Certify AI agents against any compliance framework
Built-in support for GDPR, SOC 2, EU AI Act, HIPAA, ISO 42001, and custom policies. Per-requirement evidence tracking. Auto-expiry by risk tier. Drift detection every 15 minutes.
Built for auditors who've seen the gap before.
Per-requirement evidence tracking
Map each agent to specific requirements within each framework. Upload evidence per requirement. Track completion percentage in real time. Requirements never fall through the cracks because there's nowhere for them to hide.
Auto-expiry by risk tier
Critical agents (Tier 4) re-certify every 90 days. High-risk every 180. Standard agents annually. The system enforces this, you don't have to remember. Agents approaching expiry appear in the dashboard before they become a compliance gap.
Drift detection every 15 minutes
When an agent's configuration changes, its owner departs, or a certification expires, you know within minutes, not at the next quarterly review. Every drift event is logged with a timestamp, actor, and the specific attribute that changed.
Audit-ready export
Export the full compliance posture for any agent, framework, or time range. Filtered by resource, actor, action, or date. Ready for any auditor, no additional formatting required.
Retirement compliance: because decommissioning is a governance event
When an agent is retired, its compliance record doesn't disappear. Every certification, every drift event, every audit trail entry is preserved and remains queryable, exportable as CSV or JSON at any point. For regulated industries where liability extends years beyond decommissioning, this is the difference between a clean audit and a finding.
Record preservation
Full lifecycle history archived at retirement: registrations, classifications, certifications, drift resolutions, configuration changes, and ownership transfers. Queryable and exportable indefinitely.
Succession linking
When a replacement agent takes over, link the predecessor's compliance history to the successor. Auditors see continuity, not a gap.
Regulatory coverage
EU AI Act Article 72, SOC 2 CC6.5, HIPAA system decommissioning, and ISO 42001 Clause 8.4, all satisfied by the retirement workflow.
Compliance gaps hide between audits.
Annual reviews miss drift that happens on a Tuesday afternoon. Without continuous certification, you can't prove which agents were reviewed, when, or against what criteria.
- Compliance evidence gathered manually before each audit
- No way to prove which agents were certified and when
- Certification status tracked in a document nobody updates
- Drift between audits goes undetected for months
- High-risk agents reach production without review
- Certify against any framework with per-requirement evidence
- Immutable audit trail of every certification event
- Auto-expiry: 90 days for critical, 180 for high, 365 for low
- Drift detection runs every 15 minutes
- Lifecycle gates block uncertified agents from production
Built-in frameworks. Custom ones too.
Every framework ships with pre-mapped requirements. Bring your own internal policy and Roval will track it the same way.
Risk classification, conformity assessment, human oversight, and transparency requirements for high-risk AI systems.
Trust service criteria mapped to agent governance: security, availability, processing integrity, confidentiality, and privacy.
AI management system standard: governance, risk, data management, and continuous improvement for organizations using AI.
PHI access controls, audit trail requirements, and breach notification rules for healthcare AI agents.
Data processing, consent management, right to explanation, and data protection impact assessments for AI systems.
Risk management framework for AI: govern, map, measure, and manage AI risks across the system lifecycle.
Pre-built policies. Ready to activate.
Start from a template, customize the rules, and activate. Every policy enforces blocked paths, sensitive commands, and read-only protections on your agents.
Blocks access to credentials, secrets, and system directories. Prevents destructive shell commands. Enforces read-only on configuration files.
Flags prompts containing emails, phone numbers, SSNs, and credit card numbers. Blocks PII from reaching external model APIs.
Detects and blocks patterns that suggest data exfiltration: large payloads to external URLs, base64-encoded bulk exports, and credential harvesting.
Limits token spend per agent, enforces model allow-lists, and alerts on spend spikes above configurable thresholds per team.
Detects common prompt injection patterns: role-override attempts, system prompt leaks, and instruction-ignoring sequences. Alerts on suspicious prompts.
Blocks PHI patterns in prompts and responses. Enforces audit logging for all agent interactions with patient data systems.
The rest of the platform.
Agent Registry
Register every agent with framework, model, owner, risk tier, and dependency graph. Search by natural language.
Observer & LLM Monitor
Capture every tool call and LLM request. Flag PII and policy violations in under 30 seconds.
Dashboard
KPI cards, compliance posture, drift alerts, and a live event feed, on one screen, no clicking around.
Ready for your next audit?
Join the private beta. Compliance coverage from day one.