Approach
Practical, documented and independent.
We fix the workflow, then write down why it's safe in the format your assessor and your buyers already use.
01 / Clear boundaries
What we are, and what we're not.
Hands-on, not slideware.
We write the evaluations, controls and documentation with your team. You keep everything we build.
Not a security firm.
We don't sell pen tests or SOC monitoring. We secure the AI workflow itself.
Not an auditor.
We get you ready and work alongside your assessor, never instead of one.
Not another AI agency.
We don't chase demos. We finish the unglamorous work that gets AI approved and used.
02 / We speak auditor
Every framework, mapped to something you can hand over.
Your AI workflow inherits every obligation your organization already has, plus a few new ones. We map them before they become findings.
| Framework | What the reviewer asks | What we hand you |
|---|---|---|
| HIPAA Privacy and Security Rules | What the reviewer asks:Where does PHI go, who can access it, and is access logged? | What we hand you:PHI data-flow map, access design and logging review |
| Business Associate Agreements | What the reviewer asks:Does every vendor that touches PHI have a BAA? | What we hand you:BAA chain with sub-processors, retention and training terms |
| HITRUST CSF and HITRUST AI Security Assessment | What the reviewer asks:Are AI-specific controls in place, and is there evidence? | What we hand you:Control mapping and evidence collection plan |
| SOC 2 | What the reviewer asks:Do the controls cover the AI features and operate over time? | What we hand you:Control mapping for AI components and an evidence plan |
| ISO/IEC 42001 | What the reviewer asks:Is there an AI management system with owners and risk assessment? | What we hand you:AI inventory, risk register and policies |
| NIST AI RMF | What the reviewer asks:Have AI risks been identified, measured and managed? | What we hand you:Threat model, evaluation results and monitoring plan |
| OWASP Top 10 for LLM Applications | What the reviewer asks:Is the app tested for prompt injection, data leakage and excessive agency? | What we hand you:Injection and leakage test results, least-privilege design |
| ONC HTI-1 decision support transparency | What the reviewer asks:For certified health IT: are decision support source attributes disclosed? | What we hand you:Source attribute documentation for the AI feature |
| Section 1557 nondiscrimination | What the reviewer asks:Could a decision support tool used in patient care discriminate? | What we hand you:Use review and checks on your own data |
| State AI and privacy laws | What the reviewer asks:Which state rules apply to this use? | What we hand you:Obligations map for the states you operate in |
We prepare you for assessments. We don't certify you - that independence belongs to your assessor, and we'll help you choose one.
03 / How we handle PHI
The same rules we ask of your vendors.
BAA when needed
We sign a BAA when the engagement requires access to PHI.
Your environment
We prefer to work inside your environment and accounts, so PHI stays under your controls.
Least data
We use synthetic or de-identified data wherever the task allows.
No PHI by email
Please don't email us PHI. When the work needs it, we set up a proper channel.
Have a pilot stuck in review?
Tell us what you built and where it's blocked. We'll tell you honestly whether we can help.