How it works

Five parts.
One record of your work.

Everything on leveld feeds one profile that you own. This page says what each part does, what it writes down, and what it will not do.

Professional DNA

28 vectors.
Four domains.

Professional DNA is a profile of how you work, not a personality label. It starts with an assessment and keeps learning from signals: labs, coaching sessions, retakes. Your top two domains name an archetype, and the profile shows a confidence for every vector, so you can see how much it actually knows.

Autonomy

Self-Direction
Time Management
Decision Making
Accountability
Resourcefulness
Initiative
Focus and Deep Work

Collaboration

Communication
Teamwork
Conflict Resolution
Mentoring
Cross-Functional Work
Stakeholder Management
Empathy

Innovation

Creative Thinking
Problem Solving
Adaptability
Learning Agility
Risk Tolerance
Systems Thinking
Technical Curiosity

Execution

Planning
Prioritization
Quality Standards
Deadline Management
Process Improvement
Attention to Detail
Resilience

Append-only

Every signal is kept with its date, its source and its reasoning. Nothing is edited or deleted behind the scenes. Your profile can be rebuilt as of any date.

Disputable

Disagree with a signal? Dispute it. The outcome is a new signal on the record, with its own reasoning, never a silent change to the old one.

Exportable

Your signals, scores and narrative export in one call. Delete your account and they go with it.

The GRC ladder

Six rungs.
Three branches.

Each rung says what you own there and the signal that you are ready to prepare for the next one. Your role path is your current rung, your target rung, the gaps between them and the next thing to do. Gary works from it.

#	Rung	You own	Ready for the next rung when
1	GRC Analyst	Evidence collection, control testing, questionnaires	You have run one full audit cycle and can explain why each control exists
2	Senior Analyst / Compliance Lead	One framework end to end, the auditor relationship	You have scripted away one recurring evidence task
3	GRC Engineer	Evidence automation, API integrations, compliance checks in CI	Your automation covers a whole control family and other teams depend on it
4	Senior GRC Engineer	Control architecture, common controls across frameworks, continuous monitoring	You are setting standards other engineers build to
5	Staff GRC Engineer / GRC Engineering Manager	Program design, tooling strategy, or a team	You own budget, board reporting, or risk decisions
6	Director / Head of GRC	The whole risk and compliance function	Deputy CISO or CISO is the next move

Federal

ISSO / ISSM at rung 3, FedRAMP Lead / Assessor at rung 4

Customer trust

Security Assurance Engineer at rung 3

AI governance

AI Governance Engineer at rung 3

The ladder is a first draft, written by the founders from the jobs they have held and hired for. Member data refines it.

Gary

A coach,
not a chatbot with a job board behind it.

Gary is an AI coach for GRC engineering work. It reads your role path and your lab results and coaches from there. Ask it to explain a control family, rehearse a hard conversation, or plan the next 90 days toward your target rung. The first simulation: an auditor asks for access review evidence and you only have part of it.

What Gary learns about how you work can become signals on your Professional DNA, each one with its reasoning shown. You can pause that at any time from settings. Coaching keeps working; nothing new gets written to your profile.

What Gary will not do

Invent evidence, or help you present evidence you do not have.
Give legal advice. It can explain a requirement; a lawyer tells you what to do about it.
Score you without saying why.
Pitch you jobs. There are none here.

Gary runs on an AI model provider under terms that bar training on your conversations. Our privacy policy names the provider.

Skills Lab

Paste your work.
Get graded.

Labs are written by the founders and, over time, by members. Each one is a real task from the job. You do the work in your own tools, paste the result, and get graded against what a senior engineer would accept.

Automate evidence

Take one recurring piece of evidence and script its collection.

Control as code

Write a control so a pipeline can check it.

Prose to OSCAL

Turn a written control into OSCAL that validates.

Training labs come with hints and count a little. Challenge labs have no hints and count in full. Results stay on your profile whatever tier you are on, and each lab is tagged to the rungs it supports, so your path can point at the right one.

Pay data

What GRC engineers make,
from GRC engineers.

Submit base, bonus, equity, region and years of experience, tied to a rung and a branch. The median is free to everyone, because the dataset is only worth something if people submit. Paid members see the breakdown by rung and branch.

A submission carries no user ID. It stores a one-way hash used only to stop duplicates. Nothing in it can be traced to your account, which also means it survives if you delete your account, because there is nothing to tie it to.

Your data

Private by default.
Gone when you say so.

A screen name

Generated at signup, something like Slate Falcon. Change it once every 90 days. Old names are reserved for a year so nobody can be mistaken for you. Show your real name only if you want to.

Private until you say otherwise

Your profile starts private. Only you change that. No employer sees it, because there are none, and any future sharing is by your explicit consent.

Sign in without a password

Passkeys, or a password with an authenticator code, or a one-time code by email. Your choice.

Delete means delete

Every table that holds your data hangs off one account ID. Deleting your account removes all of it in one statement and cancels your subscription. The audit log keeps that a deletion happened.

An audit log, from day one

Every read of your profile and every founder action on your account is written down. Nothing happens to your record without a trace.

No third-party analytics

No tracking pixels, no analytics scripts. If you opt in, usage events go into our own database and nowhere else. Logs carry IDs, never email addresses.

Invite-only beta.

The first members come by invitation, one at a time, from the GRC engineering community. Invites open when the app is ready.