Platform

One knowledge engine. Web, desktop and your agent.

The same signed knowledge powers the InfoSec Manager in your browser, the local-first desktop app and the connector that brings KloudForm into Claude.

Web app

KloudForm InfoSec Manager

Early access

The InfoSec Manager is where your organisation’s knowledge, estate and security work come together. Each organisation’s data is kept separate at the database level.

A built-in AI assistant helps you assess, plan and write documentation. It runs on an API key from a supported AI provider that you bring yourself. The key is stored encrypted and is never displayed again once saved.

Request access

What’s inside

Knowledge Engine
Knowledge Units, packs, blueprints and recipes, with a review queue so nothing becomes active without human approval.
Prevent
Asset inventory and estate map, confidentiality, integrity and availability ratings, scans, attack-path analysis and exposure scoring.
Protect
Findings and risks ranked by exposure, incident handling and proposed remediations that you approve.
Comply
Pack assessments and self-assessment questionnaires, graded readiness, remediation roadmaps, compliance reports and an audit log.
Learn
Security training for your team.

Desktop app

Local-first, on your machine

Coming soon

KloudForm Desktop runs the full InfoSec Manager on your computer, with its own bundled PostgreSQL database (including pgvector). Your data lives in that local database, and the app listens only on your machine’s loopback address, never on your network.

Secrets such as the database password are kept in your operating system’s keychain, and local backups are encrypted with AES-256-GCM.

Download page

Highlights

Estate discovery
A read-only discovery agent maps your estate, including cloud inventory through the command-line tools you are already signed in to, such as gcloud, aws, az, gh and kubectl.
Claude connector built in
The app ships a small MCP bridge so Claude Desktop or Claude Code can use KloudForm while the app is running.
Local AI checks In development
An on-device engine that checks agent actions against your guardrails without sending data to an external AI service.
Signed updates
The app checks for updates and verifies each one’s signature before installing it.
Platforms
macOS on Apple silicon and 64-bit Windows.

Knowledge library and Hub

Governance as code

KloudForm’s knowledge is written as code: Markdown with YAML front matter, reviewed like software, then compiled into signed, digest-pinned packs. Each unit is original guidance mapped to the framework clause it supports.

Because AI agents consume it, the library is defended like a package registry: content is data only, every bundle passes an injection lint, and imported packs are quarantined for human review.

Knowledge Hub Coming soon

A public, searchable, read-only registry of the open library, like a package registry for controls and rules. Every pack page links straight into KloudForm so you can start using it.

Packs are guidance, not legal or audit advice, and do not by themselves confer any certification.

Packs include

  • Cyber Essentials readiness (UK)
  • UK GDPR data protection
  • ISO 27001 starter
  • SOC 2 readiness
  • Supplier and vendor assessment
  • SaaS startup baseline
  • Professional services baseline
  • Healthcare clinic baseline
  • E-commerce and retail baseline
  • Charity and non-profit baseline
  • Django and Node.js web apps
  • AWS, Google Cloud and Azure small estates
  • Kubernetes small cluster
  • AI and LLM applications

Blueprints include

  • Multi-tenant B2B SaaS
  • REST API service
  • RAG chat assistant
  • E-commerce storefront
  • Internal admin panel
  • Data pipelines

Claude connector

Bring KloudForm into Claude

Early access

The KloudForm plugin connects Claude to your knowledge engine over the Model Context Protocol (MCP). Claude can load signed packs, read your estate’s live facts and produce assessments, plans, designs and documentation grounded in them.

It runs through the desktop app: a small bridge started by Claude talks to the app on your own machine. Nothing listens on the network, and you never paste a URL or token into Claude.

Its token can call only the tools the skills need, every call is audited, a fresh token is issued each time the app starts, and the workspace owner can revoke access at any time. Other MCP-compatible coding agents can connect too.

KloudForm supplies the spec and the guardrails and records the facts. It never executes code on your behalf: your agent does the work, under your control.

Skills included

Assess and self-assess
Gap analysis against a pack, or a questionnaire that becomes a graded readiness score.
Plan
A dated, prioritised remediation roadmap from an assessment’s gaps.
Docs
Security policies, control narratives, architecture documents and readiness reports.
Greenfield, architect and build
Design a blueprint for review, then generate a secure-by-default app from the approved design.
DevOps
Infrastructure-as-code, Kubernetes and CI configuration that meets your packs’ guardrails.
Re-architect
Gap analysis, target blueprint and migration roadmap for an existing system.
Observe and RCA
An estate stand-up, and evidence-backed root-cause analysis for incidents.

Security model

Secure by design, not by promise.

Your credentials stay yours

Connectors are specifications, not credential stores. A connector holds only the name of a credential that lives in your own store.

Human review

Knowledge proposed by people or agents lands as a draft in a review queue. Only reviewed knowledge becomes active.

Signed and traceable

Packs are signed and pinned by digest, and generated work records the pack it was built against.

Responsible disclosure

Found a vulnerability? Email [email protected]. See our security.txt.

See it on your own estate.

KloudForm is in early access. Tell us what you are working on and we will set you up.

Request early access Email [email protected]