Kliper
Sign in Book a demo
Kliper
BUILT BY & FOR QSAs

The workspace where
PCI engagements get done.

Scoping, evidence, interviews, gaps, and ROC export — one tenant-isolated workspace, with Cortex drafting every testing procedure from your firm's own past work.

Start free trial See how it works
PCI DSS v4.0.1 Audit trail Per-tenant isolation Encrypted in transit & at rest
app.kliper.dev/workbench
Kliper Workbench: engagement KPIs, the priority queue, the active engagement and what is next up
Run a real engagement with us, shape the roadmap, keep founding pricing.
PCI DSS v4.0 & v4.0.1 278 controls tracked per ROC Inline guidance on 267 controls 62 scoping questions ROC + AoC export
SCOPE & SETUP

Every phase of the engagement, in one workspace.

Replace the spreadsheet-plus-Word-plus-Sharepoint stack with a system that models the work itself — requirements, evidence, procedures, and the ROC output they feed.

LIFECYCLE

Scoping → ROC, on a single timeline.

Kanban, Gantt, interviews, evidence, gap analysis — every artifact linked back to the testing procedure it satisfies.

PHASE
W01–03 W04–06 W07–09 W10–12
Scoping
100%
Evidence
92% · 4 open
Interviews
48% in prog.
Gap analysis
Queued — not started
ROC export
Pending
CLIENT PORTAL

Evidence in, not lost in email.

Tenant-isolated portal for your client. Uploads land against the exact requirement.

ACME · INBOUND 4 NEW
Received
18 files
Verified
14
Pending
4
  • network-diagram-v4.pdf
    REQ 1.2.1 · 2h ago
    VERIFIED
  • hsm-key-ceremony.mov
    REQ 3.6.1 · today
    REVIEW
  • Awaiting upload…
    REQ 8.3.4 · 6d ago
    OVERDUE
GAP & RISK

See the gaps before QA does.

Live heatmap across all 12 requirements. Every gap routes to an owner with a plan and a date.

COVERAGE · 12×16 93.9% IN PLACE
In place Comp. ctrl Gap
ROC EXPORT

Your ROC template, rendered — not reformatted.

Upload your firm's DOCX once. Kliper maps every answered procedure into the exact styling your QA expects.

NORTHBEAM QSA ROC v3.1 · CONFIDENTIAL
PCI DSS v4.0.1 · REPORT ON COMPLIANCE
10 · Log and monitor all access
10.2.1.1 Audit logs capture all individual user access to cardholder data.
ASSESSMENT FINDING IN PLACE

Audit logging is enabled across all in-scope Linux hosts via auditd and forwarded to Splunk under a 12-month retention policy. Cardholder data access on the card_vault schema is captured through Postgres pgaudit. The assessor reviewed configuration and live log samples and confirmed coverage of all administrative and application identities.

EVIDENCE REF
auditd.conf — host CDE-01 EV-014
splunk-retention.png EV-021
REQ 10.2.1.1Page 142 of 335
  • Template styles preserved — TOC, headings, tables
  • 370 testing procedures mapped automatically
  • Evidence appendix + audit trail auto-generated
  • Redline diff against prior-year ROC
Procedures
370 mapped
Requirements
253 covered
Pages
335 generated
Export time
~1 second
Export Acme-ROC-Q4.docx
DRAFT WITH CORTEX

Grounded in your firm's ROCs.
Not the open web.

Cortex isn't a chat wrapper. It retrieves from your prior ROCs, templates, interview notes, and every piece of evidence already in your tenant.

Drafts TP responses in your firm's voice

Retrieves phrasing from ROCs your partner already signed off on.

Cites every sentence

Each claim maps back to a source document, interview, or config snippet.

Scope-diff against last year

Flags where this year's scoping diverges from last year's, and explains why.

See Cortex in action Data stays in your tenant
Cortex req 8.3.4 · MFA coverage
grounded
R
Reem · Lead assessor · 2:14pm
Draft the TP response for 8.3.4. Use last year's ROC and check if Okta coverage changed.
Cortex · 2:14pm
MFA is enforced for all non-console administrative access via Okta + hardware tokens for the CDE. Compared to the 2024 ROC, coverage now extends to 14 additional bastion hosts added in Q2.
SRC·01Acme 2024 ROC · §8.3.4, p.98
SRC·02okta-coverage-export.csv
SRC·03Interview · Priya Shah, IT Director
R
Reem · 2:16pm
Any compensating controls we missed?
Cortex · 2:16pm
One candidate: the legacy payroll jumpbox jb-payroll-01 still uses password + TOTP. Previous ROC filed this as a compensating control with quarterly log review. Worth confirming the log review is current▍
Ask Cortex about this requirement…
⌘ K
Drafted
42 / 63 TP
Hours saved
≈ 4h / TP
Avg citations
3.2 / RSP
GAPS & REMEDIATION

The same engagement,
two very different weeks.

Gap tracking and the ROC write-up are where engagements stall. Here's what the last mile looks like on the old stack versus on Kliper.

Spreadsheets + Word + emailTHE OLD WAY
Gaps tracked in a side spreadsheetdrifts out of sync with the ROC
Evidence chased over email threadsno link between a file and the requirement
Each TP written from a blank pagecopy-paste from last year's Word doc
QA re-checks every citation by handdays of review before sign-off
One Kliper workspaceWITH KLIPER
Gaps live on the requirement itselfstatus rolls up to the ROC automatically
Evidence auto-linked on uploadCortex maps the file to its requirement
Cortex drafts each TP from your past workgrounded, in your firm's voice
Every sentence pre-cited for QAreview defensibility, not prose

Two audiences, one source of truth.

QSA FIRMS

Run every engagement from the same cockpit.

Reuse prior ROCs, templates, and interview banks. Stop reimplementing process for each partner.

  • Firm-wide ROC library + retrieval
  • Partner / manager / assessor roles
  • Your ROC template, not ours
  • Utilization across all engagements
IN-HOUSE

Continuous readiness, not a fire drill.

Mid-to-large merchants running their own PCI program year-round, not just the six weeks before the QSA arrives.

  • Evidence expiry + refresh reminders
  • Route gaps to engineering owners
  • Hand QSA a clean package on day one
  • Jira / ServiceNow / Okta integrations

What a week back per engagement is worth.

Drag to match your firm. Estimate based on Cortex removing roughly 40% of ROC assembly time.

Engagements per year12
Avg hours per ROC today120 h
Today ≈ 1,440 h/yr on ROC assembly · with Kliper ≈ 864 h/yr.
Hours saved per year576 h
Weeks reclaimed
14
≈ Extra capacity
8 engagements
INTEGRATIONS

Evidence and project state flow in.

Connect the systems your evidence already lives in — Kliper keeps requirements, tickets, and access in sync.

Testing
ServiceNow
Ticketing & ITSM
Sync remediation tickets to gaps & findings — status flows both ways.
Live
Odoo
Project management
Two-way project-management sync for engagement tasks.
Live
Okta
Identity & SSO
SSO sign-in and automated access-review evidence.
Live
Jira
Issue tracking
Track gaps as issues your team already works in.
Request an integration
Anything else
Tell us where your evidence lives — we'll wire it up.

Be one of the first firms to run an engagement on Kliper.

We’re onboarding a small founding cohort ahead of public launch — from solo and freelance assessors to multi-QSA firms. No customer logos here yet, by design. The people who join now help decide what Kliper becomes.

Shape the roadmap

Your workflow, your ROC quirks, your house style drive what we build next — with a direct line to the people writing the code.

Founder-led onboarding

Solo or a full firm, we migrate your past ROCs and templates with you, hands-on, until Cortex drafts in your own voice.

Founding pricing, locked

Lock early-partner pricing for the life of your account — set before public plans go live, and it doesn’t move.

Request founding access Limited founding cohort · onboarding now

Pricing that scales with your practice.

From solo assessors to mid-size QSA firms — change or cancel anytime via Polar.

FREE

Free

Get started with basic compliance tracking.

$0/month
  • 1 user
  • 1 client · 1 assessment
  • 5 DOCX / assessment / month
  • 5 Cortex AI drafts / mo
Get started free
SOLO

Solo

For independent compliance consultants.

$49/month
  • 1 user
  • 5 client engagements
  • 10 DOCX / assessment / month
  • 100 Cortex AI drafts / mo
  • Priority support
Start free trial
PROPOPULAR

Pro

For small QSA firms running parallel engagements.

$199/month
  • 10 users
  • 25 client engagements
  • 25 DOCX / assessment / month
  • 1,000 Cortex AI drafts / mo
  • Advanced reporting
Choose Pro
TEAM

Team

For mid-size QSA firms — no limits.

$499/month
  • 25 users
  • Unlimited assessments
  • Unlimited exports & AI
  • White-label reports Coming soon
Choose Team
ENTERPRISE

Enterprise

For top-100 QSA firms — unlimited everything with the controls your security team expects.

  • Unlimited users & assessments
  • Enterprise SSO (OIDC)
  • SAML 2.0 Coming soon
  • Dedicated CSM
  • Custom contract & SLA
  • Audit log export
  • White-label Coming soon
Custom
Annual contract
Contact sales

Checkout and card storage are handled by Polar (Merchant of Record) — card data never touches Kliper. Prices in USD; tax may apply at checkout. See full plan comparison →

Asked by every firm we onboard.

Where does our engagement data live?
Each firm runs in its own isolated tenant — separate storage, separate keys, encrypted in transit and at rest. Your ROCs and evidence are never used to train shared models or visible to any other tenant.
Does Cortex make things up?
Cortex drafts only from your firm's own cited past work — every sentence carries a source reference, and anything it can't ground is flagged for the assessor instead of invented. Your QA reviews defensibility, not prose.
Can we keep our own ROC template?
Yes. Kliper exports into your firm's ROC template — formatting, numbering, and house style intact — not a generic layout you have to re-edit.
How do clients get evidence to us?
Through the client portal: you request evidence, the client uploads via a magic link, and Cortex auto-scans each file and suggests which requirement it answers — with a human always in the loop.
What happens when an engagement ends?
The engagement is archived read-only with a complete audit trail, and you can export everything. Retention defaults align with PCI SSC workpaper rules — evidence held a minimum of three years.

Ship your next ROC
on Kliper.

A 25-minute walkthrough with one of our engineers. Bring your ugliest past engagement.

Book a demo Start free trial

No credit card · Full product · 14 days