Qorelo

Read and write access to SAP is documented, along with the credential model. The Security FAQ says Qorelo reaches SAP "through standard SAP-supported interfaces (RFC, OData, SAP Cloud Connector), using credentials your team provisions and revokes," with permissions scoped to what the team grants: usually read only on production, with write access limited to systems outside production.

On the migration page the Legacy Intelligence Agent reads ABAP, custom Z objects and dependencies along with usage, the Discovery Agent consolidates documentation "from every tool your program already uses," and process flows are reconciled against SAP Best Practices in Signavio. Evolve queries master data, GL balances, open orders and inventory from the live tenant, read only.

Beyond SAP, whether connectors are native or wired up per customer is not documented, and neither are custom tools. An Other Systems page names Salesforce, Dynamics, Oracle, Workday and NetSuite.

Sourceqorelo.com/security FAQ, qorelo.com/s4hana-migration, qorelo.com/evolve; readread 2026-09-15

Agents are assigned by program phase over a shared knowledge base, but the sequence belongs to the SAP methodology and the team running it, not to an orchestration layer in the product. The Legacy Intelligence and Discovery Agents work in Discover, the Fit-Gap and Configuration Agents in Realize, and release management and governance agents in Deploy. Their outputs accumulate in "one shared knowledge base," and the route adapts to a Greenfield, Brownfield or Selective transition. That is a real structure of several agents.

The product is not described as sequencing, branching or retrying work, nor as routing it or mixing deterministic steps with agent steps. The seven phases are SAP Activate, SAP's delivery methodology, and the How we deliver page has the agents "work inside SAP Activate or your own method" in "sessions your team leads." No handoff, branch or fallback between agents is described. Agent and app building on SAP BTP is a roadmap item planned for Q4 2026.

Sourceqorelo.com/s4hana-migration, qorelo.com/how-we-deliver, qorelo.com/platform, qorelo.com/evolve roadmap; readread 2026-09-15

The agents draw on one shared knowledge base built from the customer's own SAP estate and program documents. The platform, migration and Evolve pages describe "14 specialist agents across all seven phases" with "one shared knowledge base underneath." Ingestion covers the customer's ECC system, from ABAP and custom Z objects to dependencies and usage, and program documentation the Discovery Agent "consolidates from every tool your program already uses," with requirements "extracted from context, not re-typed from sessions."

The store persists and can be queried. Evolve's decision memory keeps every implementation decision, the alternatives considered, and who decided and why, "queryable forever," alongside plain English search over configuration, master data and business processes, as well as integration logic. Customer data is never used to train models, so new knowledge is added without retraining, and decisions are documented "with reasoning and source."

Permissions per source and the handling of stale or conflicting documents are not documented, and the knowledge base is described on marketing pages rather than in documentation.

Sourceqorelo.com/evolve, qorelo.com/s4hana-migration, qorelo.com/platform; readread 2026-09-15

The approval gate is stated as product behavior. Under "Reviewable by your team," the Security page says: "Nothing changes in your system without human sign-off. Every Qorelo recommendation is transparent, traceable, and reversible." The migration page repeats that "every recommendation is reviewable before anything changes," and the platform page separates the agents' work from "your delivery team + your leads: judgment & sign-off" at every phase. Sign off and reversibility are Qorelo's own; the read only default on production comes from the SAP authorizations the customer grants.

The gate is stated rather than shown. No approval queue or checkpoint settings appear, and routing approvals into existing channels, autonomy modes by risk and explanations of why a checkpoint fired are not documented.

Sourceqorelo.com/security, qorelo.com/s4hana-migration, qorelo.com/platform; readread 2026-09-15

A held attestation and access controls for customers are both documented. The Trust Center linked from qorelo.com/security, hosted on Kantis and published by Qorelo GmbH, lists ISO 27001 certified by Tempo Audits, valid May 2026 to May 2029, with the certificate PDF under NDA (updated 26 August 2026), and a SOC 2 Type 1 report by Dansa D'Arata Soucia LLP, May 2026. That names a certificate, an auditor and a date.

The Security FAQ states "your team controls access through role-based permissions," "SSO (SAML / OIDC) is supported by default," every workspace is logically isolated, and "admins set retention policies." Customer code, configuration and requirements, along with documents, are never used to train models, a rule enforced by contract with model providers under Zero Data Retention.

The badge strip on the Security page (alt text AICPA SOC 2, ISO, EU GDPR) matches the Trust Center; GDPR is listed as a program, not a certification.

Sourceqorelo.com/security, trust.getkantis.com/qorelo-gmbh; readread 2026-09-15

Every action, decision and document is logged in the customer's workspace, according to the Security page, and audit logs can be exported. Under "Audit-ready by default," it says "every action, decision, and document is logged in your workspace," and the FAQ adds that "audit logs are exportable." A buyer can inspect what happened after the fact, though the log is described on a security page without the surface itself being shown.

Inspection of prompts, tool calls and retrieved knowledge step by step is not documented, nor are audit logs kept apart from runtime traces or retention by plan. Admins set retention policies. Evolve's drift monitoring reads the customer's SAP system rather than the agents.

Sourceqorelo.com/security; readread 2026-09-15

Learning and a decision record are what carry the word memory here; no agent memory with a stated scope and lifetime is documented. Evolve "moves in and keeps learning" the customer's configuration and decisions, along with workflows and tickets, which is learning across sessions rather than a memory layer. Decision memory is a queryable record of implementation decisions, which makes it part of the knowledge base. No session, conversation or workflow memory is documented as agent run state, and no long term memory either, so there is nothing to review, edit or delete, or to scope.

Sourceqorelo.com/evolve, qorelo.com/s4hana-migration; readread 2026-09-15

The customer chooses where it runs, and a default residency is named. Asked where SAP data is hosted and processed, the Security page FAQ answers: "You choose. Qorelo can run in your private cloud (AWS, Azure, GCP), your existing SAP BTP environment, or on-premise. Default deployment is EU-hosted with data residency in Germany." Data storage can be pinned.

One tension stands out. The page says "your SAP data never leaves the environment you control," while the Trust Center lists OpenAI as LLM provider with Zero Data Retention and EU residency, so model traffic leaves a deployment the customer hosts for inference under those terms. Whether a private cloud or on premises deployment can keep model traffic elsewhere is not documented, nor are feature differences between modes or who patches each one.

Sourceqorelo.com/security FAQ, trust.getkantis.com/qorelo-gmbh subprocessors; readread 2026-09-15

Of the 14 specialist agents described, only some are named, and they are sold by work package rather than as units a buyer picks. The migration page names four with their jobs, the Legacy Intelligence and Discovery Agents and the Fit-Gap and Configuration Agents, plus release management and governance agents left unnamed. The How we deliver page counts "all 12 delivery agents" at the Scale stage, which disagrees with the 14 given elsewhere. Each named agent does a distinct job.

Most of the set is unnamed, and adoption runs through a work package, not an agent. Trial is "one work package... fixed scope, fixed price," Embed puts "the agent layer" inside the running program, and Scale brings in all delivery agents. The Evolve roadmap puts the catalog in the future ("Expanded agent catalog, H2 2026, the custom-agent launch set grows into a full catalog, beta to GA").

Sourceqorelo.com/s4hana-migration, qorelo.com/how-we-deliver, qorelo.com/evolve roadmap; readread 2026-09-15

Migration work starts when a person asks, but after go live Qorelo Evolve describes monitoring that starts work nobody requested. During migration, agents work in "sessions your team leads." After go live, three pages describe the monitoring in the present tense.

The platform page says "After go-live, Qorelo monitors system drift against the approved configuration baseline," and the migration page says Evolve "monitors configuration drift, assesses each SAP release against your landscape."

Under System health monitoring, the Evolve page lists the job to "monitor the live SAP landscape against the approved baseline and detect where the system starts to drift," with each February and August SAP release assessed before it reaches the customer's tenant. Drift in the live system and an arriving SAP release start the work.

The description is on marketing pages, with no cadence, event mechanism or channel named, and Evolve switches on only at go live, though drift monitoring sits in the section on current capability, not the roadmap. Change request intake starts from a request a person files, and no schedule, webhook or messaging channel is documented, nor any handling of duplicates. Evolve's monitoring may run on request rather than continuously.

Sourceqorelo.com/evolve, qorelo.com/platform, qorelo.com/s4hana-migration; readread 2026-09-15

One model provider is named, and there is no choice. The Trust Center's subprocessor list names three processors, AWS, GitHub and OpenAI, Inc., the last as "LLM provider, Zero Data Retention, EU residency." With a single provider named, the lack of choice is visible rather than inferred. The vendor controls the model: no selector, workspace policy or bring your own model path is documented, including for private cloud and on premises deployments.

The Security FAQ refers to "all model providers we use" in the plural without naming a second, and with one provider listed, no routing across providers is disclosed. AWS and GitHub are infrastructure, and SAP Joule, named on the Evolve page as running alongside Qorelo agents, is SAP's assistant in the customer's tenant, not a model Qorelo routes to.

Sourcetrust.getkantis.com/qorelo-gmbh subprocessors, qorelo.com/security FAQ; readread 2026-09-15

Nothing documented makes Qorelo itself callable: there is no API, SDK or MCP server. /llms.txt returns 404, the docs., dev. and api. subdomains do not resolve, nor do trust. and app.qorelo.com, and the sitemap's 37 URLs contain no API, developer or MCP page. The Security page says "workspace, agents, documentation, and configurations are exportable in full," which is data portability, not an integration surface.

"Agent & app building on SAP BTP" is marked in development for Q4 2026 on the Evolve roadmap, not shipped. Qorelo reaches SAP through RFC, OData and SAP Cloud Connector, which is Qorelo calling SAP rather than anything calling Qorelo.

Sourceqorelo.com/security, qorelo.com/sitemap.xml, qorelo.com/evolve roadmap; readread 2026-09-15

Nothing on the site evaluates the agents' own output; everything that looks like testing tests the customer's SAP system or is marketing. Fit gap analysis weighs the customer's requirements against SAP standard, which is the product's output, not a test of the agent. Evolve's "release confidence" assesses each SAP release against the customer's configuration, which tests the customer's system.

"Release QA, embedded, with automated regression testing" is on the roadmap for H2 2026 to H1 2027 ("In development now. Dates are plans, not commitments") and also targets the SAP system. The "45% reduction in total time to completion" is captioned "estimates based on selected Qorelo engagements," the vendor's benchmark of its own product.

No fixtures, mocks or datasets for testing workflows before production are documented for the agents, and no scoring of output quality over time.

Sourceqorelo.com/evolve, qorelo.com/s4hana-migration, qorelo.com/platform; readread 2026-09-15

SAP is reached through machine interfaces, not a screen. The Security FAQ says Qorelo connects "through standard SAP-supported interfaces (RFC, OData, SAP Cloud Connector)," so a change to a user interface has nothing to break. No SAP GUI scripting, browser or desktop control is described anywhere on the site. Generating BPMN process flows and reconciling them in Signavio is output and integration, not computer use.

Sourceqorelo.com/security FAQ, qorelo.com/s4hana-migration; readread 2026-09-15