DEXYS – Digital Governance & Assurance

Making organisational decisions explainable, accountable and auditable.

DEXYS covers quality, information security and AI standards (ISO 9001, 27001 and 42001), alongside risk, controls, decision authority, accountability, nonconformities and evidence. What sets it apart is that it connects a decision to the authority that allowed it, the risk and controls it answers, the actions that followed and the evidence behind it.

Four areas, one record

Organisation compliance management

Describe your organisation once and keep it current: the Registers of issues, interested parties, risks, impact assessments, the roles people hold and the authorities you will not let a machine decide, alongside your processes, policies, systems and people.

  • A RACI matrix per requirement, and only the Accountable party is read when deciding who may confirm it
  • Processes and policies kept beside the decisions that rest on them
  • Competence recorded per person against the roles they hold, and an agent that holds a role is never graded on competence
  • Every system you run is declared, Microsoft or not

Framework assessment and posture

Assess the documents you already hold against ISO 9001, ISO 27001 and ISO 42001, and Cyber Essentials. Each requirement gets one audit-readiness verdict, golden threads show what has to join up, and the gaps are named rather than averaged away.

  • One verdict per requirement, worked out from the record on every read and stored nowhere, with no compliance percentage anywhere
  • Findings quote your own documents, and Not examined is never treated as covered
  • An auditor view shows each statement with the line that decided its verdict, exportable as a CSV
  • The report is drafted by an AI model and is not a certification: DEXYS certifies nothing

Decision governance

Record a decision once and connect it to the authority who may take it, the accountable person, the risk and controls it answers, the actions that follow and the evidence that supports it. A named person confirms it, the confirmation carries a review date, and DEXYS can say in writing which rule produced each answer.

  • Authority: who may confirm is derived from the party accountable for the requirement, with roles resolved to whoever holds them today, and an on-behalf confirmation carries a written reason
  • Risk and controls: a decision is linked to the requirement and risk it answers and to the checks that watch it
  • Actions and what followed: corrective actions are verified by a person, and a nonconformity's closure is computed on read and never drawn as a pass when the read did not answer
  • Evidence: pointers to where the proof lives, and an assurance pack that holds the record as it stood at a named instant
  • A confirmation lapses when its review date passes, so a decision nobody has looked at since is not still counted
  • The human sovereignty boundary is a register of its own: the authorities you will not let a machine decide

Continual assurance

The Assurance checker ships inside your DEXYS deployment and checks your Microsoft 365 and Azure configuration on a schedule. It reports what it finds, including when a run fails, because silence reads as health. A failing check alerts the accountable person, and what follows is worked through as events, incidents, nonconformities and corrective actions.

  • A High risk alert is sent immediately, and a Low risk alert is included in the daily email summary
  • Nothing the checker sends changes your record until a named person accepts it
  • Every run is recorded, including failed ones, with what it could reach
  • Events, incidents, nonconformities and corrective actions in one place, split by whether they are yours
  • Drills to rehearse a response before it is needed
  • The Actions Agent in Microsoft Teams is available to deploy in your own tenant

AI that works inside your governance

AI assistants are useful when they answer from what your organisation has confirmed, and dangerous when they answer from nothing. DEXYS lets them work inside the record, as the person who connected them.

ChatGPT, Claude and Copilot over MCP

On a plan that includes it, an assistant that speaks the Model Context Protocol can answer from your confirmed record. It acts with the connecting person's own permissions, every change it makes is recorded in that person's name, and each area is exposed only when you tick it: the default is nothing. A decision it adds from an assessment is a draft with nothing accepted. An AI assistant has worked a test organisation over MCP (November 2026): Claude, signed in as a member of that organisation, ran assessments, set up decisions and checks, and closed failing-check alerts. It has run on a test organisation so far.

A Microsoft 365 Copilot agent that knows how you work

DEXYS can package your confirmed working practices as a Microsoft 365 Copilot agent, “How we work”, for your administrator to upload to your own tenant. It was uploaded to a test tenant and tested in Microsoft 365 Copilot in November 2026.

A register of the agents you run

The AI agents your organisation runs are recorded in an agents register beside the people and roles. An agent may hold a role and perform it, and that is recorded; competence is a claim about a person, so an agent is never graded on it.

Connect your API Management gateway

If you run Azure API Management in front of your AI tools, you can connect your gateway to DEXYS. The gateway asks DEXYS whether your own record shows a recorded stop for the system behind a tool, and the human sovereignty boundary lists the authorities you will not delegate to a machine. It needs your own API Management and is off until you connect it, and DEXYS enforces nothing by itself.

Your data stays yours

A governance record is only worth trusting if you can see what holds it and what can reach into your systems. These are the guarantees, stated with the conditions they depend on.

No standing credential into your systems, where deployed in your own Azure

In a deployment in your own Azure subscription, DEXYS holds no standing credential into the systems your organisation declares. DEXYS Assurance is a read-only registration with no secret, used for the checks you switch on, consented to by your administrator and revocable by them at any time. Where DEXYS hosts your deployment, DEXYS holds the same registrations and no secret for them.

The checker reads, and changes nothing unless your administrator opts in

The Assurance checker runs compiled read-only commands. Some checks need a permission that could also change things, such as SharePoint full control. None is given by default: your administrator opts in one at a time, with an acknowledgement, and can opt out at any time.

Your documents can stay in your own SharePoint

You can keep your compliance documents in your own SharePoint. Where you host your own deployment, your record stays in your Azure subscription, on your own spend, in the region you choose.

Changes are made by named people

DEXYS can carry out a short list of named changes in your systems, but only when a named, accountable person presses for them, on that person's own permission. Closing a corrective action can need a second person: until an Organisation Admin narrows it, every severity needs a peer review.

A history, not an overwrite

Changes to the record are kept in a change log and a case history with who made them and when.