ISMS Copilot
Sign inStart free

The compliance API for what you build.

Cost-effective models with compliance knowledge built in, behind an OpenAI-compatible text-only endpoint. Pick your path below.

ISMS Copilot is the GRC expert your AI or your product calls. The API injects curated framework knowledge before an answer, for the frameworks it detects or you pin, and names the modules it used; you or your customer decide what to do with the answer. 151 framework modules today, each with a public last-verified date.

Get an API keyRead the docs →
Your first request
curl https://api.ismscopilot.com/v1/chat/completions \
  -H "Authorization: Bearer sk-isms-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "isms-fast",
    "messages": [
      {"role": "user", "content": "List 3 ISO 27001 access control requirements."}
    ]
  }'

Pick your path

Same API, same knowledge. What changes is the model you pick and what you need to prove about the data.

  • EU consultants

    Client data that needs EU processing: run it on the -eu models. Keep your own AI for the rest.

  • Compliance platforms

    Customers in many countries: pin each customer's national law on every request.

  • GRC engineers

    Mappings and reviews at volume on isms-mini, about $5 per 1,000 answers at a measured size.

  • Agents over MCP

    Claude, ChatGPT, Claude Code, Cursor or Codex call ISMS Copilot as a tool, on your ISMS Copilot chat plan (the free plan connects too).

Models and prices

Prepaid credits, from USD 20. The console is the billing source of truth.

Every model, limit and data path →

isms-fast, isms-thinking
Global path. $2.80 in, $8.80 out per million tokens.
isms-fast-eu, isms-thinking-eu
EU path. $2.80 in, $8.80 out per million tokens, same as global.
isms-mini
Global path, bulk lane. $0.50 in, $2.00 out per million tokens.

Where your data goes

The alias you call picks the path (as of 2026-11-09). On the -eu aliases, AI-model processing is done by Mistral AI on its EU-bound host. The other three go through OpenRouter (US) to a closed set of three hosts, two in the US and one in Sweden, with no per-request region pin, so treat that path as processed in the US. Request content is not kept as a record in our API data layer and is not used to train any model; usage and billing metadata are kept. The sub-processor list is the binding record if this page and the list ever differ.

Data paths, retention and sub-processors →API sub-processor list →

Latest framework changes

From the public change log, read 2026-11-09: 357 dated changes so far. Each module publishes the date it was last verified.

  • 2026-11-09: NIST_800_171

    SP 800-171 Rev. 2 version label now uses NIST's own wording, includes updates as of January 28, 2021, instead of the unofficial Update 1; same edition, lastVerified unchanged (prior-edition carry-forward).

  • 2026-11-09: NIST_800_171

    SP 800-171 Rev. 2 re-checked (NIST PDF and CSV unchanged, 32 CFR Part 170 not amended since 2024-12-16, Class Deviation 2026-O0025 still at Revision 3); states the DFARS 252.204-7012(b)(2)(ii)(B) condition that a requirement may be left unimplemented once an authorized representative of the DoD CIO has adjudicated it; lastVerified unchanged (prior-edition carry-forward).

  • 2026-11-04: ISO_9001

    Version moves from 2015 to 2026, the current edition per ISO Open Data (record 88464, edition 6, published 2026-09-16); the ISO 9001:2015 edition rows are removed.

  • Full change log (JSON)

    GET /v1/frameworks/changelog, no key needed

  • Framework catalog (JSON)

    GET /v1/frameworks, no key needed

Start here

Frequently Asked Questions

Is it OpenAI-compatible?

It is a documented text-only subset of chat completions: streaming works; tool calling, JSON mode, images, n>1 and logprobs do not. Point an OpenAI SDK at https://api.ismscopilot.com/v1 for plain completions.

What does the first call cost?

While the offer runs, a new API account can get a one-time USD 2 credit when it creates its first key in the console. It is one per person, and accounts that sign in only with Microsoft do not qualify. After that, prepaid credits from USD 20.

Can I use it from Claude or ChatGPT instead of code?

Yes, over MCP: your AI calls ISMS Copilot as a tool, and usage counts against your ISMS Copilot chat plan (the free plan connects too), not API credits. Connect your AI

Make the first call.

Create a key, send the request above, read the x-isms-frameworks header.

Get an API key