Authoring, versioning, and publishing for technical standards and the profiles that elaborate on them.
A multi-tenant SaaS web application that gives standards bodies,
consortia, and security teams a single source of truth for their
criteria, the standards that collect them, and the profiles that
elaborate specific standards for a use case. Operated by us as a
managed service, on our infrastructure, with your data logically
isolated in its own tenant.
The codebase is the product: it is what we operate, what your working groups use, and what your AI assistants query through the MCP server. The default deployment is multi-tenant SaaS, operated by us on Noetroniq's infrastructure. Your data lives in its own tenant, logically isolated from every other customer, and you access it through the same WebAuthn-authenticated UI and the same API a self-hosted customer would.
On-premise and your-own-cloud-account deployments are also available for customers who need them, scoped and priced separately. The multi-tenant SaaS model is the default and is how we recommend running the service for most customers; it gives you the same features at a lower operational cost, and it lets us apply patches, monitoring, and capacity planning on your behalf.
The data model is the one used by the Pan-Canadian Trust Framework and the kind of framework you would build from it: a hierarchy of criteria grouped into standards, with profiles that select the elaborations of a specific standard for a specific use case. Every content entity supports a user-assigned version label and a system-managed revision counter. Every save writes a complete snapshot of the prior state to an append-only revision history. No history record is ever modified or deleted.
Multi-tenancy is enforced throughout: at the data layer (every query is scoped to a tenant), at the API layer (every endpoint requires a tenant-scoped credential), and at the UI layer (users only ever see the data of the tenant they belong to).
§ 02 ·
What it does
The capabilities relevant to standards bodies, consortia, and security
teams. Each is a first-class feature of the application, not a roadmap
item.
Authoring and versioning
Criteria are the atomic unit. Each has a user-assigned identifier
(e.g. `AC-1`, `IA-2.3`) that is stable across versions, so
citations and cross-references survive renames. Criteria can be
organised into hierarchical Criteria Groups.
User-assigned identifier that does not change across versions
User-assigned version label (1.0, 2024-Q1, Draft, v2)
System-managed revision counter, incremented on every save
Revision notes attached to every save
Hierarchical Criteria (parent → child) and Criteria Groups
Standards and profiles
A Standard is a curated selection of top-level Criteria Groups. A
Profile is a curated selection of Elaboration Criteria Groups that
elaborate a specific Standard for a use case. This is the
relationship the PCTF and most sector-specific assurance
frameworks use, and the relationship the tool is built around.
Standards select top-level Criteria Groups only
Profiles select Elaboration Criteria Groups only
Profile's parent group must be present in the owning Standard
Multiple profiles per Standard (e.g. HIGH / MOD / LOW tiers)
Per-entity version label, revision counter, and revision history
Revision history and audit trail
Every save writes a complete snapshot of the previous state to an
append-only revision history. The working group gets a full audit
trail, the ability to roll back, the ability to compare any two
revisions, and a clean publishable PDF or DOCX of any version for
public consultation.
Append-only; history records are never modified or deleted
Compare any two revisions of the same entity
Roll back to a prior state
Server-rendered PDF and DOCX for public consultation
Document identifiers (NIST-SP800-53-style) are first-class
Cross-standards mapping
The Similarity Service computes semantic similarity between
criteria using a local sentence-transformer model, producing a
0 to 1 similarity score with a human-readable band. This is the
"have they met something equivalent elsewhere" question: an
organisation presenting evidence under another standard's criterion
can be matched to the most similar PCTF criterion, and a reviewer
can decide whether the evidence is sufficient.
Local sentence-transformer model: no data leaves the tenant
0–1 similarity score with a human-readable band
Supports the conformance / attestation use case
Pair with Gap Analysis for full mapping workflow
Gap analysis
The Gap Analysis Service uses a configured LLM (bring your own
key, your contract, your billing) to compare two criteria and
produce intersection, A-minus-B, B-minus-A, and a synthesised
join. The service does not ship with a hosted LLM, does not see
the API key, and does not bill for hosted LLM usage.
[object Object]
[object Object]
[object Object]
[object Object]
Bring-your-own LLM key; no hosted inference
AI-agent access via MCP
A Model Context Protocol server exposes standards, criteria,
groups, and profiles to AI assistants such as Claude and GitHub
Copilot. Tenancy is enforced by API key. Working-group chairs
and staff can use an MCP-aware assistant to search, summarise,
and draft text against the live, tenant-scoped dataset, with
the assistant's actions bounded by the same access controls a
human user has.
Standards, criteria, groups, and profiles exposed over MCP
API-key tenancy enforcement
Assistant actions bounded by human access controls
Search, summarise, and draft against the live dataset
Decision support
First-class voting on six entity types (criteria, criteria_group,
standard, profile, standard_document, profile_document). Votes are
bound to the current revision so a vote on revision 7 of a
criterion does not silently carry forward to revision 8.
Threaded comments on the same entities, with the same revision
binding. Append-only collaboration event log.
Voting on six entity types
Votes are revision-bound (not silently carried forward)
WebAuthn / passkey authentication. Members log in with a
device-bound credential, which avoids shared passwords and is
appropriate for the federation-style membership of a standards
consortium. Role-based access with global and tenant-scoped
roles.
WebAuthn / passkey authentication
No shared passwords
Service Administrator, Service Auditor, and tenant-scoped roles
RBAC enforced at the API and UI layer
§ 03 ·
The author's first attempt was a spreadsheet, workable for one person, difficult for other contributors to use, easy to break with a stray paste. The web application is the second attempt: a real data model, a real API, a real UI, and a real revision history. It has been in active development since 2023 and is in production use.
The generalisation from PCTF-specific to any standards body or consortium was deliberate. The data model (Criteria, Criteria Groups, Standards, Profiles, versioned and revisioned with a full audit trail) is the same shape that NIST, ISO, and sector-specific assurance frameworks use. The PCTF was the first customer, not the only one the tool was designed for.
Talk to us about deploying it
Standards Manager is offered as a multi-tenant SaaS subscription by default. We operate the production deployment on Noetroniq's infrastructure, with your data logically isolated in its own tenant. Pricing is sized to the deployment shape: number of users, number of standards in scope, expected traffic, and we are happy to scope it with you. On-premise and your-cloud-account deployments are also available for customers who need them; these are scoped and priced separately.
