# ISMS Copilot

Aiolum story: https://aiolum.com/story/isms-copilot/ · added 2026-11-10 · updated 2026-11-10

**In short.** ISMS Copilot (AI assistant for ISO 27001 compliance work, France): US$500 a month, February 2024. Evidence grade D: reported, not verified. Team: 1 founder and no employees in February 2024; the About page names 2 people in November 2026. Launched October 2023; still running.

AI assistant for ISO 27001 compliance work · France · AI-native · solo founder · still running · group: Finance, risk and compliance

- Outcome: US$500 a month, February 2024 (evidence grade of the headline number: D; headline in US dollars: 6000)
- Launch: October 2023; months from launch to the outcome: 4
- Team: 1 founder and no employees in February 2024; the About page names 2 people in November 2026
- Outside funding: None
- Main factor: Own problem
- Meters, 1 to 4: evidence strength 1, copyable pattern 2, capital needed 1
- Tags: AI-native, Solo founder, Bootstrapped, Running, B2B, Compliance

Links:

- Visit ismscopilot.com: https://www.ismscopilot.com/

**The product.** An AI assistant for people who do information-security compliance work: consultants, security leads and auditors. It answers questions on ISO 27001 and other frameworks, reviews uploaded documents for gaps, and drafts policies. It runs as a chat app and as a connector inside assistants such as Claude and ChatGPT.

**Why it worked.** Tristan Roth built the first product for a job he did himself: writing the security documents for an ISO 27001 audit. He told Starter Story that the generator “solved my own pain point”. He also said that buyers found the site through Google by typing “policy generator”.

Evidence grades: A = disclosed by a public company, a filing or a payment processor, or verified by one; B = two or more independent reports agree, or a journalist confirmed it; C = a founder claim that no one else verified; D = reported, not verified: one founder claim or a third-party estimate with no second source; E = no revenue figure found, so the headline is a non-money fact and the other facts carry their own grades; calc = computed on this page from graded facts.

## Summary

ISMS Copilot is an AI assistant for information-security compliance work. An ISMS is an information security management system: the written policies, risk assessments and controls a company keeps to protect its data. ISO 27001 is the international standard that says what an ISMS must contain, and an auditor certifies a company against it. The assistant answers framework questions, checks uploaded documents for gaps and drafts policies. The home page says it covers more than 150 frameworks.

Tristan Roth started the business in 2023 with a different product, ISMS Policy Generator. He told Starter Story that he was preparing an ISO 27001 audit for his employer and had to write or update more than 80 documents. He built forms that send a company's answers to an AI model and return a finished policy as a Word file. He said the first sales came in the last quarter of 2023. The Starter Story page, published on 25 February 2024, reported revenue of US$500 a month. By April 2024 the site sold a chat assistant, and the old domain now leads to ISMS Copilot.

The headline is the US$500 a month that Starter Story reported in February 2024, a single self-reported figure for the earlier product. No later revenue figure was found, so the size of the business in 2026 is not known. Chatbase wrote in September 2025 that the product had more than 1,500 users.

## Why did ISMS Copilot work?

### The founder built the generator for documents he had to write

In early 2023 Roth prepared an ISO 27001 audit for his employer and had to write or update more than 80 documents. He told Starter Story that the generator “solved my own pain point”. He said this makes validation easier and customers easier to understand.

### Buyers found the site through Google by searching for “policy generator”

Roth told Starter Story that his product finds its clients through Google. In his words, people type “policy generator” for cybersecurity and find him. He said he had focused on search from the start. He also posted generated policies on LinkedIn and explained them.

### A demo generator and immediate signup took the place of a sales call

Roth said no company would pay for this kind of product before seeing it work. He put a demo generator on the site and said it turned curious visitors into paid users. He also said he entered the market with no “book a demo” step. He said half of the trial users stayed as customers.

### By April 2024 the site sold a chat assistant by monthly subscription

Roth said in February 2024 that customers left once their documents were generated. He said he was working on recurring features. The archived site of April 2024 lists a chat assistant at US$20 a month. The pricing page of November 2026 lists five paid plans, from US$24 to US$1,000 a month.

## How it was built

These details come from the founder's interview, a vendor's case study and the company's own pages. They are grade C.

- The first document generators were built on Bubble, a no-code platform that the founder learned for this product.
- Each generator is a form. It sends the user's answers and written instructions to an OpenAI model and exports the result as a Word document.
- The founder said he built more than 30 generators, one for each document type.
- Chatbase wrote that the first version of ISMS Copilot was built in one day on Chatbase. The April 2024 site names ChatBase and OpenAI as data processors.
- In November 2026 the pricing page says AI runs by default on open-source models through OpenRouter. Customers can switch to Mistral AI in Frankfurt.
- The terms of service say that payments go through Stripe and that the database is on Supabase in Frankfurt.

Sources: [1, 5, 8, 2, 9]

## Who tried this before ISMS Copilot, and why did they fail?

Three companies in our database of failed startups sold software that answers expert questions or writes working documents. The values below are from that database and are not independently verified.

The failed startups come from our database of dead startups, retold here in our own words; Its entries are AI-assisted summaries of public sources, so they carry no evidence grade.

### ROSS Intelligence (2015 to 2018; funding US$13M; cause: Competition)

- Promise: AI legal research that finds the relevant case law and documents for lawyers.
- Why it died: The record says it did not gain enough traction. The market was dominated by incumbents with decades of data and integrated products.
- Record: 

### ABBY (2016 to 2020; funding US$3.5M; cause: No market need)

- Promise: Software that writes the documentation of A/B test results for marketing and product teams.
- Why it died: The record says it gained no traction as a standalone documentation tool. Users preferred tools that raised conversion and profit directly.
- Record: 

### Answerly (2013 to 2016; funding US$550K; cause: Product failure)

- Promise: FAQ systems and automated replies on company websites, so that fewer questions reach human agents.
- Why it died: The record says its promise did not match how customer service worked in 2013 to 2016.
- Record: 

## What changed

The three records describe software that tried to answer expert questions or write working documents before large language models existed. ROSS Intelligence and Answerly relied on the language processing of their time. ABBY sold documentation that its buyers did not value on its own.

ISMS Policy Generator started in 2023 on a general AI model. Roth said the generators became good enough to sell after the summer of 2023. He told Starter Story that he had written security documents for five years before AI tools became common. He called this “good timing”. His buyers also had a fixed reason to pay: an ISO 27001 audit needs the documents.

## Can one person copy ISMS Copilot now?

**Verdict: Yes, for an expert in a document-heavy field.**

One person with expert knowledge can copy the method, and the cost is low. The founder said the product cost about US$100 a month to run in February 2024. He built it on a no-code platform while employed. The revenue he reported was small, so the method is shown to work only at that size.

1. Pick a document set that a standard requires and that you have written by hand many times.
2. Build one form per document. Send the answers and your own instructions to a model, and return a finished file.
3. Name the product after the words buyers type into a search engine.
4. Put a working demo on the site and let people sign up without a sales call.
5. Add a recurring use, such as reviews or a chat assistant, because one-off documents end the subscription.

**What is still open.** Other standards with a fixed set of required documents, where the buyer must pass an audit and an expert can write the instructions.

## How much revenue does ISMS Copilot make? The numbers, graded

One self-reported revenue figure from February 2024, four months after the start date on Starter Story, and no later figure

| Fact | Value | Grade | Note | Sources |
|---|---|---|---|---|
| Revenue per month, February 2024 | US$500 | D | Shown in the header of the Starter Story page, beside an interview published on 25 February 2024. Self-reported. The product was then ISMS Policy Generator. | [1] |
| Run rate from the February 2024 figure | about US$6,000 a year | calc | Calculated: US$500 times 12. | [1] |
| Start date given on Starter Story | October 2023 | C | The page header says "started October 2023". The founder said in the interview that sales began in the last quarter of 2023. | [1] |
| Earliest archived copy of the first website | 29 April 2023 | C | The Internet Archive holds no earlier copy of ismspolicygenerator.com. The page title is "ISMS Policy Generator". The rest of the page loaded by script and could not be read. | [7] |
| Company registered in France | BETTER ISMS, 22 April 2025, Paris | B | The French register lists the trade name ISMS COPILOT and the founder as manager. Which legal form sold the product in 2023 and 2024 was not found. | [6] |
| Team, February 2024 | 1 founder, 0 employees | C | Starter Story header. The founder said he sometimes paid freelancers for advice. | [1] |
| Team, November 2026 | 2 people named | C | The About page names the founder and an engineer it calls Alex. It says the engineer helped ship the first version in 2023. | [3] |
| Time from the start date to the February 2024 figure | 4 months | calc | Calculated: October 2023 to February 2024. | [1] |
| Cost to run the product, February 2024 | about US$100 a month | C | Founder interview. He said this was only what the product needed to work. Security monitoring, insurance and accounting tools cost more. | [1] |
| Paying customers needed to cover costs, February 2024 | 2 a month | C | Founder interview: "Having 2 paid clients per month is enough to be profitable." | [1] |
| Customer lifetime value, February 2024 | US$800 | C | Founder interview. He said he expected to raise it to about US$4,000. | [1] |
| Share of trial users who stayed, February 2024 | half | C | Founder interview: "When someone trials, half of them remain a customer." The trial lasted 7 days. | [1] |
| Price rise in early 2024 | up to 4 times | C | Founder interview. He said new customers slowed down at the same time. | [1] |
| Premium plan, April 2024 | US$20 a month | C | Archived home page of ismscopilot.com, 16 April 2024. It also showed a free Basic plan and a custom Enterprise plan. | [8] |
| Users, September 2025 | more than 1,500, with 400 active each month | C | Case study by Chatbase, a vendor the product was built on. Chatbase does not say how many users paid. | [5] |
| Paid plans, November 2026 | US$24 to US$1,000 a month | C | Company pricing page. Five paid plans and a free plan. | [2] |
| Reviews shown on the home page, November 2026 | 4.8 from 30 reviews | C | Collected by the company. The page says it does not check each reviewer's identity. It says reviews from before October 2026 came through a tool that sent ratings of 3 or lower to private feedback. | [4] |
| Outside funding | none | C | About page: "There are no investors behind us." Chatbase also wrote that he built it without outside funding. | [3, 5] |

How to read this table. A grade D value rests on one source with one date. A grade C value is a statement by the founder, the company or a vendor. A grade B value comes from the French state company register. A "calc" value was computed on this page.

## Pricing

ISMS Copilot prices in US dollars, read on the company's pricing page on 10 November 2026 (grade C)

| Plan | Per month, billed yearly (US$) | Per month, billed monthly (US$) | Limit |
|---|---|---|---|
| Free | 0 | 0 | 10 messages per 4 hours |
| Plus | 20 | 24 | 600 chat credits a week |
| Standard | 41.67 | 50 | 1,250 chat credits a week |
| Pro | 83.33 | 100 | 2,500 chat credits a week |
| Business | 166.67 | 200 | 5,000 chat credits a week |
| Unlimited | 833.33 | 1,000 | no chat credit cap |

The yearly column is the yearly price divided by 12, computed on this page. The page says prices exclude VAT. One plan covers a team: the page says teammates are free, up to 50, and share the plan's usage. The API and the embed product are priced separately by usage.

## When did ISMS Copilot launch, and how did it grow? Timeline

From a no-code document generator in 2023 to a chat assistant with six plans in 2026. Each entry carries its grade.

- **Early 2023** (grade C [1]): Roth leads the ISO 27001 audit preparation at his employer, a fintech company. He has to write or update more than 80 documents and has the idea of a generator.
- **29 April 2023** (grade C [7]): The Internet Archive saves its first copy of ismspolicygenerator.com.
- **Spring and summer 2023** (grade C [1]): He builds the document generators on a no-code platform after work. He says he made no sales in these months.
- **Last quarter of 2023** (grade C [1]): The first sales arrive. He says December brought a wave of customers and covered the product's costs.
- **January and February 2024** (grade C [1]): He raises prices by up to 4 times and adds a credit system. He says new customers slow down.
- **25 February 2024** (grade D [1]): Starter Story publishes his interview. Its header reports revenue of US$500 a month, 1 founder and 0 employees.
- **16 April 2024** (grade C [8]): The archived ismscopilot.com sells an ISO 27001 chat assistant in beta. The Premium plan costs US$20 a month.
- **22 April 2025** (grade B [6]): The company BETTER ISMS is registered in Paris with the trade name ISMS COPILOT.
- **30 September 2025** (grade C [5]): Chatbase publishes a case study. It reports more than 1,500 users and 400 active each month.
- **August 2026** (grade C [3]): The company stops charging per seat. One plan now covers a whole team.
- **November 2026** (grade C [2, 9]): The pricing page lists a free plan and five paid plans. The old domain redirects to ismscopilot.com.

## What could go wrong for ISMS Copilot?

- **What is not verified.** The revenue figure rests on one source. Starter Story showed US$500 a month beside the founder's interview of 25 February 2024, and nobody outside checked it. The figure belongs to the earlier product, ISMS Policy Generator. No later figure, payment-processor profile or second interview was found. A reader could look for a TrustMRR profile or a newer founder post.
- **The figure is small and old.** The only revenue figure is from February 2024, before the chat assistant existed. The founder said then that he was not satisfied with his situation. He said the product covered its costs in December 2023 but not in January 2024.
- **Older reviews were filtered.** Ratings of 3 or lower did not become public reviews before October 2026. The home page says older reviews were collected through Senja, “which sent ratings of 3 or lower to private feedback”. The page also says the company does not check each reviewer's identity.
- **The company is younger than the product.** The French register dates the company BETTER ISMS to 22 April 2025, about two years after the first website. The founder called himself the founder of BetterISMS in February 2024. Which legal form sold the product before the registration was not found.
- **Sources disagree on the early team.** Starter Story lists 1 founder and 0 employees in February 2024. The About page of November 2026 says an engineer helped ship the first version in 2023. The founder also had a job at the time and worked 3 to 4 hours a day on the product.
- **Customers are not named.** No customer is named on the company's pages. The home page shows usage counts for four organizations and calls them “Selected customers, anonymous”. The user count of September 2025 comes from Chatbase, a vendor, and does not separate free from paying users.

## Sources

1. Starter Story, 25 February 2024: My AI Startup Helps Businesses Stay Compliant — https://www.starterstory.com/stories/isms-policy-generator (grade C). Read in full. Founder interview with a header of self-reported figures. Source for the revenue figure, the start date, the team, the costs and the sales method.
2. ISMS Copilot pricing page, read 10 November 2026 — https://www.ismscopilot.com/pricing (grade C). Read in full. Source for the plans, the prices, the team rule and where the AI runs.
3. About ISMS Copilot, read 10 November 2026 — https://www.ismscopilot.com/about (grade C). Read in full. Source for the two people, the statement on investors and the end of per-seat prices in August 2026.
4. ISMS Copilot home page, read 10 November 2026 — https://www.ismscopilot.com/ (grade C). Read in full. Source for the product description, the review score, the review note and the anonymous customer counts.
5. Chatbase blog, 30 September 2025: How a Consultant Built a SaaS in 1 Day with Chatbase — https://www.chatbase.co/blog/how-a-consultant-built-a-saas-in-1-day-with-chatbase (grade C). Read in full. A vendor's case study by Sandra Dajic. Source for the user counts and the one-day first version.
6. Recherche d'entreprises (French government company register API): BETTER ISMS, SIREN 943 594 648 — https://recherche-entreprises.api.gouv.fr/search?q=better%20isms (grade B). Read the register record on 10 November 2026. Source for the registration date, the trade name, the seat and the manager.
7. Internet Archive copy of ismspolicygenerator.com, 29 April 2023 — https://web.archive.org/web/20230429011213/https://ismspolicygenerator.com/ (grade C). Read the earliest copy. Only the page title could be read, because the page loaded by script.
8. Internet Archive copy of the ISMS Copilot home page, 16 April 2024 — https://web.archive.org/web/20240416014714/https://www.ismscopilot.com/ (grade C). Read in full. Source for the first plans, the beta status and the data processors named then.
9. ISMS Copilot Terms of Service, effective 5 November 2026 — https://trust.ismscopilot.com/en/terms (grade C). Read the sections on the products, payment and data processing. The old domain's redirect was checked with a header request on 10 November 2026.
10. Database of failed startups, local export — /method/#dead (grade C). Record pages read on the website on 10 November 2026. AI-written summaries, not independently verified. Source for the failed predecessors.

Contact: aiolum@livyden.com. Run ISMS Copilot? Send corrections or a verified figure to aiolum@livyden.com (subject: Correction: ISMS Copilot).