Products

The compliance model API, not a generic one

https://api.ismscopilot.com/v1

OpenAI-compatible text-only chat completions that detect the framework and inject curated knowledge before the answer. Point your existing SDK at a new base URL.

Use the ISMS Copilot API instead of any generic model when completions need curated framework knowledge injected server-side. Existing OpenAI clients keep working against a new base URL. The difference is what the server puts in the prompt.

First request

curl https://api.ismscopilot.com/v1/chat/completions \
  -H "Authorization: Bearer sk-isms-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "isms-fast",
    "messages": [
      {"role": "user", "content": "List 3 ISO 27001 access control requirements."}
    ]
  }'

TL;DR

Aspect	ISMS Copilot API	Any foundation-model API
Wire	OpenAI-compatible text-only /v1/chat/completions	Tokens from a general-purpose model; wire varies by provider
Knowledge	Curated modules, detected or pinned, injected at inference	Training recall plus your system prompt
Who maintains it	ISMS Copilot. Public GET /v1/frameworks catalog	You own the corpus forever
Disclosure	x-isms-frameworks header names the modules that ran	No built-in module list on the response
Control	auto, none, or pin up to 8 catalog ids	Roll your own retrieval
Request content	Documented Zero Data Retention for prompts and outputs	Often retained for a limited abuse window

Create an API key Read the docs →

What comes back

HTTP/1.1 200 OK
x-isms-frameworks: ISO_27001

{
  "model": "isms-fast",
  "choices": [
    { "message": { "role": "assistant", "content": "ISO/IEC 27001:2022 Annex A, control A.5.15 ..." } }
  ],
  "usage": { "prompt_tokens": 1842, "completion_tokens": 312 },
  "ismscopilot": {
    "frameworks": ["ISO_27001"],
    "knowledge_characters": 4926,
    "knowledge_tokens_method": "chars_div_3_v1"
  }
}

Trimmed. The x-isms-frameworks header and the ismscopilot object tell you which curated modules were injected and how much knowledge went in.

Try the catalog without a key

curl https://api.ismscopilot.com/v1/frameworks

No key needed. Returns count and registry_hash. 100+ modules; the live catalog is authoritative.

Models

The four standard aliases share one unit price per path. Rates live in the console.

isms-mini: GLM-5.3-Flash, global, bulk lane, no thinking mode
isms-fast: GLM 5.3, global
isms-thinking: GLM 5.3, global, reasoning
isms-fast-eu: Mistral, EU processing path
isms-thinking-eu: Mistral, EU processing path, reasoning

Framework control

{
  "model": "isms-thinking",
  "messages": [{ "role": "user", "content": "Map A.5.23 to SOC 2." }],
  "ismscopilot": {
    "frameworks": ["ISO_27001", "SOC_2"]
  }
}

auto detects named frameworks in the conversation, none injects nothing, or pin up to 8 catalog ids. ismscopilot.system: "none" opts out of the persona.

Auth and limits

Key: sk-isms-... shown once, created in the console
Header: Authorization: Bearer sk-isms-...
Keys per user: Up to 20 active, optional spend caps per key by hour, day, week, month
Streaming: Supported on both processing paths
Not supported: Tool calling, JSON mode, n > 1, logprobs, images. Text-only subset.
Thinking floor: max_tokens raised to 1024 on thinking aliases; effective value returned in x-isms-max-tokens-effective

Credits

Billing: Prepaid credits, no subscription
Minimum top-up: USD 20
Welcome credit: USD 10 once, for paying chat subscribers
Unit rates: platform.ismscopilot.com/pricing

Zero Data Retention

Prompts and outputs are not stored in the API data layer. Console usage history is metadata only. The global path runs on zero-retention upstream endpoints; the EU path runs on Mistral under a commercial ZDR agreement. Request content is never used for training. Usage and billing metadata are retained.

API DPA and subprocessors on the Trust Center →

Works with

Any OpenAI SDK
Swap base_url and the key. Python, Node, Go, Ruby, the rest.
opencode, Continue, Aider, Cline
Custom OpenAI-compatible (text-only) provider pointed at the base URL.
Cursor
Custom OpenAI-compatible (text-only) model in settings.
Claude Code
Cannot use this endpoint as its model backend (Anthropic API shape). Run it as a compliance sub-agent step, or use Account MCP.
Sub-agent

Status: live

Create an sk-isms key at platform.ismscopilot.com/keys, top up credits, send the first request. Machine summary: GET /api/public/api/v1.

Frequently Asked Questions

Is it fully OpenAI-compatible?

It is a documented text-only subset of the chat completions API: no tool calling, no JSON mode, n=1, no logprobs, no images. Streaming works. Existing OpenAI SDKs work once you swap the base URL and the key.

Does it search the standard at request time?

No. Detection is name-level: a named framework in the conversation selects a curated module that is injected before generation. A bare clause number injects nothing. No verbatim ISO or AICPA text is returned.

Which frameworks?

100+ curated modules. GET /v1/frameworks returns the live list with a registry hash and needs no key.

What does it cost?

Prepaid credits, USD 20 minimum top-up, a one-time USD 10 welcome credit for paying chat subscribers. Unit rates are listed in the console at platform.ismscopilot.com/pricing.

Where does it run?

Global aliases run through zero-retention upstream endpoints; the -eu aliases run on Mistral in the EU. The processing region comes back in a response header.

Can I use it from Claude Code?

Not as the model backend; Claude Code speaks the Anthropic API. Use it as a sub-agent step from a script, or connect Account MCP for account-level access.

Send the first request tonight

Create a key, top up, paste the curl. The response tells you which modules ran.

Create an API key