Operations · compliance · artificial intelligence
Operate while you comply
Consultancies deliver documents; the Agency audits operations. Manage your assets, projects, people, suppliers, risks, incidents, plans, activities and AI agents inside the platform, and the evidence is issued on its own, traceable down to the article the law requires.
The real problem
Nobody fails to comply on purpose. The problem is being unable to prove it.
Your organisation already backs up data, controls access, requests consent and assesses suppliers. What it does not have is the dated, attributable and traceable record of those operations — which is exactly what gets asked for when the regulator arrives.
Today
Compliance lives outside operations
The organisation works in its systems and, separately, someone transcribes what happened into a document manager so there is something to show with. The report is out of date the day it is born.
With BRAINLOF
Multiple high-use functions integrated: operations happen inside and the evidence is issued in the same act. There is no transcription left to fall behind.
Today
Every standard is a separate project
ISO 27001 on one side, Law 21.719 on another, quality and occupational safety in different folders. The same controls get built three times.
With BRAINLOF
A single framework-agnostic engine cross-references the frameworks and sets your baseline. One control, once assessed, answers to every standard that requires it.
Today
There are not enough specialists
Chile has an estimated shortfall of 28,000 cybersecurity professionals. There are not enough people to do this work by hand, at any price.
With BRAINLOF
AI brings in the framework with its controls, documents and activities, and guides you step by step. What used to require a specialist becomes something your own team can run.
Today
Data subjects have no way to exercise their rights
A RoPA, consent management and an ARCO channel are mandatory for every organisation that processes personal data, whatever its size. Almost nobody has them up and running.
With BRAINLOF
An ARCO portal, consent management and a living RoPA fed by your own operations. Always included, never behind a higher plan.
Today
Holding companies, networks and trade associations cannot govern their members
A holding company cannot see the state of its subsidiaries; a trade association can recommend but cannot hand over a tool; a health network repeats the same work at every site.
With BRAINLOF
Genuine multi-organisation: each subsidiary with its own brand, its own data and its own encryption key; the parent consolidates without seeing what is not its business.
Today
Your sector's regulations are not in any software
Accreditation from the Superintendencia de Salud, CMF regulations, DS 132, CNA accreditation: no international suite models them, and translating them by hand takes months.
With BRAINLOF
Chilean sector frameworks preconfigured, maintained and updated when the regulation changes. No new project required.
This is how it looks inside
An operating platform, not just a documentary one
Take a look at some views of the platform running on a demonstration institution. The data is fictitious; the structure and the behaviour are the real ones.
The reading that matters is not where the risk is, but how much it moved. If the two matrices look the same, the controls are not doing their job. Each cell opens the risks that make it up, with their owner and their process.
Inherent risk · 23
Impact 1 → 5 · likelihood on the vertical axis
Residual risk · the same 23
After the treatment applied
The clock runs from the record, not from the meeting. Every incident carries its severity, phase, responsible lead and the notification deadline the regulation requires — with the due date in plain sight.
| Code | Incident | Severity | Phase | Lead | Next deadline |
|---|---|---|---|---|---|
| INC-2026-001 | Ransomware on file server | S1 Critical | Phase 3 | Cybersecurity officer | Due in 1 h 40 |
| INC-2026-002 | Phishing targeting internal accounts | S2 High | Phase 2 | Cybersecurity officer | Due in 6 h |
| INC-2026-003 | Spreadsheet exposed in a shared folder | S1 Critical | Phase 4 | Data protection officer | Notified |
| INC-2026-006 | Loss of a device holding personal data | S2 High | Phase 2 | Data protection officer | Under assessment |
| INC-2026-008 | Malware on a laboratory computer | S4 Low | Phase 1 | IT support | No deadline |
Fixed, auditable rules over the data your organisation has already loaded. This is not a model giving an opinion: it is a deterministic rule that reviews your own information and points to the specific records behind each finding. Then the AI proposes; you decide.
Processes flagged as critical in the data map for which nobody has yet declared what could go wrong.
They hold sensitive personal data or confidential information and declare no encryption at rest.
Every control requires documents, and every document has a frequency and an owner. The system generates the evidence calendar and shows which regulation each piece covers. A document manager stores files; this one demands them.
| Document | Controls | Class | Status | Frequency | Coverage |
|---|---|---|---|---|---|
| Security committee charter | GOV-03 | Minutes or record | Pending | One-off | ISO 27001 · 2 |
| Personal data catalogue | GOV-02 · PRV-01 | Report | In progress | Annual | Law 21.719 · 4 |
| Risk methodology review record | RISK-01 | Minutes or record | Pending | Annual | ISO 27005 |
| Matrix of profiles and privileges across systems | IAM-02 · IAM-04 | Matrix | In progress | Monthly | ISO 27001 · 3 |
| Minutes of security committee meetings | GOV-03 | Minutes or record | Pending | Quarterly | Law 21.663 · 5 |
44 documents required by the active framework · the due-date calendar builds itself
The CRM leaves evidence too. Every opportunity, contact and campaign is entered with a lawful basis and traceable consent, so the commercial team stops being the blind spot of the RoPA.
Funnel of open opportunities
Pipeline weighted by stage
The regulatory obligation shows up in the diary of whoever has to meet it. Committees, evidence due dates, notification deadlines and RoPA reviews do not live in a report: they land in the calendar of the person responsible, with their origin in plain sight.
Every activity keeps the module and the control that originated it. If it is rescheduled, the regulatory due date does not move with it.
The platform assistant only sees documentation, never your data. It explains what each application does, in what order it is best configured and what gets recorded in each field, limited to what the profile of whoever is asking has available. It does not query your information or carry out actions on your behalf.
Administration
Demonstration views with fictitious data. The real configuration depends on the framework and the structure of each institution.
The difference in category
Almost everything sold as compliance in Chile is a document manager with a workflow
Upload the document, approve it, file it and have someone remember it a year later. It is useful for keeping papers in order, but the evidence is still the paper — and the regulator does not ask about the paper, it asks about the operation behind it.
The usual approach
Document manager and workflow
A repository of policies and procedures, with approvals and reminders. The organisation carries on operating outside, in its own systems, and someone has to transcribe by hand what happened over there to leave a record over here.
- The document is the end, not the consequence
- Evidence is transcribed, and that is why it falls behind
- Nothing forces what is written to match what is done
Our approach
Multiple high-use functions, integrated with one another
Day-to-day operations happen inside the platform: assets, projects, people, suppliers, signatures, campaigns and service. The document is issued as a result of that operation, not the other way round.
- A single piece of data feeds administration, risk and compliance
- Evidence is born dated and attributed, with no transcription
- What is written and what is done cannot differ: they are the same record
The difference is in the cross-referencing
For every front of work, a single engine that cross-references them
Each module operates on its own and hands its data to the others and to the AI-driven multi-standard engine. Evidence is born of that cross-referencing — dated, attributed and traceable down to the article the law requires — and it is what a document manager cannot produce by design.
- You capture a piece of data once and it serves assets, risk, people and compliance at the same time.
- A single engine for every framework: ISO 27001, NIST CSF and Laws 21.719 and 21.663.
- The AI reasons over that cross-referencing with strict isolation by organisation.
The functions that are integrated
Each function operates on its own and hands data to the others and to the compliance engine. That cross-referencing is what a document manager cannot produce by design, however many approval flows it adds.
How you come in
Two ways of working with the platform
My organisation has to comply
Clinics and health networks, banks and fintechs, municipalities and State services, mining operations, universities and every Vital Importance Operator designated by ANCI.
- Your sector's framework already loaded, not a generic template
- Evidence ready for inspection from the first month
- You start with what you need and add capabilities when the time comes
I bring compliance to a network
Consultancies that implement, holding companies that govern subsidiaries, trade bodies and associations that need to raise the standard of all their members at once.
- Multi-organisation with its own brand per subsidiary or member
- Your methodology inside the platform, not ours on top of it
- Recurring revenue instead of projects that end
The central idea
When you operate, you are already complying
It is not a marketing promise: it is a consequence of where the data lives. Because the asset, the project, the person and the supplier are inside the platform, the control the regulation requires is satisfied by the record the operation has already generated.
Native data protection
A single standard of protection for all your relationships
Law 21.719 draws no distinction between a client and a job applicant: both are data subjects. Every person you register comes in with a lawful basis, consent and isolation by organisation, and feeds the same Record of Processing Activities.
Commercial relationship
Contacts and clients
A record with full history, declared purpose and consent for each authorised contact channel.
Contractual relationship
Suppliers and third parties
Assessed and monitored, with a data processing agreement and evidence that expires.
Employment relationship
Employees and collaborators
Sensitive employment data kept safe, with access limited by role and traceability of every query.
Service relationship
Patients, students and members
They come in through the extranet with identity verification, exercise their rights and see what is being done with their data.
Artificial intelligence
The AI executes. The control is yours.
Inside the platform, the AI drafts, assesses control by control, reads documents and answers by voice — and your people decide how far it goes on its own, what requires a signature and what gets reversed. Since Law 21.719 regulates automated decisions, we give you the tools to govern all the AI your organisation uses.
See the full AI layerBRAINLOF assistant
Generate the preliminary Law 21.719 assessment for the admissions area.
Client control
We give you the platform. The control stays with you.
A compliance platform handles the most sensitive things an organisation has: its data, its evidence and the decisions it makes about people. None of that can sit on the provider's side.
Your data
Your own encryption key
Each organisation stores its documents with its own key, in private storage. Neither the storage provider nor we access the content.
Your evidence
Exportable whenever you want
The compliance history is yours and comes out in audit format. Staying should be a decision, not an exit cost.
Your AI
You set the thresholds
What an agent settles on its own, what needs a person's signature and what gets reversed. Autonomy is defined by your team, system by system.
Your people
You define who sees what
Profile, privilege and resource: each person reaches only what their role and their level in the structure allow, and every access is recorded.
Your scope
You add and remove what you use
Modules, frameworks and subsidiaries adjust when your reality changes. No counted seats and no paying for what you do not use.
Your brand
The portals are yours
Each subsidiary serves its patients, suppliers or members with its own logo and colours. The data subject sees your institution, not us.
What makes us different
Four advantages for a better service.
A combination that is hard to replicate, because we integrate where coverage is difficult and we adapt to your organisation's operational needs if you need us to. With consultants of broad experience in the cybersecurity and technology market, we have built unique solutions not just to document, but to operate while complying — keeping the house in order while our users deliver service without interruption.
Advantage 01
An operating layer with compliance underneath
GRC suites manage controls and watch external systems. BRAINLOF also manages assets, projects, people, signatures, campaigns and identity: the evidence originates inside, it is not imported.
Advantage 02
Chilean sector depth
Superintendencia de Salud, Law 20.584, DS 132 and SERNAGEOMIN, CMF regulations, Fintech Law 21.521, CNA accreditation and DS 44. It is the barrier an international entrant cannot amortise in a market this size.
Advantage 03
Multi-organisation with a brand per subsidiary
A parent governs subsidiaries with strict isolation and each one opens its own portals for suppliers, members or patients. It is what technically enables the network and channel model.
Advantage 04
An extranet with agents that serve your clients
Clients, students, subscribers, members or suppliers complete their procedures 7×24, supported by AI that verifies identity, executes and closes — and every interaction is left with a lawful basis, consent, a documented record and strict compliance.
Reference case
Fundación Cristo Vive: primary care in Recoleta, with an ISMS in operation
Construction of a complete Information Security Management System under a hybrid CIS, NIST and ISO 27001 framework for CESFAM Cristo Vive, covering health, telemedicine and electronic health record regulations, including Laws 19.628, 21.719, 21.663, 20.584 and 21.459.
The CESFAM has operated since 1993 under an agreement with the Servicio de Salud Metropolitano Norte and is part of the public health network. A provider like this processes sensitive data for an entire population, with extended hours and emergency care: there is no window to stop operations while compliance is implemented. The service agents, by contrast, answer 24×7 without depending on consulting-room hours.
Population served
25.000
people in Recoleta and the surrounding area under the family health model
Episodes of care per year
+20.000
people seen each year in the Foundation's health area
Operating since
1993
under an agreement with the Servicio de Salud Metropolitano Norte
Frameworks implemented
3 + 2
CIS, NIST and ISO 27001, cross-referenced with Laws 21.719 and 21.663
Coverage figures published by Fundación Cristo Vive. They correspond to the provider's operation, not to BRAINLOF users.
Certified consultants
The platform does not arrive on its own. It arrives with someone who knows how to implement it.
Your implementation is carried out by a consultant with accredited certification in the field that applies to you: information security, data protection, quality, occupational safety or sector regulation. That is what turns a licence into a management system that works — and what no international suite has in Chile.
Verifiable credentials
You know who is coming into your organisation
The assigned consultant evidences their certification in the field and is certified on the platform. You can ask for both before signing.
Coverage by speciality
The specialist your regulation requires
The profile that implements an ISMS is not the same one that prepares a health accreditation or a mining DS 132. You are assigned by subject matter, not by availability.
Independence
We implement; a third party certifies
The network provides consultancy and implementation, not certification audits. That separation is what makes the evidence you leave behind valid before the certifying body and before the Agency.
Why this matters more than an integration
Chile has an estimated shortfall of 28,000 cybersecurity specialists. The bottleneck is not the software: it is finding someone to make it work. Hiring that profile today takes months and competes with the whole industry; here it comes included in the project.
Structure
One organisation, all its levels
Model your institution, its subsidiaries or branches, its departments, units and teams. Each level reaches only what is theirs, and assessments run through the whole structure or consolidate upwards.
- Access control by role and organisation, with separation of duties by design
- Custom branding per subsidiary: its own logo and palette in each portal
- Assessments by subsidiary, by department or consolidated for the group
- Documents with envelope encryption and their own key per organisation
Sectors
Designed for Chile's most regulated industries
Frequently asked questions
What we get asked most about compliance in Chile
When does Law 21.719 come into force and what do I risk if I do not comply?
It was published in December 2024 and is fully enforceable from 1 December 2026, after twenty-four months of adaptation. Penalties reach up to 20,000 UTM for the most serious infringements and up to 4% of annual revenue in the event of repeat offences. The Agency may also order processing to be suspended and publish a national register of penalties.
What is the Record of Processing Activities and why do I need it?
It is the inventory of how your organisation processes personal data: purpose, lawful basis, categories of data, retention periods and recipients. The law requires it to be kept up to date. In BRAINLOF it is generated and kept alive from your data map and your day-to-day operations, without rebuilding it each time.
What does Law 21.663 require and who is bound by it?
It binds essential services and Vital Importance Operators in particular to implement an ISMS, appoint a cybersecurity officer, manage risks and report incidents to ANCI within a maximum of three hours. It is already in force and has no grace period.
I am a small business — do I have time?
Less than it looks. During the first twelve months in force, smaller companies receive a written warning instead of a fine for their first infringements. That ends in December 2027, and the warning neither excuses you from putting things right nor protects you against a complaint from a data subject.
How is this different from traditional consultancy?
A consultancy delivers documents; an inspection reviews operations. BRAINLOF leaves operational evidence traceable by article of law, together with continuous monitoring, instead of a report that goes out of date. And it leaves capability installed in your team rather than taking the knowledge away when the project ends.
Does it work for any regulation or only for Chilean law?
The engine is agnostic: ISO 27001, 27005, 9001 and 14001, NIST CSF, CIS, Chilean Standards and your own frameworks, as well as Chilean Laws 21.719, 21.663 and 20.584. Frameworks are cross-referenced with one another so that one assessed control answers to every standard that requires it.
How do I know whether my organisation is a Vital Importance Operator?
ANCI designates OIVs by resolution and publishes the list. The first process closed on 24 July 2026. If your institution was designated, you are notified and you take on reinforced obligations enforceable immediately: an ISMS, a cybersecurity officer, risk management and incident reporting within three hours, with fines of up to 40,000 UTM.
I am not an OIV, but my client is. Does it affect me?
Yes, and it is the route by which most organisations discover they have obligations. Law 21.663 pushes OIVs to demand standards of their supply chain, so you will start receiving security questionnaires and contractual clauses that did not exist before. Answering them with evidence rather than promises is now a condition of continuing to sell to them.
Is the AI trained on my organisation's data?
No. The artificial intelligence layer is decoupled from the business logic and operates with strict isolation by organisation: neither the user nor the model reaches data outside the tenant and the role of the session. Your data does not feed models and is not used to improve the service for other clients.
How do you stop the AI from inventing risks or controls?
By separating who finds from who writes. Detection runs on fixed, auditable rules over the data your organisation has already loaded, and every finding points to the specific records behind it. Only then does the AI propose the risk in writing, and a person accepts it, edits it or discards it.
I am already ISO 27001 certified. What good is this to me?
Certification attests to a moment; an inspection asks about continuous operation. The platform keeps the ISMS alive between audits, cross-references your current framework with Laws 21.719 and 21.663 without building the same controls again, and leaves the file ready for the surveillance audit without reconstructing it.
Can I load my own framework or my internal standards?
Yes. The engine is agnostic: besides the frameworks included, you can define your own with your controls, your required documents and your frequencies, and cross-reference them with external standards so that one assessed control answers to all of them at once.
How do you protect my organisation's data?
Documents with envelope encryption and their own key per organisation in private storage, strict isolation between organisations, access control by role, short-lived sessions, access logging and defences against the OWASP Top 10. The platform runs on hosting infrastructure certified to SOC 2 Type II and ISO 27001.
Do I need technical knowledge, and how long does it take to implement?
You do not need to be an expert: the AI brings in the framework with its controls, documents and activities, and guides you step by step. What takes a traditional consultancy months comes down to weeks. Implementation is carried out by a certified consultant from the network, in the field your regulation requires.
What exactly do the AI service agents do?
They serve your clients, patients, students or suppliers 24×7 by chat, voice or portal; they run the service flow under your organisation's rules; they escalate to a person when the case crosses the threshold your team set; and they leave the interaction recorded with a lawful basis and consent. They do not make clinical, financial or disciplinary decisions.
My organisation uses AI in admissions or recruitment. Is that regulated?
Yes. Law 21.719 regulates automated decisions affecting people: they require a lawful basis, information for the data subject and a right to object. BRAINLOF lets you inventory your AI systems, appoint an owner for each one, record the decisions and set what the model settles and what a person signs.
Can I take my data with me if I change platform?
Yes. The compliance history is yours and is exported in audit format whenever you ask. Staying should be a decision, not an exit cost.
Do you work with consultancies, holding companies and trade bodies?
Yes, in two different ways: we certify partners who implement the platform for their clients, and we agree channel terms with networks that bring in many organisations at once. They are signed separately because they are different relationships.
Am I required to appoint a data protection officer?
Law 21.719 requires data controllers to be designated and, in certain cases, a prevention officer with specific duties. Even if you were not required to, having someone appointed with a written scope is the first thing an inspection looks at. If you have nobody to appoint, the partner network provides the role externally.
What do I do if I suffer a data breach?
The platform records the incident with its taxonomy, starts the applicable deadlines and assembles the notification file. What cannot be improvised is what comes before: having the data map, the asset inventory and the communication channel defined ahead of the incident. That is the work the platform leaves done.
Does it integrate with my current systems?
Today operations happen inside the platform and the evidence originates there, not imported from outside. Native integrations with identity, cloud and SIEM providers, along with single sign-on and the public API, are under development. We say so plainly because it is the gap most often raised against the international suites.
How is the assistant different from the agents?
The platform assistant is for your team: it guides configuration and explains what gets recorded in each field, and it only sees the documentation available to that profile — it does not reach your data or carry out actions. The service agents are for your clients: they answer 24×7, complete whole procedures and leave the evidence of every interaction.
We are a network, a holding company or a trade body. How does it work?
A parent organisation governs its subsidiaries or members with strict isolation: each one operates with its own brand, its own data and its own encryption key, while the parent consolidates the group's status. It is the same architecture that underpins the channel programme, and it is already built.
Can I try it before deciding?
Yes. The Law 21.719 exposure assessment is free, takes four minutes and returns your prioritised gaps with the article that requires them. If you go ahead, that result is the starting point for configuration, and the demo is run on a real process of yours instead of a product presentation.
Start by measuring
Stop gathering evidence. Start issuing it.
We will show you, with a real process, how it ends up recorded when someone runs it inside the platform. No commitment.
Platform
An agnostic engine, all your frameworks on the same foundation
The same machine that assesses ISO 27001 handles Law 21.719, ISO 9001, occupational safety, the Chilean Standards or your internal rules. Standards and legislation are cross-referenced with one another, so one assessed control answers to every standard and law you choose to relate, and you do not start from scratch with each certification or sector regulation.
Engine
Assessment control by control
With automatic guidance, real-time scoring and traceability down to the article of law.
- Frameworks included and your own frameworks
- Cross-referencing between Chilean and foreign law
- A single baseline per organisation
- Due-date calendar and alerts
Evidence
A record with evidentiary value
Every operation is left dated, attributed to a person and linked to the control it satisfies.
- Audits and findings with follow-up
- Reports, records and RoPA generated automatically
- Documentation exportable for inspection
- Accumulated history that is not lost
Architecture
Multi-organisation with levels
Organisation, subsidiaries, departments, units, teams and users, each with its own scope.
- Strict isolation between organisations
- Custom branding per subsidiary
- Consolidated assessment for the group
- Extranet with its own address per site
Example structure
Security
Protection that stands up to a penetration test
It is not a promise: these are implemented controls. And where we do not have something, we say so.
Envelope encryption per organisation
Each organisation stores its files with its own key in private storage. Not even the storage provider reaches the content.
Isolation between organisations
No data crosses from one to another. Every query is limited to the session's tenant, including those made by the AI.
Access control by role
Profile → privilege → resource, with separation of duties by design and traceability of every access.
Sessions and monitoring
Short-lived tokens, access and incident logging and alerts on anomalous behaviour.
OWASP Top 10 defences
Parameterised queries, a strict content policy and protection against XSS, CSRF and IDOR.
Provider infrastructure
We run on hosting certified to SOC 2 and ISO 27001 and inherit its physical and operational controls.
Fact sheet for third-party questionnaires
Your OIV and banking clients are required to assess their supply chain. This is what they need from us, published so that you do not have to ask for it.
| Service model | Multi-tenant SaaS with strict isolation by organisation |
| Location of applications and data | The hosting provider's data centre, certified to SOC 2 and ISO 27001 |
| Encryption at rest | Envelope encryption with a key per organisation, in private storage |
| Encryption in transit | TLS on every connection |
| Access control | RBAC by profile, privilege and resource, with separation of duties |
| Logging and monitoring | Traceability of accesses and incidents, alerts on anomalous behaviour |
| Secure development | Parameterised queries, strict content policy, OWASP Top 10 defences |
| Backup and recovery | A documented backup and recovery policy, to be completed with committed RPO and RTO |
| Sub-processors | List available under agreement, with a processing contract in force |
| Retention and deletion | Defined by the client; export of the history in audit format on termination |
| Incident notification | To the client and, where applicable, to ANCI within the legal deadline |
Against the market
Where we win and where we do not yet
A table with “yes” in every row of your own is not information, it is advertising. These are the rows where we lose.
| Criterion | BRAINLOF | International GRC | Local GRC | Consultancy | Spreadsheets |
|---|---|---|---|---|---|
| Models the letter of Chilean law | Yes | Partial | Yes | Yes | No |
| Sector frameworks (health, mining, CMF, CNA) | Yes | No | Limited | Yes | No |
| High-use operating functions integrated | 24 | Few | Documentary | N/A | No |
| Operating layer (assets, signature, Gantt, QR, CRM) | Yes | No | No | No | No |
| Reaches the end data subject (portal, ARCO, extranet) | Yes | No | No | No | No |
| Its own biometric identity | Yes | No | No | No | No |
| Multi-organisation with a brand per subsidiary | Yes | Partial | No | No | No |
| Tools for people to govern the AI | Yes | Emerging | Certification | Project | No |
| Native integrations (cloud, IdP, SIEM) | In progress | Extensive | Limited | N/A | No |
| Single sign-on (SSO) | On the roadmap | Yes | Variable | N/A | No |
| Installed base and references | Early stage | Thousands | Dozens | Broad | N/A |
| Network of certified partners in Chile | Yes | No | No | Our own | No |
| Leaves capability behind | Yes | Yes | Yes | No | Fragile |
Reference comparison by solution category, using public information as at today's date. It implies no affiliation or sponsorship; trade marks belong to their respective owners.
Methodology
Built on the world's reference frameworks
ISO 27001 and 27005, NIST CSF, CIS Controls, ISO 9001 and 45001, Chilean Standards and Laws 21.719, 21.663 and 20.584. LOF has consultants with individual certifications backing every implementation.
How it is contracted
Modular, in layers.
The scope is defined by frameworks, structure, modules and vertical — and the proposal is adjusted to what you actually need.
Compliance core
Multi-standard engine, RoPA, ARCO channel, consent, risks, incidents, critical assets, encrypted documents and regulatory updates. It is the floor, not a higher plan.
Operating and advanced modules
CRM, planning, people, campaigns, third parties, electronic signature, biometrics, extranet and the full AI layer. They are added and removed according to what you use.
Sector vertical
Your sector's framework loaded, with evidence templates and supported go-live.
Consultancy and implementation
Gap assessment, scope of the system, risk analysis, loading of frameworks, migration of evidence, go-live and training — delivered by the network of partners certified in each field, working inside your own platform and not in a separate report.
Solutions
Each capability solves something concrete and feeds the others
It is not a box of loose tools. Each solution operates on its own and, in doing so, hands data to the others and to the compliance engine. Open each one to see what it includes and what evidence it leaves.
From the asset to the risk, from the risk to the evidence
Solutions that share the same data
The equipment you register under assets is the one that appears in the risk, in the supplier's contract and in the accreditation evidence. Registering it once is what keeps compliance from being extra work.
One piece of data, three uses
The medical equipment you register under assets is the same one that appears in the risk, in the supplier's contract, in the maintenance plan and in the accreditation evidence. Registering it once is what keeps compliance from being extra work.
Artificial intelligence
Three layers: the AI that helps you, the one that serves, and the one your organisation controls
Most compliance platforms bolted a chat on top. Here the AI is decoupled from the business logic but sits inside the same isolation — neither the user nor the model reaches data outside the tenant and the role of the session — and every action is attributed to the person who authorised it.
Layer 1
AI that helps you comply
Where a consultancy charges for weeks, the platform delivers in minutes, with the context of your own organisation.
- Drafts policies, procedures and minutes
- Assesses control by control against the chosen framework
- Vision over documents: reads, extracts and classifies
- Detection by fixed, auditable rules over your own data
- Turns findings into proposed risks that a person accepts, edits or discards
- Prioritises gaps and builds the remediation plan with owners
- Conversational and voice assistant, always under the role of whoever uses it
- Platform assistant that guides configuration without reaching your data
Layer 2
Agents that serve
Several specialised agents orchestrated over your data, serving 7×24: one receives, others resolve, one supervises and another records the evidence.
- Scheduling, admissions, procedures and requests
- Assisted ARCO channel with identity verification
- First line of incidents with the ANCI clock running
- Supplier assessment and follow-up
- 24×7 service, no shifts, no queues and no office hours
- Escalation to a person with the full context
Layer 3
Control stays in your company
Law 21.719 regulates automated decisions and ISO 42001 sets the standard. Neither of them asks anything of a model: they hold a person in your organisation to account. Our job is to give them the place to exercise it.
- An appointed owner for each AI system, with its scope
- Inventory of the AI systems the organisation uses
- Impact and bias assessment, approved by the right person
- Autonomy thresholds: what the model decides and what a person signs
- Record of automated decisions and of the data subject's right to object
- ISO 42001 framework on the same multi-standard engine
Govern the AI
When a model decides about a person, somebody has to answer for it
AI governance is not a software feature: it is a set of human decisions — who authorises each system, how far it may go on its own, who reviews its results and who answers to the data subject. We do not make those decisions for you: we give you the place to make them, record them and evidence them, with the same multi-standard engine that already handles your other obligations.
Why this matters now and not in two years
Any organisation that has brought AI into admissions, recruitment, scoring or customer service is making automated decisions about people. Under Law 21.719 that requires a lawful basis, information for the data subject and a right to object — and it requires somebody able to explain the decision, not a provider to ask. It is a new obligation for which almost nobody has a tool, and the one case where having the AI inside and the compliance engine inside is the same advantage.
Orchestration
Four roles, a single conversation for the user
The data subject speaks once. Behind the scenes, the agents hand the case between them as needed, without leaving your organisation's isolation or the assigned role.
Role 01
Reception
Answers at any hour, every day. Understands what the person needs, identifies them and decides which agent is appropriate. By chat, voice or a portal carrying your institution's brand.
Role 02
Specialists
They run the specific flow: scheduling, admitting, processing, answering an ARCO request or raising an incident.
Role 03
Supervision
Checks the answer against the rules your organisation defined and escalates to a person when the case crosses the threshold. That threshold is set by your team, not by the model.
Role 04
Compliance
Records the lawful basis, consent and traceability in the RoPA. Turns the interaction into evidence without anyone documenting it afterwards.
How far an agent goes
The agents operate inside the platform on our own agent management engine, and are configured per vertical with each institution's flows. An agent makes no clinical, financial or disciplinary decisions: it runs the flows your team defined, respects isolation and consent, and escalates to a person anything that crosses the threshold.
Against a chatbot
Answering is not the same as resolving, and resolving is not the same as being able to prove it
| Criterion | BRAINLOF Agents | Chatbot / IVR | Agent on a generic suite | External call centre |
|---|---|---|---|---|
| Resolves the whole procedure | Yes | No | Partial | Yes |
| Serves and resolves 24×7 | Yes | Answers, does not resolve | Partial | In shifts |
| Leaves evidence with a lawful basis and consent | Yes | No | No | No |
| Operates on the organisation's data, isolated | Yes | Limited | Depends | Exports them |
| Records in the RoPA what it processes | Yes | No | No | No |
| Escalates to a person with the full context | Yes | No | Partial | Yes |
| Integrations with third-party systems | In progress | Broad | Broad | N/A |
| Installed base and references | Early stage | High | High | High |
The last two rows are genuine disadvantages against providers with years in the market, and they are declared in the sales conversation, not afterwards.
Verticals
Your sector does not need a generic template
Each vertical arrives with its regulatory framework loaded, its evidence templates and a supported go-live. It is the layer no international suite can amortise in a market the size of Chile's.
Health vertical
Three pieces that are now a single one
The patient extranet, the service agents and the cybersecurity and data protection framework are integrated, because in healthcare they do not work apart: the data subject exercising an ARCO right is the same patient booking an appointment, and the data identifying them is a special category.
The provider operates; the accreditation file builds itself
Electronic health record, telemedicine, patient consent and health data as a special category: every episode of care leaves the record that accreditation and Law 21.719 ask for separately.
Framework loaded
Superintendencia accreditation
Standards for institutional providers, with evidence attached to each assessed characteristic and an owner for each one.
Framework loaded
Law 20.584 and the clinical record
Patient rights and duties, confidentiality of the electronic health record and traceability of access to health data.
Framework loaded
Telemedicine and the care network
Networked providers, remote consent and protection of the remote clinical session.
Operation
Patient extranet
A portal with the provider's brand, biometric verification, consent and access by QR code on site.
Operation
24×7 service agents
Scheduling and confirmation, admissions and documents, an assisted ARCO channel and post-care follow-up — at any hour, with the provider's flows. Service does not depend on how long the consulting room stays open.
Operation
Sensitive data and OIV status
An ISO 27001 and 27005 ISMS, Law 21.663 for designated providers, and health data as a special category under Law 21.719.
Reference case
Construction of a complete ISMS under a hybrid CIS, NIST and ISO 27001 framework for CESFAM Cristo Vive, covering health, telemedicine and electronic health record regulations, including Laws 19.628, 21.719, 21.663, 20.584 and 21.459.
Higher education: accreditation stops being a project every six years
A university lives the cycle backwards: it operates for five years and then spends a whole one rebuilding the evidence of what it did. This vertical turns that logic around — each CNA criterion is linked to the operation that feeds it, and the file is built month by month.
Accreditation
CNA by dimension and criterion
Institutional and programme level, with attached evidence, an owner and a status for each criterion.
Data
Students and applicants as data subjects
Tens of thousands of data subjects with different purposes: admissions, welfare, student health and research, each with its own lawful basis.
Structure
Campuses, faculties and units
The same multi-level structure an accreditation file requires, with consolidation upwards.
Real status of this vertical
The CNA framework is under construction, due in 2027 alongside the mining vertical. An institution can operate today on the core, Law 21.719 and the ISO frameworks, and bring accreditation in when it is available without migrating or rebuilding the evidence already accumulated.
Network and channel
Two ways of being on BRAINLOF's side
We certify partners who implement: consultants and firms that put the standard to work inside the client's platform. And we agree channel terms with those who bring organisations in: networks that take the platform to many organisations at once. The same partner can be both, but they are signed separately because the terms differ.
We certify you so that you implement
If you already do consultancy in security, data, quality or sector regulation, we train and certify you on the platform so that you deliver the whole project with it inside.
- Training and certification credential by subject
- Your own environment to practise and to demonstrate to your clients
- Account referrals according to your speciality and territory
- The project ends with your client operating, not with a report delivered
We bring organisations onto the platform
Consultancies with a client base, holding companies that govern subsidiaries, and trade bodies or associations that want to raise the standard of all their members at once.
- Multi-organisation with its own brand per subsidiary or member
- Preferential terms and recurring commission per active organisation
- Partner portal with authorised co-branding
Who brings what to the table
Consultancies
Your methodology, with a platform behind it
You deliver the assessment and the implementation as always, but the client is left with capability installed and you with recurring revenue instead of a project that ends.
Holding companies
Group governance, autonomy per subsidiary
You consolidate the compliance of every subsidiary on one board and each one operates with its own brand, its own data and its own encryption key.
Trade bodies and associations
Raise the standard of all your members
A single agreement brings in dozens of organisations on preferential terms. The trade body goes from issuing recommendations to handing over a tool.
Agreement and certification
Your team is certified on the platform and in the frameworks it will implement.
A portal with your brand
We open the parent organisation and the partner portal so that you can add the identity and authorised co-branding you need.
Onboarding of accounts
Each organisation in your network comes in isolated, with its framework, its brand and corporate colours, its structure and its own plan.
Optional support from the network for your channel.
Service 01
Consultancy
The judgement work no software replaces: understanding the organisation, interpreting the regulation and deciding which controls apply and with what scope.
- Gap assessment against the applicable framework
- Scope of the management system and statement of applicability
- Risk analysis and definition of the treatment plan
- Data map, purposes and lawful bases
- Preparation for accreditation or certification
Service 02
Implementation
Leaving the system running inside the platform, with the client's people using it. It is what separates an active licence from a client who renews.
- Configuration of the structure, subsidiaries, units and roles
- Loading of frameworks, controls, assets and suppliers
- Migration of existing evidence and documentation
- Go-live of the RoPA, the ARCO channel and the incident register
- Training of the team and handover of operations
How we certify our partners
You evidence your field
You present the certifications you already hold in security, data, quality, occupational safety or sector regulation. That defines which verticals you can take accounts in.
We train you on the platform
Training on the multi-standard engine, loading frameworks, the RoPA, the ARCO channel and evidence generation, with your own environment to practise and to demonstrate to your clients.
You gain accreditation
Assessment and visibility as a certified partner by subject, which you can show your clients and which they can verify on our site.
You take accounts and recertify
We refer accounts according to your speciality and territory. Accreditation is renewed when the frameworks change, so that your team does not fall behind the regulation.
Directory of certified partners
Public and verifiable: the client checks the credential before signing, and the partner gains visibility for being certified. To be completed with the real network.
| Partner | Certified subjects | Vertical | Territory | Credential |
|---|---|---|---|---|
| Example consultancy A | ISO 27001 · ISO 27005 · Law 21.719 | Health | Metropolitan Region and Valparaíso | Valid until 2027 |
| Example consultancy B | NIST CSF · CIS · Law 21.663 | OIV and public sector | Nationwide | Valid until 2027 |
| Example consultant C | ISO 9001 · ISO 45001 · DS 132 | Mining | Antofagasta | Recertifying |
Subjects we certify in
To be completed with the real detail of the programme.
What we measure, and what we do not
A signed agreement is not an organisation brought in. The programme is assessed by active organisations inside your network, not by announced agreements — and that is how we report it.
Free assessment
How exposed are you to Law 21.719?
Four questions. At the end you see your level of exposure and the gaps an inspector would look at first. Nothing to install and no commitment.
1. Do you keep an up-to-date Record of Processing Activities?
2. How do data subjects exercise their rights today?
3. Can you prove when a control was applied and who applied it?
4. Do you use AI in processes affecting people (admissions, recruitment, scoring)?
What you get
A map of gaps, not a brochure
The report lists your gaps prioritised by risk of penalty, with the article that requires them and what evidence would have to be produced to close them.
What it is for afterwards
It is the agenda for the first meeting
If you decide to talk to us, we do not start with a product presentation: we start with your own gaps on screen.
Platform access
How do you want to come in?
There are two different doors, because they are two different worlds: the team that runs the organisation from inside, and the people that organisation serves.
I am a user of an organisation
Entry for the internal team: administrators and users who operate the modules according to their profile and their level in the structure.
- Your access respects your role: you see only the data that belongs to you
- Every session is recorded as evidence of access control
I am a supplier, member or subscriber
Services extranet: enter the portal carrying your institution's brand for procedures, documents, identity verification and enabled services.
- Use the branded link your institution gave you
- You can exercise your rights over your data from the same portal
Lost your institution's link?
Each subsidiary has its own extranet address, with its logo and its colours. If you do not have it to hand, ask the organisation that serves you: we cannot provide it, because the portal and its users belong to them.
Resources
What is coming, when, and what to do beforehand
The Chilean regulatory calendar has fixed dates and different consequences depending on who you are. This is what has to be ready, at no cost and without signing up first.
Regulatory calendar
Already in force — Law 21.663, Cybersecurity Framework
Obligations enforceable for essential services and Vital Importance Operators: an ISMS, a cybersecurity officer, risk management and incident reporting to ANCI within three hours. Fines of up to 40,000 UTM.
July 2026 — Final list of OIVs
ANCI closed the first designation process. The institutions designated have reinforced obligations from now on, with no adaptation period.
1 December 2026 — Law 21.719 fully enforceable
The Personal Data Protection Agency begins operating, with powers to investigate on its own initiative, impose penalties of up to 20,000 UTM, order processing to be suspended and publish a national register of penalties.
1 December 2027 — The grace period for smaller companies ends
During the first twelve months they receive a written warning instead of a fine for their first infringements. After that, the penalty regime applies in full.
Downloadable guides
Guide
RoPA checklist
What fields Law 21.719 requires, how to build your processing activities and the mistakes that show up in the first review.
Guide
The data officer's first 90 days
A 30, 60 and 90-day plan for whoever has just taken on the role: what to gather, what to document and in what order.
Guide
Minimum evidence for ANCI
What is asked for in an incident report, how the three-hour clock runs and what backup you need to have before it happens.
Regulatory alerts
We tell you when the rules change
An email when a resolution is published, a deadline changes or a framework that affects you is updated. No fixed frequency: only when there is something to do. It is also exactly what the platform does on the inside.
Contact
We show you the platform using your own reality
The demo is not a tour of features: we load a real process of yours and you see what evidence is left when someone runs it.
Company details
| Registered name | LOF Limitada |
| Brand | BRAINLOF · lofconsultoria.com |
| Address | Santiago de Chile |
| Business email | info@lofconsultoria.com |
| Rights over your data | info@lofconsultoria.com |
| Opening hours | Monday to Friday, 9:00 to 18:00 |
RUT and telephone are completed before publication: they are a requirement in technical tender evaluations.
Law 21.719
Rights channel
Exercise your rights over the personal data processed by LOF Limitada: access, rectification, cancellation or erasure, objection, portability and blocking. We respond within the legal deadline.
We ask for your RUT only to verify your identity. If your data is processed by an organisation that uses BRAINLOF, exercise your rights with that organisation through its own portal: this channel is LOF Limitada's as data controller.