Hinology Control
AI governance and GRC software with reviewable evidence
Hinology Control is an AI governance platform with GRC workflows for organising AI systems, risks, controls and compliance evidence. Teams document reviews and track approved follow-up actions in one workspace. Higher plans add supported software vulnerability assessment, cryptographic inventory and post-quantum readiness.
Why choose Hinology Control
Connected systems and responsibilities
Bring AI system, supplier, risk and control records together. Document their relationships and owners so your team can review responsibilities and priorities in one workspace.
Evidence with accountable review
Connect controls with evidence and recorded team tests. Assign a separate authorised reviewer and follow the review decision through to an approved internal action.
A clear path from governance to PQC readiness
Start with governance and evidence in Starter. Add software vulnerability assessment in Professional, then cryptographic inventory, CBOM and PQC readiness planning in Advanced.
How your team works with the platform
- Record systems and responsibilities.
- Connect risks and controls with evidence.
- Document team tests and request review by another authorised user.
- Follow up on evidence that needs updating and on approved actions.
Who it is for
For governance, risk and compliance teams organising records, evidence and reviews, and security teams that need to add software vulnerability assessment or understand cryptographic assets and PQC readiness priorities.
USD 49 per month.
Starter for AI governance and risk management
Organise records, evidence, reviews and team responsibilities. Included in both higher plans.
View details
AI system inventory
Record each AI system’s purpose, owner, supplier, data exposure and status. Add model, agent and dataset records in the governance workspace, and update them when responsibilities or use change.
Risk and supplier records
Assess risks using team-supplied information, maintain supplier records and assign action owners, priorities, due dates and completion status.
ISO/IEC 42001 readiness and reports
Record your team’s readiness assessments, evidence references and notes, then review work summaries and printable reports.
Compliance evidence management
Connect systems, risks and obligations with controls and evidence. File fingerprints help identify changes against the stored content.
Control review and approval
Document your team’s manual control tests, including procedures, evidence and results. Refer each test to another authorised reviewer for an approval decision.
Evidence freshness and change review
Review ageing tests and changed controls or files when opening the monitoring view or requesting an assessment. Identify what needs another review.
Remediation task tracking
Use Decision Center to document a proposal, obtain approval and create an internal follow-up task. Track progress, attach closure evidence and record the reviewer’s closure decision.
Inputs and outputs
You provide: System, risk, supplier and control information, evidence files and results of tests performed by your team.
You review or produce: Records and responsibilities, linked controls and evidence, reviews and internal tasks, work summaries and printable reports.
Prepare readiness records, linked evidence and printable reports for internal review and audit preparation.
Connected governance and management reporting
Risk and control mapping
Document supported relationships between AI system, model, agent, dataset, supplier, business service, risk and control records. Review the responsibilities and links entered by your team in one governance workspace.
AI governance reporting
View an internal AI Assurance Passport for each registered AI system. It brings together recorded relationships, linked controls and their review status for internal assessment within your organisation.
Executive risk dashboard
Use Executive Compass to review recorded assets, team-assessed risks, missing owners and unassessed areas. See priorities and the next suggested action based on saved information.
Governance data and evidence export
The organisation owner can download supported records and available evidence files in a ZIP archive with file integrity checks. Printable evidence reports and JSON downloads support internal review.
Guided three step onboarding
Choose an initial goal, name the responsible person and create a first internal review action. Add a known AI system or supplier when relevant to your goal.
USD 249 per month.
Professional for software vulnerability assessment
Everything in Starter, plus vulnerability information to help prioritise remediation.
View details
Software component assessment
Compare a supported component or dependency file with known vulnerability information when its source is configured.
Reviewable findings
Review the component, version and associated advisory, then check whether it applies to your application before deciding on remediation.
Priorities in risk context
Use component and advisory findings alongside business risks to prioritise follow-up review and remediation tasks.
Inputs and outputs
You provide: A supported component or dependency file and a configured vulnerability information source.
You review or produce: Component, version and advisory findings that help review remediation priorities.
Review known vulnerability advisories for the software components and dependencies you provide.
USD 349 per month.
Advanced for post quantum cryptography readiness
Everything in Professional, plus cryptographic inventory, dependency analysis and priorities for PQC preparation.
For organisations that need to understand cryptographic dependencies, especially in critical applications and long-lived sensitive data.
View details
Cryptographic asset inventory
Add assets manually or through supported CSV. Record algorithms, usage, owners, criticality, data sensitivity and confidentiality duration.
Public certificates
Extract key family, key size, fingerprint and expiry from supported public X.509 certificates.
Source file patterns
Locate cryptographic patterns and line numbers in supported source text so your team can review and confirm actual use.
Cryptography Bill of Materials CBOM
Import and export supported CycloneDX CBOM records, review asset context and identify entries that need further review.
Cryptographic dependency mapping
Review declared relationships between components, applications and services in the CBOM data your team provides.
Explained priorities
Rank assets using algorithm family, business criticality, data sensitivity and confidentiality duration, with visible reasons for review.
Planning outputs
Use inventories, findings and evidence reports to identify what needs validation and prepare inputs for authorised transition planning.
Inputs and outputs
You provide: Manual or supported CSV data, public X.509 certificates, supported source text and supported CBOM records.
You review or produce: Inventory, certificate details, source patterns, supported CBOM records, declared dependencies, explained priorities and evidence reports.
Advanced brings together cryptographic inventory, declared dependency analysis and prioritisation to support post-quantum readiness planning.
Team controls from Starter upwards
Organisation-scoped roles and permissions, available multi-factor authentication, change history and team-supplied regulatory references with human review.
Selected readiness frameworks
Use selected readiness prompts to connect preparation for ISO/IEC 42001 and the listed frameworks with controls, evidence and team reviews.
Framework details
| Reference | Area |
|---|---|
| ISO/IEC 27001:2022 | Information security management |
| SOC 2 | Trust Services categories |
| ISO/IEC 27701:2025 | Privacy information management |
| NIST CSF 2.0 | Cybersecurity risk functions |
| NIST AI RMF 1.0 | AI risk management |
| ISO/IEC 23894:2023 | AI risk management practices |
| ISO/IEC 42005:2025 | AI system impact assessment |
| NIST AI 600-1 | Generative AI risk profile |
Organise the regulatory references entered by your team and review their relevance to your organisation.
Compare Hinology Control plans
| Capability | Starter | Professional | Advanced |
|---|---|---|---|
| Monthly price in USD | 49 | 249 | 349 |
| AI systems risks suppliers and actions | Included | Included | Included |
| Controls evidence tests and separate review | Included | Included | Included |
| ISO/IEC 42001 and selected framework prompts | Included | Included | Included |
| Team roles change history and available MFA | Included | Included | Included |
| Supported software vulnerability assessment | Upgrade to Professional | Included | Included |
| Crypto inventory CBOM and PQC readiness | Upgrade to Advanced | Upgrade to Advanced | Included |
Each higher plan includes the previous plan. Software vulnerability assessment starts with Professional; PQC readiness is included in Advanced. Access follows the user’s role.
Questions about plans and evidence
How do Hinology Control plans work?
Choose one plan that fits your organisation. Each higher plan includes the capabilities of the previous plan, and you pay the listed price of your chosen subscription.
Which plan includes the capabilities my team needs?
Starter covers governance records, controls, evidence and reviews. Professional adds supported software vulnerability assessment. Advanced adds cryptographic inventory, CBOM and PQC readiness planning. Each higher plan includes the previous plan, with access according to the user’s role.
How does Hinology Control help my team organise evidence?
Connect controls with evidence, recorded team tests and review decisions, alongside owners and follow-up tasks. This gives your team organised information for internal reviews and for questions from customers and auditors.
How can my team keep evidence current?
Open the monitoring view or request an assessment to review ageing tests and changes to controls or evidence files. Use the results to identify what needs updating or another authorised review.
How does software vulnerability assessment help my team?
Compare supported component or dependency files with known vulnerability information from configured sources. Review the matched components, versions and advisories, then validate their relevance to your environment and prioritise follow-up actions.
Questions about PQC frameworks and subscriptions
What is a Cryptography Bill of Materials (CBOM)?
A CBOM records cryptographic components, their context and declared relationships. With Advanced, your team can import, export and review supported CycloneDX CBOM records as part of cryptographic inventory and readiness planning.
How does Advanced support post-quantum transition planning?
Advanced combines cryptographic inventory, supplied dependency data and explained priorities to support transition planning. Use the findings and evidence reports to decide what your technical team should validate first and prepare authorised changes.
How does Hinology Control support framework readiness?
Organise controls and evidence with ISO/IEC 42001 readiness assessment and selected topics from other frameworks. Record your team’s assessments, identify preparation gaps and coordinate reviews using the framework guidance available in the platform.
What outputs can my team prepare for readiness reviews?
Prepare work summaries, printable reports and documented control evidence, including recorded tests and review status. These outputs support readiness discussions, internal reviews and preparation for conversations with assessors and auditors.
How do I subscribe and arrange payment?
Choose your plan and follow the subscription and payment options shown on the website, or contact us through the Contact Us page if you need any assistance. Include your organisation’s name and preferred plan when contacting our team.
Start with Hinology Control
Choose your plan and follow the subscription and payment options shown on the website, or contact us through the Contact Us page if you need any assistance.
Contact Us to Subscribe