Skip to content
Koralis AI

Kovac · status as at 29 September 2026

What Kovac does for your role and sector

Kovac is software that checks requests to your data against your policy before they reach it: requests from people and from pipelines built on it. It checks three of the seven data paths today, and all seven by October 2026. It is in beta.

Choose your role, your sector, or one of each, below. Each card gives the question, what Kovac does for it today, what it does not do yet and when, and your first step.

By role

Championing a pilot

You want AI on work that has something in it nobody else should see.

For the COO or MD

Your question

We want AI on client work. Can we show the board what it could reach, and what stopped it?

Your first step

Book a free Scoping Review

Today

  • Kovac checks requests to data loaded into it against your policy before they reach the data, on three of seven data paths today, and refusals on those paths are kept in a searchable record.
  • A pilot is one workflow, four weeks from data access.
  • Kovac runs on your own machines; a hosted AI model, if you choose one, is outside them.

Not yet

  • October 2026All seven data paths checked against your policy.
  • October 2026Only Kovac itself can write to the record.
  • December 2026Every entry signed as it is written, permitted requests as well as refusals.
  • October 2026SharePoint and OneDrive released, with Microsoft Entra ID sign-in. In alpha testing today.
  • November 2026Google Drive and shared drives, Gmail, and Docs and Sheets content, with Google sign-in. Planned; not built today.
  • From late October 2026, in pilots, AI models connect through Kovac's check.

For finance leads

Your question

Which AI tools can reach our pricing and customer data? And what will finding out cost?

Your first step

Book a free Scoping Review

Today

  • Salary, margin or cost columns you mark are enforced when records are read in Kovac, and sensitive fields are swapped for placeholder tokens before Kovac passes them to an AI model or posts them to another system.
  • Reads of the raw files and previews are not checked until October 2026.
  • Kovac does not see tools that bypass it.
  • The Scoping Review is free; the dry run is £1,500 fixed, not credited; a pilot is priced in writing after the Scoping Review.

Not yet

  • October 2026Only Kovac itself can write to the record.
  • December 2026Every entry signed as it is written, permitted requests as well as refusals.
  • December 2026Microsoft Dynamics and HiBob.
  • November 2026Whether we build Xero and Sage is decided.
  • From late October 2026, in pilots, AI models connect through Kovac's check.

For bid teams

Your question

Can we use AI on our bid library without our rates and client names going with it?

Your first step

Book a free Scoping Review

Today

  • A pilot runs on your bid records, supplied as files.
  • Rates and client names you mark sensitive are swapped for placeholder tokens before Kovac passes them to an AI model or posts them to another system.
  • Once those records are loaded into Kovac, someone without clearance who reads a rate is refused, and the refusal is recorded.
  • Reads of the raw files and previews are not checked until October 2026.
  • Kovac does not draft proposals.

Not yet

  • October 2026SharePoint and OneDrive released, with Microsoft Entra ID sign-in. In alpha testing today.
  • November 2026Google Drive and shared drives, Gmail, and Docs and Sheets content, with Google sign-in. Planned; not built today.
  • October 2026All seven data paths checked against your policy.
  • From late October 2026, in pilots, AI models connect through Kovac's check.

For innovation leads

Your question

Will this pilot reach the people who would use it, or stall in IT and legal review?

Your first step

Book a free Scoping Review

Today

  • Koralis AI Limited can sign your contract today.
  • Paid pilots start from late October 2026, four weeks from data access, with a go/no-go on day five.
  • The one-page brief answers what your IT and legal lead will ask, with a month or "no date yet" for each gap.

Not yet

  • No date yetA pilot on personal data waits for a data processing agreement.
  • No date yetProfessional indemnity insurance: not held today.

For the Head of AI

Your question

Which rules in our AI-use policy actually stop anything?

Your first step

The page for the Head of AI

Today

  • The policy dry run takes each rule and says whether Kovac enforces it today, and on which data paths, only from a dated roadmap commitment, or not at all.
  • Refusals on the paths it checks are kept in a searchable record.

Not yet

  • October 2026All seven data paths checked against your policy.
  • October 2026Only Kovac itself can write to the record.
  • December 2026Every entry signed as it is written, permitted requests as well as refusals.

By role

Signing it off

Someone asked you to look at us. Each gap below has its month, or says there is none yet.

For IT

Your question

What does this put on my team, what does it connect to, and what does it do that our Microsoft stack doesn't?

Your first step

Forward the one-page IT & legal brief

Today

  • It governs requests to data loaded into it; it does not sit in front of Microsoft Copilot or web chat assistants.
  • A pilot runs locally, on your own machines, on files you supply.
  • PostgreSQL and MySQL connect, for schema discovery.

Not yet

  • October 2026SharePoint and OneDrive released, with Microsoft Entra ID sign-in. In alpha testing today.
  • November 2026Google Drive and shared drives, Gmail, and Docs and Sheets content, with Google sign-in. Planned; not built today.
  • October 2026Every path blocks a request when the policy check cannot run.
  • No date yetSign-in is by OpenID Connect (OIDC) only today. No SAML single sign-on or SCIM provisioning.

For data protection officers

Your question

Who is the processor, where does the data sit, and is there an agreement I can review?

Your first step

Forward the one-page IT & legal brief

Today

  • Your contract is with Koralis AI Limited, and it can be signed today.
  • Any personal data would be processed by Koralis AI Limited under a data processing agreement; that agreement is not in place yet.
  • In a pilot your data is used only for the pilot.
  • Kovac runs on your own machines; a hosted AI model, if you choose one, is outside them.

Not yet

  • Data processing agreement: being put in place, no date yet. Koralis AI Limited can sign a contract today; a pilot on personal data waits for it.
  • October 2026First pilot deployment, in beta.
  • December 2026UK and EU hosting, and customer-hosted and air-gapped options.
  • From late October 2026, in pilots, AI models connect through Kovac's check.
  • In a pilot, from late October 2026, Kovac is model-agnostic: you choose the AI model, a hosted one or your own on your own network. Fields you mark sensitive reach it as placeholder tokens; fields you don't mark reach it as they are.

For legal teams

Your question

Can we let people use AI on client material, and defend that to the client and to our regulator?

Your first step

Forward the one-page IT & legal brief

Today

  • Your contract is with Koralis AI Limited, and it can be signed today.
  • Kovac runs on your own machines; a hosted AI model, if you choose one, is outside them.
  • For clients whose contracts forbid third-party AI, the offer page has a consent letter to adapt with your own legal team.

Not yet

  • No date yetProfessional indemnity insurance: not held today.
  • No date yetCyber Essentials: not held yet – in preparation.
  • From late October 2026, in pilots, AI models connect through Kovac's check.
  • In a pilot, from late October 2026, Kovac is model-agnostic: you choose the AI model, a hosted one or your own on your own network. Fields you mark sensitive reach it as placeholder tokens; fields you don't mark reach it as they are.

By sector

What your sector answers to, and what Kovac does and does not do near it.

We name regulators and rules as context only, and do not describe what they require. Kovac does not make any organisation compliant with them, and Koralis AI holds no certification today. When an obligation applies to you is a question for your own counsel, not for a vendor's website.

For built-environment and engineering consultancies

What the sector needs

Bid rates, client project records and design data kept to the people cleared to see them, and a straight answer when a client or a tender asks how you use AI.

Named as context: RICS (the Royal Institution of Chartered Surveyors), for regulated surveying firms, and PPN 017 (a Cabinet Office procurement policy note), for central-government bids.

Your first step

Book a free Scoping Review

Today

  • Kovac checks requests to bid and project records loaded into it against your policy, and keeps the refusals in a searchable record.
  • It does not keep your AI register, and it does not draft bids.

Not yet

  • October 2026SharePoint and OneDrive released, with Microsoft Entra ID sign-in. In alpha testing today.
  • November 2026Google Drive and shared drives, Gmail, and Docs and Sheets content, with Google sign-in. Planned; not built today.
  • October 2026Only Kovac itself can write to the record.
  • December 2026Every entry signed as it is written, permitted requests as well as refusals.

For building, facilities management (FM) and support-services contractors

What the sector needs

Tender rates kept to the bid team, some clients’ documents kept away from AI altogether, and building records kept current.

Named as context: PPN 017 (a Cabinet Office procurement policy note), the Building Safety Act’s golden thread, and Cyber Essentials Plus.

Your first step

Book a free Scoping Review

Today

  • A pilot runs on your bid records, supplied as files.
  • Once those records are loaded into Kovac, a refusal is recorded when someone without clearance reads what your policy withholds.
  • Reads of the raw files and previews are not checked until October 2026.
  • Kovac does not draft tenders.

Not yet

  • No date yetCyber Essentials: not held yet – in preparation.
  • No date yetCyber Essentials Plus: not held.

For commercial real-estate services and fit-out

What the sector needs

Client reports, valuations and proposal pricing kept to the people cleared to see them. Fit-out work is won through proposals and pre-qualification questionnaires (PQQs).

Named as context: RICS (the Royal Institution of Chartered Surveyors), for regulated firms.

Your first step

Book a free Scoping Review

Today

  • We work with a commercial real-estate fit-out firm as a design partner, whose name we have not been cleared to use.
  • A pilot on client reports or proposals runs on your own machines, on files you supply.

Not yet

  • October 2026SharePoint and OneDrive released, with Microsoft Entra ID sign-in. In alpha testing today.
  • November 2026Google Drive and shared drives, Gmail, and Docs and Sheets content, with Google sign-in. Planned; not built today.
  • No date yetOur design partner cannot be named yet; when they can is their decision, not a build.

For law and IP firms

What the sector needs

Client confidentiality and privilege, and client material, including unpublished inventions, kept within the firm’s control.

Named as context: the SRA (Solicitors Regulation Authority) and, for patent and trade mark attorneys, IPReg (their regulator).

Your first step

Forward the one-page IT & legal brief

Today

  • A pilot runs on files you supply.
  • Kovac runs on your own machines; a hosted AI model, if you choose one, is outside them.
  • The founders work on it alongside you, so Koralis AI Limited would act as your processor under a data processing agreement.
  • That agreement is not in place yet.
  • Your data is used only for the pilot.
  • Reads of the raw files and previews are not checked until October 2026.

Not yet

  • No date yetA pilot on personal data waits for a data processing agreement.
  • October 2026All seven data paths checked against your policy.
  • From late October 2026, in pilots, AI models connect through Kovac's check.
  • In a pilot, from late October 2026, Kovac is model-agnostic: you choose the AI model, a hosted one or your own on your own network. Fields you mark sensitive reach it as placeholder tokens; fields you don't mark reach it as they are.
  • No date yetProfessional indemnity insurance: not held today.

For management and professional-services consultancies

What the sector needs

Client material kept to what each client’s contract allows, and an answer when a client’s security questionnaire asks how you use AI.

No sector regulator; named as context: PPN 017 (a Cabinet Office procurement policy note), for central-government bids.

Your first step

Ask about a policy dry run

Today

  • The policy dry run reads the AI and confidentiality clauses from up to five client contracts, as redacted extracts, and says for each rule whether Kovac can enforce it today, only from a dated roadmap commitment, or not at all.

Not yet

  • October 2026SharePoint and OneDrive released, with Microsoft Entra ID sign-in. In alpha testing today.
  • November 2026Google Drive and shared drives, Gmail, and Docs and Sheets content, with Google sign-in. Planned; not built today.
  • October 2026All seven data paths checked against your policy.

For recruitment and staffing agencies

What the sector needs

Candidate data is personal data throughout: CVs, contact details, salary expectations.

Named as context: UK GDPR and the ICO (the Information Commissioner’s Office).

Your first step

Book a free Scoping Review

Today

  • Kovac does not screen candidates or record screening decisions.
  • It checks requests to candidate data loaded into it on three of seven data paths today, and the fields you mark sensitive are swapped for placeholder tokens before Kovac passes them to an AI model or posts them to another system.

Not yet

  • No date yetA pilot on personal data waits for a data processing agreement.
  • October 2026Only Kovac itself can write to the record.
  • December 2026Every entry signed as it is written, permitted requests as well as refusals.

For housing associations

What the sector needs

Tenant data is personal data, and repairs and complaints records need to be accurate and complete.

Named as context: the Regulator of Social Housing, Awaab’s Law and the Housing Ombudsman.

Your first step

Book a free Scoping Review

Today

  • A pilot runs on an export of repairs or complaints records, supplied as files.
  • Once those records are loaded into Kovac, it checks requests to them against your policy, and records the refusals.
  • Reads of the raw files and previews are not checked until October 2026.
  • Housing management systems do not connect to it.

Not yet

  • No date yetA pilot on personal data waits for a data processing agreement.
  • October 2026All seven data paths checked against your policy.

For pension administrators

What the sector needs

Member data is personal data, and trustees oversee what their administrators do with it.

Named as context: the Pensions Regulator and its General Code.

Your first step

Book a free Scoping Review

Today

  • Kovac checks requests to member data loaded into it and records the refusals, and the fields you mark sensitive are swapped for placeholder tokens before Kovac passes them to an AI model or posts them to another system.
  • Administration platforms do not connect to it: a pilot runs on files.

Not yet

  • June 2027SOC 2 Type II report expected; not held today, audit period begins December 2026.
  • No date yetA pilot on personal data waits for a data processing agreement.

For market research agencies

What the sector needs

Participant data is personal data, and clients want to know how AI was used on their project.

Named as context: the MRS (Market Research Society) and its Code of Conduct.

Your first step

Book a free Scoping Review

Today

  • Kovac records refusals on the paths it checks, in a searchable record.
  • It does not yet record what was permitted.

Not yet

  • October 2026Only Kovac itself can write to the record.
  • December 2026Every entry signed as it is written, permitted requests as well as refusals.
  • From late October 2026, in pilots, AI models connect through Kovac's check.

For testing, inspection and certification

What the sector needs

A report’s integrity is what a client pays for, and the inspection and test records behind it carry that integrity.

Named as context: UKAS (the United Kingdom Accreditation Service), ISO/IEC 17020 and ISO/IEC 17025.

Your first step

Book a free Scoping Review

Today

  • Kovac does not draft inspection or test reports.
  • It checks requests to the records loaded into it against your policy, and keeps the refusals in a searchable record.

Not yet

  • October 2026Only Kovac itself can write to the record.
  • December 2026Every entry signed as it is written, permitted requests as well as refusals.
  • No date yetISO 27001: not held.

By role

Championing a pilot

You want AI on work that has something in it nobody else should see.

By role

Signing it off

Someone asked you to look at us. Each gap below has its month, or says there is none yet.

By sector

What your sector answers to, and what Kovac does and does not do near it.

We name regulators and rules as context only, and do not describe what they require. Kovac does not make any organisation compliant with them, and Koralis AI holds no certification today. When an obligation applies to you is a question for your own counsel, not for a vendor's website.

Bring the question your role asks. We'll say what Kovac does about it today.

The free Scoping Review, with both founders: what Kovac can do for your workflow today, what waits for a date, and a written pack within 48 hours. No data, nothing installed.

Book a free Scoping ReviewOr forward the one-page IT & legal brief →