de.iterate is an Australian GRC platform with privacy compliance and data governance built in. You can't protect data you haven't found. de.iterate maps your personal information and data flows, helps you assess privacy risk and keeps your privacy obligations up to date. Your privacy policy even updates itself.
Instead of managing policies in one place, risks in another, evidence in folders, and audits through a last-minute scramble, de.iterate connects the whole system. That means better visibility, clearer ownership, stronger assurance and less time lost to manual admin. The current platform spans policies, assurance tasks, registers, evidence, reporting, Trust Centre capabilities, auditor access and support for multiple frameworks.
We help you get your ducks in a row.
The statutory tort for serious invasions of privacy has been in force since June 2025. From 10 December 2026, privacy policies must explain when computers make, or substantially contribute to, decisions that significantly affect people. Meanwhile, your privacy policy was last reviewed by a lawyer in 2021, and your data map is a photo of a whiteboard on someone’s phone.
Larger organisations have a privacy office, a data map in a platform and a policy reviewed every year. The data map was built for the 2018 GDPR project and describes the systems the organisation had then. Since then, the business has added a hundred SaaS tools, three of which make decisions about customers, and the privacy team learned about two of them from this page. The December deadline asks a specific question: which of your systems make or substantially contribute to decisions that significantly affect people? The privacy team can answer for the systems it knows about. Credit, fraud, recruitment screening and the vendor features switched on last quarter sit with four other teams, none of whom have been asked.
AI governance works when you know which AI systems you have, including the ones your vendors switched on, someone is accountable for each, and the controls around them grow out of the security and privacy work you’ve already done rather than starting a third program from scratch. de.iterate is built that way. AI systems sit in de.iterate's register that links to your suppliers and risks, impact assessments and approvals are recorded against each one, and the AI management system shares its controls and testing with ISO 27001 and privacy, so “who is responsible for AI?” has an answer with a name on it.
Build your AI management system with ISO foundations and map it to international standards and obligations. AI control design and testing are shared with your existing ISO 27001 and privacy programs, so your AI risk management naturally develops out of the foundations you already have.
Record your AI systems in de.iterate's configurable register, with the fields your AI management system needs. AI tools that touch your data cross-link with your de.iterate supplier registers, where you can note where the data goes and link each tool to your AI risks and controls.
Every automated suggestion in de.iterate arrives as a draft, with its reasoning and confidence stored alongside it. A human approves it before anything changes, which is the same kind of oversight management asks of you.
Each entry in the AI register carries an accountable owner, a business purpose and a review date, with roles mapped to the responsibilities ISO 42001 expects. When an auditor asks who is responsible for AI, the answer is a list of named people rather than a committee.
Start from an AI acceptable use policy written by de.iterate's GRC experts. Distribute it through de.iterate's policy module, track who has read it, and reset attestation when the rules change, so the developer pasting code into a chatbot has seen the policy that says not to.
Assess the impact of each AI system on people and on your organisation, and keep a record of the risks, decisions, controls and approvals that follow, as well as the evidence that each step took place.
A risk register with a pulse, with inherent and residual scoring, heatmaps and risk appetite.
Every obligation traced to the evidence that meets it, across 25+ frameworks.
Plain-English policies, clear approvals and proof your staff have read them.
Scheduled controls testing, with the evidence ready before your auditor asks.
ISO 42001, AI impact assessments and an inventory of the AI in your business.
ISO 9001, ISO 14001 and ISO 45001, running alongside everything else you manage.
