Welcome to the amara Help Center

Use this guide to explore asset, risk, assessment, supplier, training and document workflows. Ask amara can help with supported questions about authorised information.

The platform combines governed records, workflow modules, role-aware access and deployment-specific controls.

Choose your starting point

Start with the work your role permits: register an Asset, review a risk, open an assessment or continue an assigned training course. For software exposure, open Vulnerability Assurance when it is enabled.

Keep the scope clear

The modules and integrations available to you depend on your role and deployment. Before using an external connector or AI provider, check its data boundary and your organisation's rules.

Review the scope, evidence, responsibilities and operating boundary before relying on a proposal or configured service.

How Modules Connect

Shared records provide context across asset, risk, supplier and assessment work. A link between records does not mean that every score or approval changes automatically.

Solid connections show explicit workflow hand-offs; dashed connections provide supporting context and still require human review.

Follow the evidence

Use the links in a record to review related information. Configured Jira and Confluence actions connect permitted work with those external services; confirm external writes before proceeding.

Vulnerability work

Vulnerability Assurance uses software lists and individual CVE findings. Guided Tasks group related work for review while preserving each finding's decisions. A resolved ticket or a scanner non-detection does not by itself close the finding.

Shared records can support several reviews, while each framework keeps its own scope, requirements and decision.

Platform at a Glance

amara provides asset and risk management, security assessments, NIS2 workflows, supplier management, training, document tools, Ask amara, administration and security scanning. Vulnerability Assurance is available when enabled.

Compare written offers using the same scope, responsibilities and lifecycle assumptions; this guide promises no fixed savings.

Explore the actual scope

Use the sidebar and module dashboards to see the work available to your role. Reports and exports belong to the relevant module; options vary by workflow.

Discuss deployment and terms

Ask AMARA about the intended deployment, enabled integrations, operational requirements and current commercial terms. This guide does not quote prices or promise an implementation timetable.

Available components, responsibilities, support and commercial terms are agreed for the selected deployment.

Data Flow Explained

Asset, risk and supplier records can provide context for related workflows. Review the linked record and its current status before making a decision.

Linked records provide context; assessment, approval and treatment decisions remain explicit within their own workflows.

Assessment evidence

An assessment records responses and evidence for its own scope. Relevant evidence may support another assessment, but each framework's requirements and gaps need a separate review.

External evidence

Enabled connectors can return Jira, Confluence, scanner or cloud evidence. Check the source, timestamp and permissions; a status update is not a substitute for the required approval.

Technical Architecture

For technical teams who need the deployment boundary. amara is a web application with governed records, document retrieval and configurable intelligence processing. External traffic occurs only through deliberately configured connectors or governed public-intelligence retrieval. Confirm exact components, controls and resource sizing for the selected environment with your implementation team.

Architecture boundary: optional Jira, Confluence, Azure, AWS and scanner connectors plus governed VA public-intelligence retrieval; the local application remains the record and approval point.

Stack Overview

Layered Security Controls

Layered controls: network boundary, encrypted transport, strong authentication, access control, audit evidence and governed records.

Three-Factor Authentication

Strong authentication can combine an approved certificate, password and time-based verification, subject to the selected deployment policy.

AI Architecture

Pipeline: Compliance Gate → Smart Router → Privacy Shield → governed processing → Audit Log

Resource requirements

Resource sizing depends on the number of users, retained records, document corpus, enabled modules, integrations, scan workload, availability requirements and processing configuration. Agree sizing, monitoring, backup, recovery and update procedures with the implementation team before production use.

Deployment Options

amara can be deployed in a managed, customer-operated or appliance-style environment. The available integrations, operational controls, data boundary and commercial terms depend on the selected deployment and agreement.

Managed, customer-operated and appliance-style deployment options — availability and terms are agreed for the selected environment

Deployment Profiles

Deployment Architecture

Deployment boundary: web application → governed records and document services → configured intelligence processing

Implementation components are deployment-specific. The customer-facing architecture is a web application, governed records, approved document services, configurable intelligence processing and explicitly enabled connectors. Do not treat a Help diagram as a production build specification.

Network requirements

Network requirements depend on the selected deployment and enabled services. An isolated environment must not enable networked connectors, public-intelligence refresh or remote scanner access without an approved boundary.

TLS / HTTPS Configuration

Use encrypted transport and an approved certificate policy. Confirm the available certificate and strong-authentication options with your implementation team.

Backup Strategy

Agree the backup frequency, retention, encryption, recovery objective and restoration test process for the selected deployment before production use.

Quick Start

Sign in with an authorised account and review the modules visible in your sidebar. Ask an administrator about missing access rather than assuming a feature is unavailable.

An illustrative onboarding sequence; prerequisites, duration, deliverables and acceptance are agreed separately.

Create a useful starting record

In Asset Management, register an asset you are responsible for and complete the required fields. In Risk Management, record a relevant risk and link the available asset context. Use the applicable assessment module to review your security posture.

Continue with a clear next action

Review the saved record and its evidence. Assign the responsible owner or proceed to the next available workflow step. Ask amara can help retrieve supported information, subject to your role.

Your First Login

After signing in, use the sidebar to open a module available to your role. The application supports English and German; use its language control to choose.

Navigate the application

Module dashboards, lists and record links lead to related work. Use normal navigation controls to open records and return to the relevant list.

Access depends on your role

An administrator assigns the permissions needed for your work. Optional integrations and Vulnerability Assurance also depend on deployment configuration.

Organisation Setup

Administrators maintain organisation information used by relevant workflows and document fields. Enter accurate information and review changes when your organisation changes.

Prepare reliable inputs

Use the actual legal name, contacts and other fields required by the selected form. NIS2 relevance results depend on the information and scope supplied.

Review the result

Check generated documents and assessment outputs after changing organisation details. A saved setting does not prove that every existing record has been updated.

Users and Roles

Administrators create and maintain user accounts and assign the permissions needed for each person's work.

Assign limited access

Use the role controls in the current Admin Panel. NIS2 Compliance and Vulnerability Assurance IT Owner each have dedicated controls. General Assessments can grant access across CIA, Rapid Assessment, ISO 27001, BSI C5 and EU AI Act; dedicated controls for those assessment areas remain available. Security Scanning has its own permission.

Read-only access

The read-only flag restricts changes; it does not grant access to every module. Combine it with the relevant viewing permissions and verify the resulting interface.

Plan Your Onboarding

Use this sequence to organise onboarding. Timing depends on your organisation, data, responsibilities and the intended deployment.

Prepare the environment, configure the organisation, populate records and review the intended launch scope.

Establish the foundation

Agree the operating environment, access roles and organisation information. Register a useful initial set of assets and suppliers, then review their completeness.

Build evidence and review readiness

Run the relevant assessments, record risks and treatment responsibilities, prepare policy drafts and assign training. Review the actual results before deciding whether the environment is ready for broader use.

The sequence is a planning aid, not a fixed timetable or certification promise.

Asset Management

Register and maintain the hardware, software, data, services and facilities relevant to your organisation. The asset record provides ownership and classification context for related work.

Register a real asset, record its context, connect relevant work and review it throughout its lifecycle.

Start with a real asset

Open Asset Management and use the available creation control. Complete the required identification, category and ownership fields, then review the saved record.

Link relevant work

Use the supported links to suppliers, risks and assessments. For security scanning or Vulnerability Assurance, confirm the asset's eligibility and the permissions required by that workflow.

Registering an Asset

Open Asset Management and create a record for something your organisation actually owns or operates. Use a descriptive name and complete the required fields shown in the form.

Asset records move from discovery through classification, protection and periodic review.

Record responsibility and context

Record the owner, category and other information you can verify. Review the classification choices in the application rather than treating example scores as mandatory values.

Verify after saving

Open the saved record and confirm its details. Add the relevant supplier or risk links through the supported controls; review any validation message before proceeding.

CIA Assessment

CIA means confidentiality, integrity and availability. Use the CIA assessment workflow to evaluate an asset's protection requirements and relevant measures.

The assessment records inputs, owner review, security context and the final responsible approval.

Use the current assessment

Select the asset and service context, then work through the measures and recommendations presented by the application. Classification labels and assessment scales serve different purposes; use the labels shown in the form.

Review and approve

Follow the assessment's review and approval workflow. Record the reasons and evidence for your decisions. CIA assessment is separate from the internal priority used in Vulnerability Assurance.

Maintaining Assets

Keep asset records current as systems, responsibilities and supplier relationships change.

Review ownership, classification, dependencies and evidence as the asset changes.

Review the record

Check ownership, classification, location and linked work according to your organisation's review schedule. Record changes through the available asset controls.

Retire with care

Before retiring an asset, review the linked risks, suppliers, scans and vulnerability evidence. Preserve the records required by your organisation's evidence and retention rules.

Asset Data Import and Export

Use the import or export controls provided by the relevant module and deployment. Confirm the accepted format before preparing a file.

Review imported data

Check required fields, categories and record ownership. Review the resulting records after import; a successful import is not proof that every entry is accurate.

Choose the available export

Use an export offered by the current interface and check the file's scope and contents. This guide does not promise every format for every record type.

Asset Module Connections

Asset records can be linked to risks, approved supplier relationships and assessments through the relevant module controls.

Asset and CIA context can support assessments and risks without replacing their separate review and approval.

Review each link

Check the linked record and the decision it represents. Asset classification provides context; it does not automatically establish compliance or close a risk.

Software and scanners

An eligible asset can supply context for authorised scans and software-based vulnerability work. A registered asset alone is not proof that software is installed or that the asset is vulnerable.

Vulnerability Assurance

Vulnerability Assurance helps you record operated software, review public vulnerability evidence and govern individual findings. Availability depends on the enabled deployment and your permissions.

Record software, match evidence, prioritise and act, then verify each finding before closure.

Start from the Overview

Create or open a software list. Review the recommended next task and the Guided Tasks view. Related work is grouped for navigation, while decisions and governance actions remain individual per CVE.

Review before closure

Confirmed findings can link to Risk, Treatment, time-limited Risk Acceptance and Jira. Verification requires the appropriate evidence and reviewer decision; a closed ticket or a scan with no finding is not an automatic all-clear.

Software Lists and Intake

Start with a software list for products you can identify. Manual entry and general CSV intake support a list without requiring an Asset for every entry.

Optional Asset evidence

For an eligible Asset, review software candidates supplied by a supported SBOM or compatible stored or fresh scan. Confirm product identity and version before treating a candidate as an operated installation.

Preserve uncertainty

Unsupported version formats or uncertain product identity require clarification. Missing public evidence or a scanner non-detection must not be interpreted as proof that the software is safe.

Guided Tasks and CVE Findings

Guided Tasks group related vulnerability work so you can find the next useful action. The technical CVE register and finding history provide additional detail.

Decisions remain individual

Review the software identity, version, source evidence and affected scope for each CVE. A grouped task is not a bulk approval or closure mechanism.

Priority and public severity

The amara Environmental Score is an internal prioritisation aid. It must not be presented as an official CVSS score. Review the explanation and evidence for the current finding.

Remediate, Verify and Close

Choose the appropriate response for a confirmed finding: delivery work, a Risk and Treatment, or a time-limited acceptance where the workflow permits it.

Record the change and evidence

Use your organisation's change process. Record what changed, the affected scope and the evidence supporting the result. A suitable authorised scan can contribute verification evidence.

Make the reviewer decision

Review the individual CVE finding and its evidence before closure. Preserve an open or clarification state when proof is insufficient. Scanner non-detection cannot erase a recorded vulnerable software assignment.

Risk Management

Use Risk Management to identify, assess and track risks and their treatment or acceptance decisions.

Record the risk, assess likelihood and impact, make the responsible decision and track treatment evidence.

Create a reasoned assessment

Describe the risk, link the relevant asset context and record likelihood, impact and evidence using the current workflow.

Track responsibility

Assign and review treatment work through the supported controls. Reports and monitoring views reflect the available records; a completed task still needs the required validation.

Creating a Risk

With the required permission, create a risk record describing the event, its potential impact and the relevant asset context.

Assess and assign

Use the likelihood and impact choices in the current form. Record your reasoning, select a treatment strategy and assign responsibility through the supported workflow.

Review the decision

Follow the approval or acceptance process for the risk. An example score, deadline or job title in a guide does not replace your organisation's decision rules.

Risk Scoring

Risk scores combine likelihood and impact using the application's assessment scale. Review the score and its explanation in the risk record.

Illustrative 4×4 scoring matrix; confirm the scale and decision rules used by the selected workflow.

Severity bands for the illustrative 4×4 scale.

Use evidence and context

Base likelihood and impact on the actual situation. Linked asset information can inform the assessment; it does not remove the assessor's responsibility to justify the result.

Review residual risk

After treatment, review the remaining risk and the evidence for any changed score. Follow the required approval or acceptance workflow.

Risk Treatment Plans

Record how your organisation will respond to a risk: mitigate, transfer, avoid or accept, as appropriate to the available workflow.

Make the plan actionable

Specify responsibility, planned work and the relevant timing and evidence. Update progress through the treatment controls and review any linked Jira status.

Verify completion

A resolved Jira ticket may support a review and progress update. The responsible person still needs to perform the required validation before the linked treatment and risk are considered complete.

Risk Module Connections

Risk records can retain asset context and links to relevant evidence. Assessment findings can inform the creation or review of risks.

Linked evidence supports the risk review; it does not automatically approve, score or close the risk.

Use linked work carefully

Where enabled, Jira and Confluence provide external task or document links. Review the actual linked record and its scope.

Keep decisions explicit

A changed external status does not by itself approve an assessment or prove that a vulnerability has been removed. Follow the relevant risk, treatment and verification controls.

Security and Compliance Assessments

Use the assessment that matches the question you need to answer. The Assessments area contains CIA, Rapid Assessment, ISO 27001, BSI C5 and EU AI Act; NIS2 has a separate workflow.

Each framework requires its own applicability and scope review; shared records do not establish legal compliance.

Reuse relevant evidence while keeping the requirements and conclusions of each review separate.

Record a defined scope

Complete the relevant questions or controls with accurate responses and supporting evidence. Review gaps and remediation options in that module.

Interpret results carefully

An assessment result describes the recorded scope and evidence. It is not a certification or a legal determination, and does not automatically satisfy another framework.

Choose an Assessment

CIA evaluates an asset's protection needs. Rapid Assessment provides an initial security-posture review. ISO 27001, BSI C5 and EU AI Act address their respective assessment scopes.

Define the scope, record responses and evidence, review gaps and inspect the available outputs.

NIS2

Open NIS2 Compliance for its relevance assessment, gap review and remediation workflow.

Work through the selected module

Follow the current form and review the saved responses, gaps and available reports. Question counts, report options and approval steps differ between assessments.

Rapid Assessment

Use Rapid Assessment to establish an initial view of security posture. Select the relevant domains and answer the questions shown by the application.

Record the active scope and evidence before interpreting the assessment result.

Review your responses

Provide accurate answers and retain supporting information. The resulting score and gap analysis reflect the selected scope and recorded responses.

Choose the next action

Review recommendations and decide which issues need further assessment or risk treatment. Completion time depends on the scope and evidence available.

Scoring and outputs depend on the selected assessment and its recorded responses.

Illustrative maturity language; inspect the actual assessment scale and evidence.

ISO 27001 Assessment

Use the ISO 27001 assessment workflow to record control responses, evidence and applicability for your intended ISMS scope.

Work through the controls

Enter organisation information, select the scope and record each relevant response. Review gaps and remediation work rather than treating an unanswered control as a verified conclusion.

Prepare the Statement of Applicability

Generate and review the SoA from the recorded assessment. Confirm applicability, exclusion reasons and evidence with the responsible ISMS owner. The assessment itself does not award certification.

EU AI Act Assessment

Use this assessment to evaluate your organisation's AI systems against Regulation (EU) 2024/1689. It turns AI governance, risk, transparency and human-oversight obligations into a scoped evidence and remediation workflow.

Start with the AI context

Create an assessment and state your organisation's role (provider, deployer, importer, distributor or a combination), the relevant AI-system types, deployment region and use sectors. This context keeps the assessment focused on obligations that apply to the systems you actually operate.

Work through the applicable domains

NIS2 Compliance

The NIS2 module supports a relevance assessment, gap analysis and remediation planning.

Assess relevance, record the scoped responses and plan owned follow-up actions; the result remains subject to review.

Start with accurate information

Complete the organisation and sector inputs required by the relevance workflow. Review the classification and its reasoning against the requirements applicable to your organisation.

Assess and remediate

Record the current implementation and evidence in the assessment. Review identified gaps and the available remediation actions. The score reflects the recorded assessment; it is not a legal determination of compliance.

BSI C5 Assessment

Use the C5 assessment to review cloud-security criteria for the selected service scope.

The module supports a scoped cloud-service assessment; it is not an independent C5 attestation.

Record responses and evidence

Select the relevant domains and complete the current assessment. Review each criterion and supporting evidence; do not assume an ISO assessment has completed the C5 work for you.

Review the result

Use the available gap and report views to plan further work. An application-generated report is not an independent C5 attestation.

Statement of Applicability

The SoA records the applicability of controls for the selected ISO 27001 assessment.

Prepare the underlying assessment

Complete the relevant responses and document the reasons for exclusions. Check that the evidence reflects the organisation's actual implementation.

Generate and review

Use the available SoA control, then review the resulting document for completeness and accuracy with the responsible owner. Maintain it when the scope or implementation changes.

Supplier Management

Maintain supplier information, assess the relationship and record the approval decision.

Record the relationship, assess its evidence and dependencies, and document the responsible approval.

Start with a verified profile

Record the actual services, access and relevant evidence. Follow the fields and review steps in the current supplier workflow.

Use approved links

Review the supplier's status before linking it to an asset. Maintain the relationship and its evidence as circumstances change; a recorded approval is not a compliance guarantee.

Adding a Supplier

Open Supplier Management and use its creation control. Enter accurate information about the supplier and the services involved.

Complete the required fields

Record the relevant contacts, data handling, access and supporting security information requested by the form. Follow any validation messages.

Review and approve

Use the supplier review workflow to assess the relationship and record the responsible decision. Confirm the saved profile and status before creating related asset links.

Supplier Criticality

Use the supplier assessment to record the relationship, access, data and dependency information relevant to your organisation.

Assess the actual relationship

Evaluate the factors shown in the current form using evidence about the supplier. Do not infer a universal review timetable from an example score.

Review the decision

The supplier approval process records the responsible decision. Reassess when the relationship, services or evidence change.

Supplier Lifecycle

Keep the supplier profile, evidence and approval status current throughout the relationship.

Review changes

Check service scope, access, contacts and relevant security information according to your organisation's review process. Use the current controls to record the review.

End the relationship responsibly

Review linked assets and outstanding work before decommissioning. Confirm that access and data-handling obligations have been addressed outside the application as required.

Supplier Approval

Use the supplier workflow to record the information, assessment and approval needed for the relationship.

Approval follows recorded supplier information, security review and a reasoned owner decision.

Review before approving

Check the supplier profile and evidence. The responsible approver should record a reasoned decision rather than treating the existence of a supplier record as approval.

Link approved relationships

Use the available asset-link controls and follow the validation shown by the application. An approved record supports evidence; it does not itself establish regulatory compliance.

Supplier Module Connections

Supplier records can link to the assets they support and retain the approval history for the relationship.

Use the evidence

Review relevant supplier information when assessing risk or compliance. Confirm the scope and currency of each supporting document.

Supported queries

Ask amara can retrieve supported supplier information when your role permits it. Review the source rather than assuming every natural-language query is available.

Document Dialog

Document Dialog helps you prepare ISMS documents from templates and organisation information.

Templates produce drafts for organisation-specific review, versioning and responsible approval.

Create and review a draft

Select a template, complete its form and generate a document. Review the content and adapt it to your organisation before using it as policy.

Maintain the record

Use the editor, version history and available export controls. Configured Jira or Confluence actions are separate external actions and require the applicable permissions.

Document Templates

Browse the current Document Dialog catalogue to find a template that fits your purpose.

Choose by scope

Review the template description and fields. Select what you need for the actual process or policy; a template title is not proof that every requirement is covered.

Adapt and review

Complete the form with accurate information and review the generated draft. The available catalogue is the application view, not a fixed count promised by this guide.

Generating a Document

Open Document Dialog and select a suitable template. Complete the fields shown in the form using accurate organisation information.

Select a suitable template, create the draft, review the content and record the final decision.

Review the generated draft

Check populated fields, missing information and the meaning of each section. Edit the document to reflect your actual processes.

Keep the right evidence

Review the saved version and use the available history or export controls. Publication to a configured external service is a separate action.

Document Version History

Document Dialog provides version history and comparison views for saved documents.

Compare changes

Open the document's version controls and select the versions you want to compare. Review the actual content changes and the available author and timestamp information.

Retention

Confirm your deployment's retention and backup policy with the responsible operator. Version history is not a guarantee against every form of data loss.

Information Security Policy

The ISP area provides a structured policy reference with sections, subsections and search.

Find relevant content

Browse the table of contents or use the policy search to locate a topic. Read the relevant section in context before relying on it.

Related work

Where enabled, create a reviewed Jira task or link an existing Confluence page from a policy section. Use Document Dialog when preparing a separate organisation-specific document.

Reviewing Documents

Keep policy documents aligned with the organisation's current processes and responsibilities.

Plan the review

Agree a review owner and schedule through your organisation's document-control process. Check the current document and its available history.

Record the outcome

Update and save the relevant changes, then follow your organisation's approval process. Confirm any notification or automation capability in the actual deployment.

Document Dialog Workflow

Choose a template, complete the form and generate a draft. Use the editor to refine it and the version views to inspect changes.

Export the document

Use the export controls available for the document or selected version. Review the exported content before distributing it.

Optional Confluence publication

When the integration and permissions allow it, review the target and content before publishing. Check the resulting Confluence link and page; an external update is a separate action from saving locally.

Training

Training provides role-based security learning through knowledge cards, quizzes and completion records.

Training content is assigned by role and produces completion evidence for review.

Complete the assigned curriculum and required quizzes before the certificate is issued.

Learn and complete the course

Open an assigned course, read and complete its cards, then take the quizzes. The normal passing threshold is 80%; follow the criteria shown for the quiz.

Certificate and review

A certificate is issued after all required cards and quizzes are completed. Training records support evidence of learning; they do not automatically determine compliance with a regulation.

Training Courses

The training catalogue groups roles into specialist, executive and functional learning areas. Open the current catalogue or your assigned courses to see what is available.

Match the role to the responsibility

A learner may have more than one training role. Administrators assign the roles appropriate to the person's actual work.

Complete the curriculum

Work through the knowledge cards and quizzes shown for the course. Review the completion requirements and resulting certificate; course completion is evidence of training, not a legal compliance verdict.

Knowledge Cards and Quizzes

Each training role has a curriculum of knowledge cards and quizzes. Work through the cards and use the course controls to record completion.

Take the quizzes

Read each question and select the appropriate answer or answers. The normal pass threshold is 80%; check the criteria and feedback shown in the current quiz.

Complete the curriculum

Certificate issuance requires the required cards to be completed and every quiz to be passed. Review any remaining work on the course overview.

Training Certificates

After the required cards and quizzes are completed, Training issues a course certificate with a verification hash and validity dates.

Review and retain

Open the certificate to check the name, course and completion information. The certificate has a print-friendly view; use the browser's print controls when you need a PDF.

Understand the evidence

A verification hash is not an unforgeability guarantee or an independent certification. The record supports training evidence. Review the renewal action carefully because it restarts the course's progress.

Training Administration

Training administrators assign roles and review per-user and per-role progress.

Review completion

Use the training dashboard to identify completed and outstanding work and inspect the relevant course or certificate record.

Export evidence

Use the available CSV or HTML reports and review their scope before sharing. Training completion does not automatically update every external compliance assessment.

Ask amara -- Your GRC Co-pilot

Instead of navigating dashboards and exporting reports, ask a question such as "What are my top risks?" or "Which suppliers access critical systems?" Ask amara routes supported requests to governed data, documentation and configured integrations. Always review important output before acting on it.

How to use Ask amara

Click Ask amara under Resources in the left sidebar. You'll see a clean chat interface with the greeting "Hello! I'm amara -- How can I help you today?" At the bottom, there's an input box labelled "Message amara..." with a send button. Type your question in natural language (English or German) and press Enter or click the arrow.

Review important answers against their cited sources before making decisions. Generated analysis can contain errors.

Try these queries right now

Here are real queries you can try, ordered from simple to complex:

Why Ask amara is different from a general-purpose chat tool

For a supported data request, Ask amara uses the records available to your role. For policy questions, it can retrieve approved documentation rather than relying on an unsourced public-web answer. Responses must remain reviewable; they are not an automatic decision or approval.

How the AI decides what to do with your question

Ask amara selects an appropriate governed route for supported questions:

Query pipeline: Compliance Gate → Smart Router → Privacy Shield → governed processing → Audit

Full architecture: configured integrations → amara GRC → Ask amara controls → governed processing → approved external clients

What you can ask

Query Routing

Ask amara does not treat every message as an open-ended request. It first applies the available product, role, safety and privacy controls, then selects a supported data, document, analysis or configured external route.

Data route → document retrieval → local intelligence → configured external route

Supported routes

Availability, response time and cost depend on the active deployment, role and configured route. The interface indicates when a supported route cannot be used.

How the router decides: a behind-the-scenes look

The Smart Router classifies a request before selecting a route. It uses defined product controls and does not grant additional data access because of a natural-language instruction.

Tier 1 decision: "Can I answer this from the database?"

For supported requests such as counts, lists and status, the router uses a defined data capability. It does not create arbitrary database queries, and the result remains limited by the caller's role and the available records.

Example: "How many critical assets do we have?" can route to the relevant governed data capability when it is available to your role.

Tier 2 decision: "Is this about policy content?"

For supported policy requests, the router can use available approved documentation. The result should identify or link to its relevant source where possible; always review the underlying policy for a decision.

Example: "What does our access control policy say about remote work?" can return relevant approved documentation that you can review in context.

Tier 3 decision: "This needs reasoning"

Where enabled, the local intelligence route can help with analysis, drafting, comparison and structured work. Its output is a draft or supporting explanation, not a replacement for the responsible owner or required approvals.

Example: "Draft a risk treatment plan for our unpatched server vulnerability" can create a starting point that the Risk Owner must review and approve.

Configured external route

An external route is available only where an administrator has configured and approved it. Its use is subject to the deployment's privacy, egress, consent and audit controls. Do not assume an external route is enabled or suitable for sensitive data.

How to write better queries

The routing system is designed to work with natural language, but a few tips help you get faster, better answers:

• For data questions, be specific: "How many active hardware assets do we have?" is easier to route than "Tell me about our hardware."
• For policy questions, name the document: "What does our Access Control Policy say about remote work?" helps identify the material you need to review.
• For analysis, give context: Explain the decision, scope and time period, then review the draft and its sources.

Supported Ask amara Questions

Ask amara provides defined capabilities for authorised data and product information. The supported questions depend on the current implementation and your role.

Start with a specific request

For example, ask for an asset count or the highest recorded risks. Check the source and scope of the answer, and use the relevant module to verify important records.

When a request is unavailable

An unsupported query should remain unavailable or request clarification. Do not treat generated text as evidence that a data export or external action was performed.

Privacy Shield & Data Sovereignty

For organisations with sensitive information, data handling must follow the active deployment, configured integrations and approved governance controls. amara supports local processing and controlled integrations, but neither is a substitute for your organisation's own data-protection review.

What does "data sovereignty" actually mean here?

Data sovereignty depends on the chosen deployment and configuration. Local processing can keep defined workloads within your environment; configured integrations and optional external routes have their own egress and access boundary. Review the relevant integration documentation, deployment settings and audit evidence before enabling or using them.

4 classification tiers: Public → Internal → Confidential → Restricted (each with ISO controls mapped)

What "Privacy Shield" means

1. Deployment boundary: Local processing is governed by your chosen environment and access controls.
2. Protected data handling: Use only approved routes for personal or sensitive material, following the applicable policy and configuration.
3. Configured external routes: Treat every enabled connector or external route as a separate data-flow decision.
4. Audit evidence: Use the available audit trail and source information to review governed actions.

Privacy and legal review

amara does not determine your legal obligations. Whether you need a data-processing agreement, impact assessment, transfer assessment or other control depends on your deployment, enabled services, data categories and jurisdiction. Obtain the appropriate legal and privacy review.

Air-gapped deployment

An air-gapped deployment is a deliberate operational design. Its feasibility and maintenance requirements depend on the selected environment, update process and integrations. Do not enable a networked connector in an environment intended to remain isolated.

Ask amara processing options

Ask amara may offer local and externally configured processing routes, depending on the deployment and administrator settings. This page explains the governance distinction; it does not promise that a particular route is enabled or appropriate for every request.

Choose the route deliberately

Local processing may be appropriate where your environment and operating model require it. It still needs normal access control, patching, logging and operational governance.

Configured external processing is optional and available only when your administrator enables it. Before using it, assess the destination, contractual and privacy controls, the data involved and the purpose of the request.

The practical advice: use the smallest approved route that meets the business need, and keep a human owner responsible for any decision, document or treatment plan.

Comparison

Integration Queries — Prefix Syntax

Ask amara can reach configured external systems as well as authorised local data. Each connector uses a strict prefix — type the prefix, then your question in natural language. The connector must be enabled and your role must permit the request.

Configured connector prefixes

Jira Examples

Confluence Examples

Security Scanner via Ask amara

Azure Examples

Tips for Better Results

• Be specific. jira: show high-priority open tickets in PROJECT is clearer than jira: tickets.
• Use the documented prefix for the intended connector and check the source shown in the response.
• Check the bell icon. If an integration is offline, the health indicator in Admin Panel → Integrations will show red. Ask amara will return an error message instead of results.
• Keep context explicit. State the relevant Risk or Asset record in a follow-up. Available context handling depends on the active route and session controls.

Reports and Evidence

Open the module relevant to your question and use its available report or export controls.

Reporting and export coverage varies by module; review completeness and permissions before sharing.

Choose a useful scope

Risk, assessment, training and scanner reports serve different purposes. Check the selected records, time period and the meaning of any score.

Review before sharing

Confirm completeness and the recipient's needs. This guide does not promise a separate universal reporting hub, a fixed report catalogue or automatic distribution.

Choosing a Report

Use the report available in the module whose evidence you need.

Examples

An ISO assessment can provide SoA and gap information; Training provides progress evidence; Security Scanning provides scan and asset reports. The available formats differ.

Inspect the output

Review the data scope, missing information and conclusions before using the output for management or audit work.

Preparing Audit Evidence

Agree the required evidence with the responsible reviewer, then collect the relevant module records and available exports.

Check completeness

Review assessment responses, risk decisions, policy versions and training or supplier evidence as applicable to the scope.

Share deliberately

Confirm permissions and sensitive-data handling before sharing. No automatically complete cross-module ZIP package is promised by this guide.

Charts and Visualisations

Module dashboards and reports use charts to summarise the records in their scope.

Read the labels

Check what the chart counts, which time period it covers and whether missing or unassessed records are represented separately.

Use available controls

Follow links or export controls offered by the current chart or report. Do not assume every chart supports the same interactions or file formats.

Exporting Information

Use the export or print control available in the relevant module. Formats and included fields vary.

Check the result

Open the exported file and verify its scope, labels and completeness before sharing.

Recurring distribution

Agree any recurring export or email process separately with the responsible operator. This guide does not describe an installed universal scheduling service.

Admin Panel

Administrators manage users, roles and the settings available in the current deployment. Configured integration pages provide activity and connection information.

Infrastructure, service versions and hardening depend on the selected deployment and its approved operating procedures.

Control access

Assign only the roles required for each person and verify the resulting access. Review changes when responsibilities change.

Operating procedures

Use the approved operator documentation for backups, recovery, infrastructure and service configuration. The presence of an Admin Panel does not imply that every operating task has an application wizard.

Role and Access Reference

The current Admin Panel exposes 18 role controls: Admin, Read Only, Asset Management, Supplier Due Diligence, NIS2 Compliance, General Assessments, Rapid Assessment, ISO 27001, CIA, BSI C5, EU AI Act, Training, Training Admin, Risk Assessment, Document Dialog, Integrations, Security Scanning and Vulnerability Assurance IT Owner.

Assessment, Vulnerability Assurance and scanner access

General Assessments can grant access across CIA, Rapid Assessment, ISO 27001, BSI C5 and EU AI Act; dedicated controls remain available for those areas. NIS2 Compliance, Vulnerability Assurance IT Owner and Security Scanning each use dedicated controls. Administrator access and other module or record checks still apply.

Read-only is a restriction

Read Only restricts changes and does not grant universal viewing access. Combine it with the relevant module permissions and verify the visible result. A demo may have specifically scoped exceptions.

Organisation Settings

Use accurate organisation information in the fields offered by your deployment.

Review dependent work

Organisation information can support assessment inputs and document forms. Review generated output after a change rather than assuming every existing document has updated.

Contact the operator when needed

Infrastructure, email and provider configuration may follow separate operating procedures. Ask the responsible administrator about capabilities not shown in the current interface.

Audit Trail

Use the available activity and audit records to review recorded actions.

Inspect the evidence

Check the actor, time, record and action information present in the selected view. A missing entry needs investigation rather than an assumption that no action occurred.

Coverage and retention

Confirm the actual logging coverage, access and retention rules for the deployment. This guide does not promise that every field change or external event is captured.

Backup and Recovery

Backups and restoration follow the operating procedure approved for your deployment.

Before a change

Confirm the scope and currency of the recovery point, its integrity and the agreed restore procedure with the responsible operator.

Recovery

Use the approved recovery process and verify restored data before returning to service. This guide does not promise an Admin Panel restore wizard, fixed schedule, encryption method or retention period.

Multi-Factor Authentication

MFA adds a time-based verification code to password authentication. Use the account's MFA setup controls when available or required by the deployment.

Set up carefully

Follow the visible setup steps with a compatible authenticator. Keep any recovery codes in an approved secure location and never share the setup secret.

Lost access

Use a permitted recovery code or contact the responsible administrator through the approved account-recovery process. Lockout and enforcement settings depend on the active implementation.

Bell Notifications & Activity Feed

The bell icon in the top navigation bar is your integration activity feed. It can surface events from Jira, Confluence, Azure and Security Scanning — such as ticket status changes, scan completion and treatment-validation prompts — when those connections are enabled.

Where to find it

The bell icon () appears in the top navigation bar, next to your user menu. It is visible when at least one supported integration is enabled. A red badge shows the count of unread events. Click the bell to open a dropdown with recent activity.

What triggers a notification

The Activity Feed

Click "View all activity" in the bell dropdown to open the full Integration Activity page. It is paginated and filterable by source platform and action type.

Each event shows:

• Source — which platform (Jira, Confluence, Security Scanning or Azure)
• Reference — the ticket ID, page title, or scan target
• Type — mention, status_change, scan_complete, validation
• Action taken — what amara did in response (created risk, progressed treatment, etc.)
• Timestamp — when the event was processed

Clearing Notifications

Notifications are marked as read when you view them. Treatment validation notifications clear automatically when you approve the treatment via Risk Management → Treatment Plans. Bulk clear happens during treatment validation — all related chain references are updated in a single operation.

Troubleshooting

Start by recording what you expected, the visible result and the module or record involved.

Check access and configuration

Missing controls may reflect role permissions, disabled features or an unavailable integration. Ask the responsible administrator to check the current configuration.

Preserve evidence

For a failed query, export or workflow, retain the relevant error and source context. Use the approved support process and avoid changing production configuration based on a generic help example.

External Integrations

Enabled integrations connect selected AMARA workflows with Jira, Confluence, scanner services and cloud evidence. Each has its own permissions, data flow and update behaviour.

Review external actions

Confirm the target and scope before creating or updating an external record. Check the returned link or status after the action.

Keep evidence and decisions separate

An external status update supports review. It does not automatically approve an assessment, prove remediation or close a Vulnerability Assurance finding.

Jira — Tickets & Loop-Back

Eligible module records can offer a reviewed Jira action when the connector is enabled. Confirm the target and content, then inspect the resulting link. Linked status updates support review; they do not by themselves close the underlying work.

Which Modules Can Create Tickets

Enabled Jira routes use a consistent flow: one click opens a pre-filled ticket form, you confirm, and the ticket lands in your configured Jira project with amara context attached (module, record ID, description, severity).

The Loop-Back Cycle

Jira, Risk and Treatment boundary

For an actionable scanner finding, a user may create a direct Risk or confirm a Jira action. The Jira-from-finding path can create or reuse linked governance records according to the configured workflow. A direct Risk remains its own record unless deliberately linked later.

Linked-work review

When a configured connector reports linked work, use the relevant Risk, Jira and Treatment records to review the evidence. A ticket status or scanner result supports review; it does not automatically close Vulnerability Assurance or replace the responsible approver.

@amara Mentions in Jira

Where configured, a Jira loop-back can surface relevant linked activity as an in-app notification. The available information and timing depend on the connector configuration and permissions.

Confluence — Publish & Link

Document Dialog can publish to configured Confluence spaces, while supported modules can link existing pages. Check the selected target and resulting page after each action.

Who Can Publish vs. Link

How Document Dialog Publishes

@amara Mentions in Confluence

Where configured, Confluence activity can be surfaced as an in-app notification. The available information and timing depend on the connector configuration and permissions.

Security Scanner Cycle

The Security Scanner runs authorised checks against registered Assets and returns durable technical evidence: service and version observations, curated CVE checks, web/TLS checks and passive discovery where applicable. Findings can feed Risk and Jira work; software observations can support Vulnerability Assurance without automatically closing it.

Prerequisites

Choose the right scan

Each scan answers a different question. Choose the narrowest authorised check that gives the evidence you need; a completed result records the selected type and preset so reviewers can see what was actually tested.

Nuclei and Vulnerability Assurance

For a VA-managed Asset, Nuclei separates two evidence lanes: exact active-CVE templates that are installed and software-aware supporting templates derived from recorded software. Direct templates can test named CVEs; supporting checks can help confirm exposed software or services. Neither lane clears a CVE merely because it returns no finding.

For scanner-led VA intake, choose a compatible scan offered by the current workflow. Review product and version candidates before confirming them. A later non-detection does not delete recorded software or close an individual finding.

The Full Scan Cycle

How Security Scanning supports Vulnerability Assurance

Structured product/version observations from authorised scanner-led VA discovery become source-backed software inventory for the registered Asset and can start matching. After a patch or mitigation, a suitable authorised re-scan can provide fresh technical evidence for a VA reviewer.

Azure Integration

Configured Azure access can retrieve permitted identity or infrastructure evidence. Requests use the credentials and permissions approved for that deployment.

Review available evidence

Use the supported Ask amara Azure query or Azure Sync controls, as applicable to the information you need. Check the source scope and timestamp.

Asset import

Where offered, import a reviewed infrastructure record as an Asset. Confirm the resulting details and any address needed for authorised scanning. Cloud inventory alone does not establish installed software or a vulnerability.

AWS Sync — Read-only cloud evidence

AWS Sync is an optional Admin Panel integration. It reads approved evidence from your AWS account, stores a timestamped local snapshot for review, and does not change AWS resources.

What an explicit sync retrieves

AWS → Asset → VA workflow