Ergonic Labs takes the chasing, booking and paperwork off your assessors, inside your own systems, so the same team gets through more paid assessment work.
Everything runs from your own mailbox and calendar. Your assessors keep working where they work today.
Each user gets one email from your address asking for everything at once. We email the quiet ones again and copy in their IT contact. You see who is outstanding on one list.
Applicants pick slots straight from your assessor's real calendar. The briefing goes with the invite. No-shows are rebooked without anyone chasing.
A readiness scan runs before the first CE Plus scan, so the applicant fixes what would fail. Applicants install your scanner's agent as they do for CE Plus today. We send that request, watch for the agents to report, book the slot and schedule the scan. You sell it and keep the revenue. Your assessor approves each scan. The CE Plus sample is drawn only after the readiness scan is passed.
| Scheme | Evidence collection | Assessment-day booking | Readiness scan |
|---|---|---|---|
| Cyber Essentials | Yes | Not needed | Not needed |
| Cyber Essentials Plus | Yes | Yes | Yes |
| IASME Cyber Assurance | Yes | Yes | Not offered |
| ISO 27001 | Evidence requests and reminders | Audit-day booking | Not offered |
Cyber Essentials Plus is where we start with every body. Other schemes follow once it is running.
No Ergonic Labs software to install. We connect to your existing Microsoft 365 and scanner: your SharePoint, a mailbox you nominate, your assessors' calendars and the scanner's API. Set up with your IT admin.
The spreadsheet you keep today, as a SharePoint list with a few columns added. Requests, reminders and bookings run from it on a schedule.
What needs you today, and what is being chased for you. Reply to any line to take it over. We monitor it and keep it running for a monthly fee.
You certify other people's security. Here is exactly what the service touches.
An app registration in your Entra ID with four scopes: read and write to one SharePoint site you create for it, send mail as one shared mailbox you nominate, read and write the calendars of the assessors who opt in, and an API key for your scanner limited to scheduling scans and reading results.
No global admin. No access to other sites, other mailboxes, or user devices.
In your tenant. Screenshots arrive in your shared mailbox and are filed in your SharePoint site. Scan results stay in your scanner. Reports stay in your SharePoint. Ergonic Labs never moves or deletes any of them.
Two things leave your tenant. First, a copy of each evidence screenshot is sent over an encrypted API call to a language-model provider, which returns the device facts to write into your list. The provider does not use it to train models. By default it holds the copy for up to 30 days for abuse monitoring and then deletes it. A zero-retention arrangement is available on request.
Second, coordination data is sent to a small service Ergonic Labs runs, so reminders go out on schedule when nobody is logged in.
Coordination data only: applicant and user names, device names, which items are outstanding, which slots are booked, each applicant's stage, the dates, and the device facts extracted from screenshots until they are written to your list. No screenshots, scan results or reports. This data is deleted 30 days after an engagement closes, or immediately if you switch the service off.
Delete the app registration in Entra and rotate the scanner key. Everything stops within the hour and Ergonic Labs' copy of the coordination data is deleted. The SharePoint list, the evidence and the calendar bookings are yours and stay exactly where they are.
Nobody logs into anything of ours. Your assessors work in Outlook, SharePoint and their calendar. Applicants get emails and a shared link, not an account.
We use language models to read screenshots into list rows and to sort replies. Your assessor checks every fact, makes every judgement and signs every report.
Your process, your records, your scope. Only the fetching and chasing change hands.
A call with your tracker on screen. We map where one engagement's time goes and show you the list and the morning digest on data shaped like yours.
You receive: a one-page review of what we would automate first, what we would not, and whether this fits your practice.
A written proposal for a pilot: which clients and schemes it covers, what is included, what will be measured, the timeline and a fixed price.
You receive: the proposal, and a simple financial model built from your own volumes and prices showing what a change in throughput is worth to you.
Two weeks measuring one live engagement as it runs today, then four weeks with evidence collection and booking switched on for one client, your old process kept as the fallback.
You receive: a baseline report, then pilot results against it: requests sent and repeated, days spent waiting, and assessor time on coordination. The pilot ends unless you choose to continue.
Every engagement, plus readiness scans and renewals. We monitor it and keep it running. Your evidence, list and bookings live in your own tenant, so there is nothing to hand back if you ever stop.
You receive: a monthly report of engagements run, evidence collected, scans scheduled and renewals booked.
The button opens an email to us with a short template. Tell us your body's name and roughly how many assessments you run a month, and we will reply with times within one working day.