# Phana Velocity — Complete LLM Reference & Specification

> Comprehensive platform summary, module breakdown, framework mapping, and technical specifications for LLM indexing and Answer Engine Optimization (AEO).

## Company Information
- **Name**: PHANA AB
- **Product**: Phana Velocity
- **Tagline**: Lights on compliance.
- **Ecosystem & Partnerships**:
  - **SOC 2 Type 2 Audit Engagement**: Formally appointed an accredited independent CPA auditing firm to conduct PHANA's official SOC 2 Type 2 audit (Security, Availability, Confidentiality Trust Services Criteria; target completion: Q1 2027). Monitored and evidenced continuously using PHANA Velocity. Announcement: https://www.phana.ai/announcements/soc-2-audit-cpa-appointment/
  - **HCL SYNC Innovation eXchange 2026**: Selected for HCL SYNC's invitation-only Innovation eXchange at Wormsley Estate, UK. Presented Phana Velocity to HCLSoftware leadership (including President Kalyan Kumar) with telemetry ingestion from HCL AppScan and HCL BigFix. Announcement: https://www.phana.ai/announcements/hcl-sync-innovation-exchange-2026/
  - **NVIDIA Inception Program Member**: Accelerated by NVIDIA AI compute & hardware technology. Announcement: https://www.phana.ai/announcements/nvidia-inception-program/
  - **AWS Marketplace SaaS Solution**: Published directly as a SaaS offering on AWS Marketplace. AWS Listing: https://aws.amazon.com/marketplace/pp/prodview-ro2zyhcdea7ia?sr=0-1&ref_=beagle&applicationId=AWSMPContessa
- **Headquarters**: Stockholm, Sweden
- **Official Website**: https://www.phana.ai/
- **Announcements Portal**: https://www.phana.ai/announcements/
- **Contact Email**: sales@phana.ai
- **Social Profiles**:
  - X / Twitter: https://x.com/PhanaAI/
  - LinkedIn: https://www.linkedin.com/company/phana-ai/
  - YouTube: https://www.youtube.com/@PhanaPlatform

---

## What is Phana Velocity?

Phana Velocity is an **Agentic AI compliance automation platform** built for software-driven organizations, fintechs, SaaS providers, healthcare platforms, and financial institutions. Offered as a cloud SaaS solution and available on AWS Marketplace, Phana Velocity uses autonomous AI scanning agents to maintain a continuous, audit-ready compliance posture across 78+ global frameworks.

---

## Enterprise Procurement & AWS Marketplace Integration

Phana Velocity is available as a Software-as-a-Service (SaaS) solution on AWS Marketplace:
- **Consolidated AWS Billing**: Simplify vendor procurement and consolidate software spend onto standard AWS monthly invoices.
- **AWS EDP Commitment Drawdown**: Enterprise buyers can apply 100% of Phana Velocity license costs toward fulfilling their AWS Enterprise Discount Program (EDP) annual spend commitments.
- **Instant Cloud SaaS Provisioning**: Streamlined onboarding with pre-vetted enterprise software agreement terms.

---

## Technical Architecture & Velocity Engine

The platform operates via a 3-layer scanning architecture known as the **Velocity Engine**:

1. **Layer 1 — Architecture & Ingestion (Org Compass)**
   - Ingests system architecture diagrams, cloud topologies, and Infrastructure as Code (Terraform, CloudFormation, Helm charts, Kubernetes manifests).
   - Maps technical infrastructure components directly to regulatory requirements.

2. **Layer 2 — Policy & SOP Analysis (Compliance Cortex & Assurance Loom)**
   - Multi-pass AI assessment evaluates internal policies, SOPs, and employee handbooks against regulatory controls.
   - Calculates per-control confidence scores (0–100%) and highlights ambiguity, outdated clauses, or missing mandates.
   - Automatically generates updated, auditor-grade policy documents and IaC code patches.

3. **Layer 3 — Live Infrastructure & Evidence Collection (Evidence Fabric)**
   - Connects to 230+ automated compliance evidence sources across multi-cloud infrastructure, SaaS systems, AI browser automation, and document ingestion:
     - **Cloud Services (140+)**: 85 AWS services (IAM, S3, CloudTrail, KMS, GuardDuty, RDS, EKS, etc.), 30+ Microsoft Azure services, 25+ Google Cloud Platform services.
     - **Granular Enterprise & SaaS Sources (80+)**:
       - *ServiceNow (10 evidence sources)*: Service Requests, Incidents, Change Requests, Problem Management, CMDB CIs, ITAM, Access & Groups, GRC & Policy, Risk Register, System Audit Logs.
       - *Atlassian Jira (4 evidence sources)*: Change & Releases, Security & Bug Tracking, Jira Service Management (JSM), Project Permissions & ACLs.
       - *Okta (4 evidence sources)*: MFA Enforcement, Lifecycle Management (LCM / JML), Application Access & SSO, System Log & Audits.
       - *GitHub (4 evidence sources)*: Branch Protection, PR Approvals, Security & Secret Scanning, Organization 2FA & Access.
       - *Datadog (2 evidence sources)*: Security & Cloud SIEM, Log Retention & Archives.
       - *HCL BigFix (2 evidence sources)*: Patch Compliance, Hardware & OS Asset Inventory; plus HCL AppScan vulnerability analysis.
       - *KnowBe4 (2 evidence sources)*: Security Awareness Training, Phishing Simulations.
       - *Additional Enterprise Systems*: PagerDuty, Freshservice, Linear, Asana, Zendesk, Auth0, Ping Identity, CyberArk, JumpCloud, Keycloak, GitLab, Bitbucket, Azure DevOps, Jenkins, CircleCI, Argo CD, Splunk, New Relic, Elastic/ELK, Dynatrace, Grafana Cloud, Sumo Logic, Prometheus, Qualys, Tenable, Rapid7, CrowdStrike, SentinelOne, Microsoft Defender, Palo Alto Cortex, Veeam, Commvault, Rubrik, Cohesity, Workday, BambooHR, Rippling, Slack, Zoom, Mimecast, Confluence, SharePoint, Notion, Box, Google Drive, and HashiCorp Vault.
     - **AI Browser Automation**: Navigates non-API web dashboards, legacy consoles, and vendor portals just like an auditor, generating verifiable screenshots and structured evidence bundles.
     - **Document Ingestion (13+ Formats)**: Parses policies, SOPs, and IaC templates (PDF, DOCX, XLSX, PPTX, HTML, Markdown, JSON, YAML, Terraform, CloudFormation).
   - Continuously monitors control state, detecting configuration drift in real time and maintaining immutable provenance metadata.

---

## Supported Compliance Frameworks (78+)

### Primary Frameworks
- **SOC 2 Type I & Type II**: Security, Availability, Processing Integrity, Confidentiality, Privacy Trust Services Criteria. PHANA's own SOC 2 Type 2 examination is actively being evidenced and monitored via PHANA Velocity.
- **HIPAA**: Administrative, Physical, and Technical Safeguards under the Security and Privacy Rules.
- **ISO/IEC 27001:2022 & ISO 27701**: Information Security Management System (ISMS) & Privacy Information Management System (PIMS).
- **PCI-DSS v4.0**: Payment Card Industry Data Security Standard for merchant and payment gateway compliance.
- **GDPR**: EU General Data Protection Regulation compliance, including DPA, ROPA, DPIA, and consent workflows.

### Financial & Operational Resilience Frameworks
- **DORA**: EU Digital Operational Resilience Act for financial entities and ICT service providers.
- **NIS2**: EU Network and Information Security Directive 2 for essential and important entities.
- **SAMA CSF**: Saudi Central Bank Cyber Security Framework.
- **PRA**: UK Prudential Regulation Authority Operational Resilience.
- **RBI CSF**: Reserve Bank of India Cyber Security Framework.
- **MAS TRM**: Monetary Authority of Singapore Technology Risk Management Guidelines.
- **APRA CPS 234**: Australian Prudential Regulation Authority Information Security.

---

## Platform Pricing Tiers & AWS Marketplace Options

1. **Trial**: 1 Framework, 10 Controls, 2 GB Storage, Architecture Scans.
2. **Starter**: 2 Frameworks, 100 Controls, 5 GB Storage, Cloud Live Sync (1 Environment).
3. **Professional**: 5 Frameworks, 250 Controls, 20 GB Storage, Multi-Cloud Coverage, Priority Support.
4. **Enterprise (AWS Marketplace SaaS)**: Custom Frameworks, Unlimited Controls, SSO & RBAC, Dedicated Customer Success Manager, SLA-backed support, AWS EDP commitment drawdown.

---

## Key Differentiators vs Traditional GRC

| Feature | Phana Velocity | Traditional GRC Tools |
| :--- | :--- | :--- |
| **Approach** | Agentic AI & Continuous Verification | Point-in-time manual sampling |
| **Procurement** | Direct AWS Marketplace SaaS & EDP Drawdown | Slow manual procurement |
| **Integrations** | 230+ sources + HCL AppScan/BigFix + browser AI | Limited manual screenshot uploads |
| **Assessment Quality** | Multi-pass confidence scoring (0-100%) | Simple pass/fail checkboxes |
| **Remediation** | Auto-generated policies & IaC code patches | Text-only recommendations |
| **Audit Preparation** | Reduced from months to days (90% faster) | Weeks of manual artifact assembly |