Concepts

This document describes the core concepts and components of Clearly AI.

---

What is Clearly AI?

Clearly AI is an enterprise SaaS for security teams who need to complete security (and related) reviews faster.

The problem: Security teams at enterprises spend significant time gathering scattered information—design docs, code, tickets, wikis—and performing repetitive baseline security reviews across many systems.

The solution: Clearly AI helps by gathering that information faster (via Integrations and uploads) and generating structured assessments with AI. You bring the context (Projects, Knowledge Base, Integrations); Clearly AI runs Review Templates against that context and produces answers with citations and, where applicable, compliance status.

Intended audience: Security engineers, compliance analysts, and risk owners at mid-size to large organizations who run threat models, control assessments, privacy impact assessments, or similar reviews. Clearly AI acts as a force multiplier: it handles triage and data gathering so experts can focus on judgment and high-risk items.

What Clearly AI is built for:

1. Triage – Check many systems for baseline controls, flag what needs human attention, and approve low-risk systems quickly.
2. Deep analysis – For complex systems, synthesize context and produce thorough security analysis that would take hours to gather manually.

The sections below describe the main components you use to do this: Projects, Reviews, Review Templates, Knowledge Base, Chat, Integrations, and Workflows.

---

Projects

Projects are context containers for a system or application you want to review. Each Project groups:

• Design and reference documents (uploaded files or linked integrations)
• Source code (via connected repos such as GitHub or Azure DevOps)
• Integrations (issue trackers, document sources, etc.)

A Project has a name, description, owner, and a review stage (e.g., Draft, In Review, Approved, Needs Revision). Projects are versioned: when you change files, integrations, or metadata, a new Project version is created. Reviews always run against a specific Project version so results stay consistent and auditable.

---

Reviews

Reviews are point-in-time security (or compliance) assessments. You create a Review by:

1. Choosing a Review Template
2. Running it against a Project (and thus a specific Project version)

Clearly AI uses your project’s documents, code, and integrations as context and generates structured answers—often with citations and compliance status. You can edit answers, add feedback, and regenerate individual answers. Reviews help with both triage (baseline checks across many systems) and deep analysis (thorough assessment of complex systems).

---

Review templates

Review Templates define the questions and structure of a Review (e.g., STRIDE, OWASP, privacy impact, or custom frameworks). Each Review Template has one or more blocks (e.g., freeform, single/multi-select, table generation). Review Templates can be org-specific and versioned so you can track which definition was used for each Review.

---

Knowledge Base

The Knowledge Base is your organization’s shared context that informs all analysis—Reviews and Chat. It typically includes:

• Files – Policies, standards, runbooks, and other reference documents (with optional categories and trust levels)
• Snippets – Short reusable text (e.g., standard statements, boilerplate)
• FAQs – Question-and-answer pairs that the system can use when answering Review or Chat questions

Content in the Knowledge Base is searchable and is used to ground LLM answers so they align with your policies and past decisions.

---

Chat

Chat is an ad-hoc Q&A interface. You can ask security or compliance questions and get answers that use:

• Your Knowledge Base
• One or more Projects (and their documents and Reviews)
• Optional focus on a specific Project, Review, or even a single Review block

Chat is available in the web app and (where configured) in Slack. It is meant for quick questions without creating a full Review.

---

Integrations

Integrations connect Clearly AI to external systems so Project context and automation can use live data. Types include:

• Source code – e.g., GitHub, Azure DevOps, Bitbucket
• Issue trackers – e.g., Jira, Linear
• Documents / knowledge – e.g., Google Drive, SharePoint, Confluence
• Messaging – e.g., Slack, Microsoft Teams
• Other – e.g., ServiceNow (tickets and knowledge)

Integrations can be attached to Projects (as integration sources) to pull in repos, tickets, or documents. They can also power Workflows (e.g., opening tickets, posting to Slack).

---

Workflows

Workflows are automated processes that perform multi-step actions, such as:

• Refreshing or syncing data (e.g., re-pulling from integrations)
• Creating or updating tickets in issue trackers
• Notifying channels or users
• Triggering follow-up steps based on Review or findings

Workflows are configured per Organization and can be triggered by events or schedules.

---

Organization and Access

Data in Clearly AI is scoped by Organization (tenant). Users belong to one or more Organizations. Projects, Reviews, Review Templates, Knowledge Base content, and Integrations are all org-scoped. Access control and permissions (e.g., who can create Projects, run Reviews, or change settings) are currently enforced at the Organization level.

---

Summary