Watch a breach get computed.
Below is a real, unedited run of the Qgentic engine — offline, on the synthetic GRC export bundled with every download. Pennine Rose Building Society (a fictional UK-only firm — exactly who DORA doesn't reach) had two incidents this period. One resolved inside its tolerance. One ran 14.5 hours against a 12-hour tolerance — and the engine computed the breach from timestamps. This is the engine underneath — shown for transparency: in the product, people review and approve in the Qgentic console. Then try the determination yourself.
See the console through a full run.
A guided, narrated walkthrough of the real Qgentic console — the screen your team works in. It runs the whole cycle itself: services and incidents read from your GRC export, a tolerance breach computed from timestamps, a named person approves, the regulator package prepared and hashed. No terminal, no input required. See how Qgentic collects this data from your ERP →
The same run, at the engine level.
Transcript of an offline run on the bundled sample data (service start-up lines condensed).
Reproduce it with the evaluation binary — QGENTIC_PACK=opres qgentic run — and take the approval yourself.
Four moments worth pausing on.
1 · The breach was computed from timestamps
INC-2026-052 was detected at 21:30 and resolved at 12:00 next day — 14.5 hours, calculated from timestamps. Online banking's board-approved tolerance is 12 hours. Breach: true, by arithmetic. A hand-set flag that disagrees is refused as validation error OPRES-TOL-008.
2 · Supervisory findings surfaced early
Albion Cloud is material with no documented exit plan (OPRES-EXIT-011). Crown Core Banking is material, difficult to substitute, and sub-outsourced — a concentration-risk flag (OPRES-SUB-012). Better your dashboard raises these than your supervisor.
3 · A named approval gated the package
The submission summary put the tolerance breach in front of the approver — then a scoped, HMAC-signed grant valid for 120 seconds authorised exactly one preparation: register CSV, services CSV, incident report, hashed manifest.
4 · The evidence re-verifies
Every step landed in a SHA-256 hash chain, re-verified at the end of the run. The prepared package goes to your existing FCA RegData/Connect or PRA channel — with proof of how every number was derived.
Download the submission package this run produced.
The run above ends by preparing a package for your regulator channel, and this is it — the actual files, unedited. The data is synthetic (Pennine Rose Building Society is fictional), but the identifiers are checksum-valid and the 14.5-hour tolerance breach you watched being computed is in the incident report.
| File | What it is |
|---|---|
| third-party-register.csv | The register of third-party arrangements, mapped to the services they support |
| important-business-services.csv | The firm's important business services and their impact tolerances |
| incident-report.json | The operational incidents, with computed durations and the breach determination |
| manifest.json | A SHA-256 hash for every file in the package |
| pipeline-summary.json | Everything that happened in the run, including the audit-chain verification |
Open incident-report.json and find INC-2026-052 — the breach flag was calculated from its timestamps.
Tolerance breach, live in your browser.
The same computation the engine runs — duration against the affected service's impact tolerance — ported to this page. Nothing you enter leaves this tab.
Assess an incident
Services and tolerances from the bundled sample firm.
Now try to overrule it
Source systems sometimes "remember" incidents kindly.
See the other platforms, or run it for real.
The download runs this exact pipeline on your hardware, fully offline. Sample data included.