CPSID
Sign in

CPSID · Purple Team

Cybersecurity, Protection, Sovereignty and Data Intelligence

Cybersecurity and data protection, all in one.

CPSID brings defense, offensive validation, privacy, sovereignty and data intelligence together in one platform. A Purple Team approach connects the CISO and DPO through shared controls, owners and evidence.

Sign in to the platform
CPSID · Cybersecurity, Protection, Sovereignty and Data Intelligence

What you gain with CPSID.

Fast response when something happens, round-the-clock monitoring and evidence ready for the authority and the auditor.

Critical incident response

Counted from the moment CPSID is notified.

  1. 15min

    First response

    CPSID’s response team takes the case and starts acting.

  2. 1h

    Containment

    The incident is contained so it stops spreading.

  3. 4h

    Report

    What happened, what it reached and the evidence, ready for leadership and the authority.

24/7

Continuous monitoring

The platform watches network, endpoint, WAF and cloud without pause and alerts your team.

72h

Legal deadlines under control

The usual legal deadline to notify a data breach. CPSID times every deadline and prepares the report with its evidence.

1

One piece of evidence, every law

What you prove once counts for every law and standard that requires it: less repeated work in each audit.

Digital forensics

CPSID’s forensic team acquires and analyzes the incident evidence, with chain of custody.

Pre-audit

Know where you stand and what to close first: your gaps ranked by risk against the laws that apply to you.

Contractual availability

Platform availability is committed in the service contract.

Times for critical incidents, as set in the service contract. 24/7 monitoring is done by the platform; CPSID’s response team acts from the moment it is notified.

What the law already requires, in any country.

Data protection, cybersecurity and artificial intelligence are already regulated across much of the world. Knowing how mature you are, and being able to prove it, is no longer good practice. It is an obligation with deadlines and fines.

Data protection laws

GDPR, the UK Data Protection Act, CCPA, Canada’s PIPEDA, India’s DPDP Act, Australia’s Privacy Act, Singapore’s PDPA and many more.

What it requires
They change from country to country but usually ask for the same things: a lawful basis for every processing activity, data subject rights, impact assessments, security measures and, increasingly, breach notification to the authority within hours or days. In several countries, fines can reach a percentage of turnover.
What CPSID does
Brings data subject requests, impact assessments, breach management and the DPO’s work into one place, with evidence linked to every law that applies to you.

Advanced cybersecurity

NIS2 and DORA in Europe, NYDFS Part 500 and the SEC rule in the United States, Cyber Essentials in the UK, Australia’s Essential Eight, NIST CSF 2.0 and ISO/IEC 27001.

What it requires
Managing risk under the accountability of senior management, detecting and responding to incidents, and reporting them to the authorities within ever shorter deadlines, sometimes just a few hours.
What CPSID does
Brings security operations, threat intelligence, vulnerability management and incident response together on the same controls, and prepares the report to the authorities with its evidence.

AI security

The EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework.

What it requires
Knowing which AI systems the organization uses, assessing their risks, protecting the data they are trained and run on, and keeping human oversight of their decisions.
What CPSID does
Applies controls specific to artificial intelligence, keeps the inventory of approved models and detects AI use that nobody authorized.

One control, every law.

Every control on the platform is mapped to the laws and standards that require it. What you prove once counts for every law in every country where you operate, from the European Union and the United States to Latin America, Brazil, China and Saudi Arabia.

One platform. Security and data working together.

Detection, response and security validation alongside data protection, sovereignty, governance and intelligence. CISO, DPO, technical teams and auditors work with shared controls and evidence.

Personal data protection

Everything data protection laws require, in one place and tied to the evidence for each control.

  • Record of processing activities with data lineage
  • Data subject requests with deadlines and a public portal with identity verification
  • Impact assessments linked to each processing activity
  • Map of international data transfers

Document generation

Policies, procedures and assessments generated from your organization’s verified data. Anything that cannot be verified is marked as pending: nothing is made up.

  • Documents for every documentation gap in an audit
  • Versions with a digital fingerprint and quality checks
  • Approval with quorum and signing with a one-time code
  • Export to Word, PDF and Excel

Embedded AI

An assistant that answers questions about your program with sources, a confidence level and the data that is missing, and that can run on local models. AI proposes; people approve and sign.

  • Verifiable answers drawn from your own data
  • Documents adapted to your organization’s sector
  • Model security testing against the OWASP Top 10 for LLMs

Data protection in AI (DLP)

Detects which AI tools and SaaS apps your team uses without approval, and protects sensitive data in the platform’s AI.

  • Unapproved AI and SaaS use (shadow AI and shadow IT)
  • Block, anonymize and mask rules
  • AI model inventory with approval

Asset and identity discovery

Finds every device, cloud resource and service you have, and checks it against your inventory.

  • Installable probe for Windows, Linux, macOS and Kubernetes
  • Inventory of AWS, Azure, Google Cloud, Oracle Cloud and other clouds
  • Asset inventory (CMDB) checked against what the network sees
  • Over-privileged, orphaned or inactive accounts, revocable from the same screen

Third-party risk management (TPRM)

Classifies your suppliers, scores their risk and collects their evidence through a dedicated portal, with review and periodic reassessment.

  • Supplier portal with a one-time link to submit evidence
  • Risk score and concentration by supplier and service
  • Evidence review before approval
  • Scheduled reassessments that open risks, legal cases and continuity plans

Risk, controls and maturity

Your own versioned risk methodology, controls with their gaps and the maturity of each area against its target.

  • 5×5 risk map, inherent and residual
  • Configurable, versioned scales and matrix
  • Expiring evidence, with chain of custody
  • Maturity by area, gap to target and trend

Detection and SOC

Where alerts pile up, what each sensor covers and which threats more than one source confirmed.

  • Alert funnel and detection coverage
  • Alerts confirmed by several network, endpoint and WAF sensors
  • Detection rules with tests and drift tracking
  • Threat hunting and decoys verified against real events

Incident response

From the case to containment and the report to the authority, with every action approved and logged.

  • CSIRT cases with affected assets and timeline
  • Signed containment from the probe and SOAR playbooks
  • Scope of each breach across data and processing activities
  • Authority notification deadlines under control

Vulnerabilities and security engineering

What to fix first based on real-world exploitation, and the threats to each system before it reaches production.

  • Prioritization by CVSS, EPSS and the KEV catalog
  • Installed software matched against the NVD
  • Software supply chain graph (SBOM)
  • STRIDE threat modeling and attack graph

Business continuity

The recovery you have actually achieved, compared with the one you promised.

  • Proven recovery against RTO and RPO targets
  • Business impact analysis (BIA)
  • Activation steps, versions and exercises
  • Backup matrix and dependency graph

Governance, reporting and training

Committees with their minutes and agreements, reports built on live data and training for each person’s role.

  • Committees, minutes and agreements with e-signature
  • Live-data reports with integrity checks, in PDF
  • Role-based academy with assessments and verifiable certificates

A view for every role.

Everyone sees what they need to decide, on the same data: what the auditor reviews is exactly what the team operated.

  • Leadership

    Residual risk against risk appetite, the decisions waiting for the committee and the executive report for the board.

    • Risks above appetite and tolerance
    • Committee decisions with recommended treatment and the cost of not acting
    • Executive summary report for the board
    • Committees, minutes and agreements with owner and due date

  • Department heads

    Who answers for each control, process, finding and risk, which corrective tasks are under way and which are overdue.

    • Responsibility matrices (RASCI) by control, evidence, finding and risk
    • Corrective tasks with priority, due date and overdue alerts
    • Critical processes with owner and next review
    • Findings that still have no action plan

  • DPO

    The record of processing activities with its legal basis, retention and data lineage, impact assessments, data subject requests with their deadlines, and breaches still to be notified.

    • Record of processing activities
    • Data protection impact assessments (DPIA)
    • Public rights portal with identity verification
    • Personal data breach management

  • CISO

    Security posture, residual risk, critical incidents, legal exposure, high-risk third parties and attack surface on a single dashboard, with detection and response built in.

    • SOC with correlation across network, endpoint and WAF sensors
    • CSIRT and approved, audited response actions
    • Discovery probes for Windows, Linux, macOS and Kubernetes

  • CTO

    Vulnerabilities, cloud configuration, overdue patches and supplier dependency turned into one decision: what to fix first, based on the cost of doing nothing.

    • Prioritized remediation on critical services
    • Current versus target maturity, by capability
    • Supply chain concentration by supplier
    • Audit roadmap with milestones and deliverables

  • Internal audit

    The audit plan from start to finish: each control reviewed with its evidence, peer review and a quality gate before the report is closed.

    • Plan with Gantt chart, critical path and baseline versus actual
    • Review of controls and evidence, with documents for every gap
    • Peer review and quality gate before closing
    • Report with an executive summary in PDF

  • External auditor

    A portal separate from the platform, where the auditor sees only the evidence shared with them, for the agreed period, with every access logged.

    • Invitation-only access with password and one-time code
    • Evidence packages with an expiry date and download limits
    • Documents watermarked with the viewer’s identity
    • Chained, verifiable access log

From uncertainty to evidence, in four steps.

  1. 1

    Pre-audit

    We measure your data protection, cybersecurity and AI maturity, control by control, against the laws that actually apply to you.

  2. 2

    Prioritized gaps

    What is missing, how much risk each gap carries and in which order to close them.

  3. 3

    Operating with evidence

    Controls, tests, documents and evidence kept current on the platform, each with an owner and a date.

  4. 4

    Reporting to the authorities

    Data breaches and incidents reported on time to the competent authority, backed by the evidence for each response.

Start by knowing where you stand.

In the pre-audit we measure your data protection, cybersecurity and AI maturity and hand you the gaps ranked by risk.

Email
[email protected]
Office
Valparaíso, Chile