AI-ASSISTED PROCESS DOCUMENTATION FOR U.S. SOX & ICFR

Turn operational knowledge into reviewable process documentation for U.S. SOX and ICFR work.

Use process names, notes, meeting minutes, and existing policies or manuals to generate BPMN flow drafts with approvals, branches, exceptions, and cross-functional handoffs. Review and refine the draft with process owners, then use the same flow for risk-and-control mapping, operational improvement, and export.

Start free →View features

Start without a credit card

BPMN 2.0 format
AI-directed edits
Three-document Excel set and multi-format export

WHY DOCUMENTATION STALLS

Until the process is documented, control evaluation, improvement, and system decisions cannot move forward.

Internal-control reporting, IPO readiness, and audit support all require procedures, decision criteria, exceptions, and segregation of duties to be presented in a form a third party can review.

Documents drift from actual operations

Flowcharts are not updated for organizational or system changes, and teams spend evaluation and audit time explaining the differences.

Decisions, exceptions, and control points go unrecorded

Approval criteria, rework, and changes of ownership are not documented, leaving little material to explain how controls are designed.

Creation and maintenance depend on a few people

The effort from interviews to diagramming concentrates on specific staff, so expanding coverage and periodic updates are postponed.

HOW ADOPTION WORKS

Create a draft from available materials, then finalize it through departmental review.

Finished procedure manuals are not required. Start from what you know, and refine the draft with process owners, corporate functions, and IT.

Enter your materials

Enter process names and notes or attach meeting minutes and existing rules or manuals when generating a flow.

Generate a BPMN draft

Generate a flow draft with owners, procedures, decisions, exceptions, and systems, with connectors placed automatically.

Review and revise by department

Compare the draft with actual operations and ask AI to revise owners, branches, exceptions, and control points before using it for evaluation, improvement, or system planning.

FEATURES

Start from the process flow and continue through editing, improvement, controls documentation, and export.

Draft generation from varied inputs

Generate BPMN 2.0 drafts from a process name alone, pasted notes and meeting minutes, or Word, Excel, and text files attached for a single generation, including branches, parallel work, rework, and multiple lanes for departments and roles. Existing BPMN XML and Visio diagrams can also be imported.

Automatic layout and AI-directed edits

Element placement and connector routes are arranged automatically. After generation, describe the change to AI and review its proposal before applying it to the flow.

RCM and operations list together

Generate and edit an RCM mapped to each stage of the flow, plus an operations list covering operators, operations, systems, and related documents. In J-SOX documentation mode the RCM extends to assessment fields such as procedures and evidence locations.

Risk and control mapping with operations lists

Generate and edit an RCM mapped to each step, with owners, activities, systems, and related evidence. Use the mapping as review material for process owners, internal control, and audit stakeholders; it does not replace their control-design or assessment judgment.

As-Is analysis and To-Be design

Extract candidate problems from the current flow with ECRS-style checks, and let staff adopt or reject each problem and improvement idea. The To-Be flow is generated only within the adopted scope, with an As-Is/To-Be diff view for confirmation.

J-SOX documentation and assessment workpapers

Export the flowchart, process description, and RCM as the standard three-document Excel set. Assessment workpapers are designed so that recording, review, and locking are performed by people; AI cannot finalize assessment judgments.

U.S. SOX and ICFR documentation workpapers

Export the flowchart, process narrative, and RCM as a linked Excel documentation set. Assessment workpapers support staff-led recording, review, and lock steps; AI does not make or finalize compliance or audit decisions.

SECURITY AND DATA PROTECTION

We state the operating boundaries and responsibilities for business data.

NinjaFlow is provided as a cloud service. The application runs on Railway with Supabase authentication and persistent data services. We manage platform-provider controls separately from the authorization, configuration, and operations we operate. The following data-protection posture applies to the standard service today.

Handling input data

Handle personal data, trade secrets, customer-specific information, and unpublished financial information under your internal rules and contractual conditions. Where appropriate, anonymize, summarize, or mask names, amounts, and identifiers before input. When AI features are used, the processing terms of the selected AI provider also apply.

Access control and tenant boundaries

Access is controlled per authenticated workspace. Operations on flows, members, and sharing settings are validated server-side against tenant boundaries and roles.

Secrets stay out of the browser

Secret values such as service-role and AI API keys are not sent to the browser and are limited to server or worker execution environments. Input content and keys are handled by design outside operational logs and job records.

Storage, history, and recovery

Flows retain revision history, and deleted flows are handled as recoverable records. Authentication and persistent data are managed on Supabase and kept separate from the application runtime.

Shared responsibility with platform providers

The availability, physical protection, and platform controls operated by Supabase and Railway are distinct from the access control, application configuration, and operational monitoring that we operate. Use the standard service with that responsibility boundary in mind.

Requirements outside the standard service

Customer-only data retention, dedicated environments, customer-managed AI, and specific audit material or authentication methods are not part of the standard service. Where needed, they require requirements definition, individual implementation support, and a separate quote.

WHO USES IT

Listed companies, IPO-preparing companies, and audit firms review the same flow from their own standpoint.

AI creates a reviewable draft. Each function reviews and edits it for its own purpose and responsibility before using it for evaluation, improvement, or adoption decisions.

Internal control and internal audit at listed companies

When flowcharts and RCMs in the evaluation scope need maintenance

Create drafts from existing documents and minutes, then review control points, approvals, and exceptions while updating. Staff review remains the basis for judging the output.

CFO and corporate functions at IPO-preparing companies

When process and control documentation must progress ahead of listing review

Even with a small team, prepare drafts of flowcharts, RCMs, and operations lists from available materials, and build the internal documentation that external discussions are based on.

Audit firms and advisory teams

When process understanding and documentation support need to be efficient

Create flow drafts from interview notes and obtained documents, confirm them with the client, and use RCMs, workload estimates, and exports when planning deliverables.

Process improvement, BPR, and shared services

When operations must be visualized before standardization or consolidation

Align processes across sites and departments as flows, and use rework, waits, and handoffs to identify standardization targets.

DX, IT, and systems departments

When business requirements need a common basis before system planning

Organize operational information into flows so business and IT can align. Dedicated environments or customer-managed AI are subject to requirements definition and individual implementation support.

Security, legal, and procurement

When data handling and adoption conditions must be reviewed before contracting

Confirm required data location, access, retention, authentication, AI-use conditions, and integrations before contracting. Confirm DPA, subprocessors, SLA, and audit materials individually where needed; individual requirements are separately quoted.

WHAT THE FLOW SUPPORTS

Give stakeholders one view of the process before evaluation, improvement, and investment decisions.

Internal-control documentation

Maintain flowcharts, RCMs, and operations lists in a linked form, as base material for explaining control design and for evaluation work.

IPO preparation and listing review

Organize processes and controls early, feeding into rules and management-structure readiness.

Improvement and standardization

Visualize rework, waiting, and handoffs to make improvement themes and standardization targets specific.

System planning

Business and IT reference one flow when aligning requirements and project scope.

EXAMPLE PROCESSES

Month-end and annual closeSales, billing, and collectionProcurement and paymentFixed-asset managementInventory countExpense reimbursementHR and payrollAudit support and control evaluationMonth-end and annual closeSales, billing, and collectionProcurement and paymentFixed-asset managementInventory countExpense reimbursementHR and payrollAudit support and control evaluation

PRICING

Choose by process coverage and scale of use, from trial to company-wide adoption.

Free

Try mapping one business process

¥0/mo

BPMN flow generation
PDF and PNG export

Limits and overage details

Seats included: 1
Standard monthly use: 3 flows · 60K AI tokens (input + output)
Active stored-flow cap: 3
250 MB generated-flow storage; up to 2 source documents per generation (up to 10 MB each); batch export 20 flows / 25 MB; 10 revisions for 30 days; Personal project only (no shared projects, viewers, or invites).
No usage overage (generation resumes in the next month after a cap is reached)

Start free

Plus

Create and export your own process flows

¥3,080/mo

Everything in Free
All export formats, including Excel

Limits and overage details

Seats included: 1
Standard monthly use: 25 flows · 100K AI tokens (input + output)
Active stored-flow cap: 100
2 GB generated-flow storage; up to 5 source documents per generation (up to 25 MB each); batch export 20 flows / 25 MB; 50 revisions for 180 days; Personal project only (no shared projects, viewers, or invites).
Annual base fee: ¥29,568 (20% off the monthly base fee)
Overage: the higher of ¥60 per flow or actual token charges (input ¥5/1K; output ¥25/1K)
Monthly overage cap: ¥5,000

View paid plans

Pro

Individually maintain many process flows

¥10,780/mo

Everything in Plus
Largest individual quota
For high-volume flow authoring

Limits and overage details

Seats included: 1
Standard monthly use: 120 flows · 410K AI tokens (input + output)
Active stored-flow cap: 500
10 GB generated-flow storage; up to 10 source documents per generation (up to 50 MB each); batch export 50 flows / 50 MB; 200 revisions for 365 days; 5 shared projects; 0 viewers; 0 pending invites.
Annual base fee: ¥103,488 (20% off the monthly base fee)
Overage: the higher of ¥60 per flow or actual token charges (input ¥5/1K; output ¥25/1K)
Monthly overage cap: ¥20,000

View paid plans

Team

Share and manage process flows as a team

¥10,780/mo5 seats included

Everything in Plus
Member invitations and roles
Team flow sharing

Limits and overage details

Seats included: 5 · Additional ¥1,320/seat / month
Standard monthly use: 100 flows · 400K AI tokens (input + output)
Active stored-flow cap: 1,000
50 GB generated-flow storage; up to 10 source documents per generation (up to 50 MB each); batch export 50 flows / 50 MB; 200 revisions for 365 days; 25 shared projects; 25 viewers; 20 pending invites.
Annual base fee: ¥103,488 (20% off the monthly base fee); additional seats ¥15,840/seat / year
Overage: the higher of ¥60 per flow or actual token charges (input ¥5/1K; output ¥25/1K)
Monthly overage cap: ¥20,000

View paid plans

Business

Standardize and manage flows across departments

¥32,780/mo20 seats included

Everything in Team
Pre-adoption review of audit and administration requirements
Implementation and operating-requirements review

Limits and overage details

Seats included: 20 · Additional ¥1,980/seat / month
Standard monthly use: 400 flows · 1.2M AI tokens (input + output)
Active stored-flow cap: 5,000
250 GB generated-flow storage; up to 25 source documents per generation (up to 100 MB each); batch export 100 flows / 100 MB; 1000 revisions for 1095 days; 100 shared projects; 100 viewers; 100 pending invites.
Annual base fee: ¥314,688 (20% off the monthly base fee); additional seats ¥23,760/seat / year
Overage: the higher of ¥60 per flow or actual token charges (input ¥5/1K; output ¥25/1K)
Monthly overage cap: ¥50,000

View paid plans

Enterprise

Deploy as a large-scale business platform

¥150,000+/mo

Everything in Business
Annual-contract and individual-implementation consultation
Private deployment or customer-managed AI is separately scoped and quoted

Limits and overage details

Seats: unlimited
Standard monthly use: 2,500+ flows · 6M AI tokens (input + output)
Monthly AI token cap: 8M · Active stored-flow cap: 10,000
Storage, projects, viewers, invites, per-generation file input, batch export, history, and overage caps are set by contract (starting envelope: 1024 GB generated-flow storage; 5000 revisions / 2555 days).
Overage: the higher of ¥60 per flow or actual token charges (input ¥3.83/1K; output ¥19.13/1K)
Monthly overage cap: ¥250,000

View paid plans

Displayed monthly and annual amounts include Japanese consumption tax. Annual billing discounts the monthly base fee by 20%. Team and Business additional seats are billed at 12 months even with annual billing; paid-plan overages are billed separately. Review the total at checkout. Dedicated environments or customer-managed AI require separate requirements review and quotation. Published plan prices are denominated in Japanese yen (JPY) and include Japanese consumption tax.

FAQ

Questions, answered

Can we use it before documentation is complete?

Yes. Start from process names, notes, and meeting minutes entered or attached for a generation. Treat generated results as drafts and confirm them with the departments that run the process.

How should generated content be treated?

AI-generated flowcharts, RCMs, operations lists, and workload estimates are drafts. Accuracy and control suitability are confirmed and corrected by your staff, and flow revisions can be requested through AI.

Can it support U.S. SOX, ICFR, and IPO-readiness documentation?

It supports preparing and updating flowcharts, RCMs, and operations lists. Control design, operating effectiveness, management conclusions, and audit treatment remain the responsibility of your company and auditors.

Can I enter highly confidential information?

Confirm your information-management rules, contractual restrictions, and intended environment before input. When appropriate, anonymize or summarize company names, personal names, amounts, and contract terms.

Can I keep data only in our environment?

Customer-only data retention, customer-managed AI, and dedicated or individual environments require requirements definition, individual implementation support, and a separate quote after reviewing connection, operating responsibility, and audit requirements.

Can I try it free?

Yes. Start without a credit card.

Create the first reviewable process document from materials you already have.

Review the draft with process owners, corporate functions, and IT, and shape it into material for control documentation, improvement, and system planning.

Start free →