The new way to run cybersecurity

Your security team just gained a teammate.

QoBot takes the routine: the questionnaire backlog, policy drafts, evidence collection, follow-ups across subsidiaries and suppliers, board and audit prep. Your team gets its time back for strategy, risk decisions and architecture, and still approves everything that ships.

Routine to QoBot; strategy and risk decisions to your team
Nothing ships without a named approver, every decision logged
Every statement sourced to your evidence

Free desktop app · Runs on your own AI: Claude subscription or API key

Built by the team behind Qontrol
Your data under your control
macOS, Windows, Linux

QoBotWaitlist

1 of 6

Hi, I'm QoBot. You're joining the waitlist, and a few quick questions help me get ready for you.

You're a company, right? With about 1000+ people?

This chat needs JavaScript. Turn it on and reload the page, or write to hello@qobot.io with "waitlist" in the subject and we'll add you.

Prefer a call?Talk to the founders · 30 min

QoBot at work

QoBot drafts and follows up
while your CISO makes the calls.

QoBot proposes an update to the password policy, line by line. Your CISO approves it, and the history keeps every change with Undo.

QoBot

Northwind LogisticsOn this computer

Conversations

QoBot credits$3.42 left

Password policy after MFA

Waiting for you

MFA is on for everyone now. Does the password policy need to change?

Reading the security program· Access and passwords
Updating a policy

Yes, two lines. The 90-day password change can go: with MFA on, it only pushes people to weaker passwords. And MFA moves from recommended to required.

Needs your approvalReplaces a deliverable · undoable from History

Update “Access and passwords” (v1.2 → v1.3)

MFA is on for every account, so the 90-day rotation can go.

policies/access-and-passwords.md

## Passwords
 
Passwords are at least 12 characters long.
Passwords are changed every 90 days.
Passwords are changed only when there is a sign they may be known to someone else.
 
## Multi-factor authentication
 
MFA is recommended for remote access.
MFA is required for every mailbox and for remote access.

Queues while QoBot works

History

mark “Turn on MFA for the 45 personal mailboxes” as doneYou · Oct 15, 09:12

write “Answer to the insurer: multi-factor authentication”QoBot · Oct 14, 16:40

assign “Test a restore of the NAS backup” to HugoQoBot · Oct 14, 16:38

add the risk “Former staff accounts still active”QoBot · Oct 9, 11:05

draft the policy “Access and passwords”QoBot · Oct 7, 10:22

update the company profile (company)QoBot · Oct 6, 14:03

How security teams work now

Routine to QoBot, strategy to your team.

Security teams used to cover the routine with more people, consultants or a GRC platform. Now QoBot takes the routine and your team keeps the strategy.

Option 1
More people
Analysts spend their weeks on questionnaires, evidence collection and reminders.
Salaries and recruiting
Option 2
Consultants
Extra hands for audits and backlogs, a few days at a time.
Billed by the day
Option 3
A GRC platform
Tracks controls, evidence and tasks, while your team still writes, chases and reports.
An annual licence, plus your team's time
Now
An AI CISO on the team
QoBot drafts, collects evidence, follows up and prepares board material every day. Your CISO sets the bar and approves.
Free desktop app, on your own AI

What changes

QoBot takes the routine.
Your team keeps the work that matters.

Two of us spend two days a week on customer security questionnaires.

Customers reassured

The questionnaire backlog, absorbed.

187 of 212 answers drafted from your approved library and past answers, each with its source. Only the real unknowns go to the right owner.

Léa (Legal): 4 answers only Legal can give~15 min

Policies, board decks and audit evidence are always due, and always done by hand.

Obligations covered

Drafted to your standards.

Your templates, your wording, your control mapping (here ISO 27001 A.5.15–A.5.18). QoBot drafts, your team edits and approves, every version is kept.

Claire (CISO): review the diff, 2 sections~10 min

Six subsidiaries, 50 critical suppliers, one spreadsheet of follow-ups.

Good practices, everywhere

Actions followed up, across the group.

Local owners apply with QoBot's guides; it follows up, collects evidence and escalates only what is stuck, with a tracker your board can read.

Piotr (Poland IT): 14 admin accounts, guide sentthis week

What QoBot does

Drafts policies, answers and board material to your standards
Plans, follows up and escalates across entities and suppliers
Cites a source for every statement, flags what is still open
Explains, so local teams pick up the habits that matter

What you do

Your CISO sets the bar and approves what ships
Local teams apply the actions with QoBot's guides
Owners answer what only they know
Leadership decides on risks and exceptions

In practice: every outbound draft, change and escalation has a named approver. QoBot does the CISO legwork; accountability stays with your team.

Governance

Built for the way security teams already work.

QoBot fits into the program you already run.

Your CISO stays in charge

Drafts, outbound messages and changes go through approval. Each decision is logged with a name and a time.

Every statement sourced

Each answer links to the evidence it comes from. Unknowns are flagged for a human. QoBot tells you when an auditor or a lawyer must step in.

Free app, your own AI

The desktop app is free and runs on your own AI account: a Claude subscription or an API key from Anthropic, OpenAI or Mistral. You pay your AI provider directly. Cloud and Team, both paid, come later.

Desktop app

An app on your computer, where your data stays.

QoBot runs on macOS, Windows and Linux. The workspace is a folder on your computer with full history: easy to back up, audit and keep under your own controls.

Data goes only to your own AI, or wherever you approve
Cloud is the only hosted option, opt-in, hosted in France

Works with your frameworks

QoBot maps its work to the controls you already track, and keeps one evidence base across frameworks. QoBot knows NIS2, ISO 27001, TISAX and DORA, and prepares the work for each.

ISO 27001NIS2DORATISAXGDPRSOC 2

API & MCPPreview

An API and an MCP server, so your GRC tool, your ticketing or your own agents can hand work to QoBot. Both are in preview and come with the waitlist.

# hand a questionnaire to QoBot, approval stays with your CISO
POST /v1/questionnaires
{ "file": "helios-tisax.xlsx", "approver": "claire.martin" }
→ 202 · 212 questions · draft queued for approval

Preview: what a call will look like. No public docs yet.

Why trust us

Before the first customer logos, here is what we can tell you.

Honest by design

QoBot never invents evidence. It tells you what it knows, what it assumes, and when you need an auditor, a lawyer or your insurer.

QoBot, your AI CISO

Years of cybersecurity at Qontrol
For years, Qontrol has helped vCISOs and companies run their cybersecurity. QoBot puts that know-how into an AI CISO that works with your security team. Articule SAS, Paris.
Talk to the people building it
Thirty minutes with the founders, including our CISO-domain lead. Bring your hardest questionnaire.
Built with security teams
Security teams who join the waitlist help shape approvals, multi-entity rollouts and the Team plan.

FAQ

Questions security leaders ask us.

Something else? Talk to the founders or write to hello@qobot.io.

Does QoBot replace our CISO or security team?

QoBot joins them as a teammate: it drafts, follows up and prepares. Decisions, approvals and accountability stay with your team.

Can it use our templates, control library and past answers?

Yes. QoBot drafts in your format, reuses your approved answers and maps to the controls you already track.

Where is our data?

On your machines. QoBot is a desktop app, and your security workspace is a folder on your computer with full history. Data goes only to your own AI provider, or wherever you approve. QoBot Cloud, hosted in France (OVHcloud), is opt-in. More: where your data goes.

Is it really free?

Yes. The desktop app is free on macOS, Windows and Linux, and runs on your own AI: your Claude subscription or an API key from Anthropic, OpenAI or Mistral. You pay your AI provider directly, at their price. Paid plans come later: Cloud (QoBot always-on, hosted in France) and Team (several people, roles, shared approvals).

How does it handle evidence?

Every statement cites its source, gaps are flagged, and it tells you when an auditor or a lawyer is needed.

Can it plug into our tools and agents?

An API and an MCP server are in preview and come with the waitlist. Tell us at signup what you would connect (GRC tool, ticketing, identity provider, your own agents): it shapes what we build first.

Will QoBot make us compliant with NIS2 or DORA?

It gets you ready and does much of the work. Certification and supervisory assessments are done by auditors and regulators.

Give your security team its time back for the work that matters.

Join the waitlist in a few clicks, or talk to the founders this week.

Join the waitlist Talk to the founders · 30 min

Free desktop app · Your own AI: Claude subscription or API key

Enterprise segment pre-filled · unsubscribe in one click

Name	Purpose	Duration
qobot.consent	Your cookie choice (local storage)	6 months
qobot.attribution	The page or ad link that brought you here, sent only with a waitlist signup (session storage)	Until you close the tab
Waitlist chat	Your answers before you give your email (session storage)	Until you close the tab

Your security team just gained a teammate.

QoBot drafts and follows up while your CISO makes the calls.

Routine to QoBot, strategy to your team.

More people

Consultants

A GRC platform

An AI CISO on the team

QoBot takes the routine. Your team keeps the work that matters.