications they build into one portfolio, checks each one against your own policies, and records the approval.
Companies of about 100 people and above where employees outside engineering build applications with AI tools. The buyer is usually the CISO, CIO, CTO or Head of IT. A head of AI, automation or innovation often champions it. The builders are domain experts in finance, operations, HR and similar teams.
NEKOD reads the application's repository, summarises what it does, and the owner confirms the scope. It then checks the application against your own policies in proportion to its risk, scores it, and lists the findings with a fix for each. Every application sits in one portfolio and each approval is recorded. Finding unregistered applications, approval by risk level and re-checks on every change are in a pilot with customers.
Security, reliability, maintainability, commercial readiness and your own policies, combined into a score from 0 to 100. Checks include exposed secrets, known vulnerabilities, sign-in protection, database access rules and consent handling. Each finding has a plain-English explanation, a severity and a suggested fix.
They confirm what their application does, read the findings in plain language, and paste a fix prompt into the AI tool they already use, such as Cursor, Claude or Lovable. NEKOD MCP brings findings and fix prompts into those tools. It is read-only.
A coding agent builds and reviews code for one developer. NEKOD holds your policies, decides who must approve which application, and keeps the record across every tool your teams use. It works next to coding agents.
No. A security scanner looks for vulnerabilities in code. NEKOD is the approval step for applications built outside engineering. It checks each one against your own policies, shows the evidence, and records the decision. It sits next to your existing security tools and does not replace them.
A pilot starts with one team and about five applications. NEKOD connects to the repositories, checks each application against your policies, and shows the portfolio. The success test is agreed with you up front, for example applications fixed and approved without waiting on scarce engineers.
Pricing is shared on request, starting with a pilot. There are no public prices. Contact NEKOD to scope a pilot for your team.
NEKOD has an ISO 27001 and GDPR programme in progress. NEKOD is not a certification body. It checks applications against your own policies and records the evidence.
Yes. NEKOD reads repositories through a GitHub App, and you choose which repositories to share. Access is read-only and you can revoke it from GitHub at any time.
No. NEKOD keeps assessment outputs: findings, scores, scope and metadata. The full repository is held temporarily while a check runs.
Not when it checks an application. Fix pull requests and hands-on help are separate, opt-in engagements.
Only the members of your organisation. NEKOD staff have read-only access to customer data, and privileged access needs approval.
Primarily in the EU, in the Netherlands. Some subprocessors may process in the US with appropriate safeguards. See the Privacy Policy and the subprocessors list.
Today NEKOD runs in a shared cloud. A dedicated cloud instance per customer is on the roadmap. On premises is not offered.