Scope and limits

What Loric does

Loric helps engineers design systems against regulatory and assurance requirements before those systems exist. It answers questions with clause citations, shows design patterns that address specific controls, and states where a design has been challenged in real assessments.

It works on engineering artefacts only: architectures, configurations, pipelines, product design.

What Loric does not do

Loric is not a certification body and cannot certify anything. It is not an ISMS tool and it is not a consultancy.

It does not produce management system documentation. No Statement of Applicability, no policies, no procedures, no formal risk register. If you ask for one, it will decline and say why.

It does not state that a design is compliant, sufficient, certification-ready, or that it will pass. Where a requirement is engaged, the phrasing is that a design addresses a control and an assessor will look for particular evidence.

Grounding and error

Answers are grounded in the pattern library and ingested framework text. Where a claim cannot be tied to a retrievable source, the system says so rather than asserting it.

Reference answers in the archive are written by Loric to establish the library and are labelled as such. Only answers generated in response to a real user question carry a publication date.

Regulatory text changes and dates move. Verify anything you plan around against the current official text. A confident wrong answer about a control requirement is worse than no answer, because you will build on it.

Affiliation

Loric is under common founder ownership with a separate compliance-scoring business. We disclose that rather than leave it to be discovered.

No customer data passes between the two businesses in either direction, in any form, including aggregated. They run as separate entities on separate infrastructure, with separate payment processing, support and sending domains, analytics and error tracking, and separate privacy policies that record this barrier as a commitment rather than an intention.

Loric neither influences nor benefits from any score the affiliated business produces. Neither business promotes, lists or references the other as a customer or partner, and they share no blog, newsletter or social account.

Record of what you were told

Every AI interaction is logged with its surface, model and timestamp. You can see what the system told you and when.

Questions the system cannot ground in a retrievable source are recorded separately as gaps in the corpus, so they become work rather than silence.

Data residency

Application data is held in the EU and UK. Loric shares no branding, login, data or cross-links with any other product operated by its founder, and runs on separate infrastructure with its own privacy policy.