AI security and governance services, in plain language.

For any organization that wants a clear picture before AI use grows further.

A fixed-price review of every AI tool and AI feature in use, the data that flows into them, and the controls around them. You get a prioritized action plan in plain language.

• Interviews with leadership and key staff
• AI inventory and data-flow review
• Gap analysis against NIST AI RMF, ISO/IEC 42001 and HIPAA where applicable
• Written report and a 60-minute readout
• Full scope and pricing →

For home care and home health agencies, clinics and small practices.

Everything a small healthcare organization needs to start using AI responsibly, bundled with the HIPAA Security Risk Analysis you are already required to do.

• AI inventory and use policy
• AI vendor and Business Associate Agreement checklist
• Staff training session with sign-off
• HIPAA Security Risk Analysis
• See the starter package →

For organizations that need written rules, named owners and an approval process.

We write the policy with you, not for a shelf. It says which tools are approved, what data is off-limits, who approves new tools, and what happens when something goes wrong.

• AI acceptable-use policy in plain language
• Roles: AI owner, approvers, reviewers
• New-tool request and approval process
• AI incident response steps
• Alignment to NIST AI RMF Govern function and ISO/IEC 42001

For leaders who suspect staff are using AI tools no one approved.

Using your existing Microsoft 365 or Google Workspace logs, browser and endpoint data, and short staff surveys, we find which AI tools are in use, by whom, and with what data, without a witch hunt.

• Review of sign-ins, OAuth app grants and browser extensions
• Identification of AI features inside existing software
• Staff survey designed to get honest answers
• Findings ranked by data sensitivity
• Recommendations: approve, replace or block

For any organization about to buy, renew or expand an AI product.

We read the contracts, privacy terms and security documentation so you know whether a vendor trains on your data, where data is stored, and what happens if they are breached.

• Data use, retention and model-training terms
• Security controls, certifications and sub-processors
• BAA availability for healthcare data
• Admin controls, SSO and audit logging
• Clear recommendation with conditions

For businesses deploying chatbots, copilots, AI agents or AI integrations to staff or customers.

Hands-on testing of your AI application against the OWASP Top 10 for LLM Applications, including prompt injection, sensitive data disclosure and excessive agency.

• Direct and indirect prompt injection
• Sensitive information disclosure and data leakage
• Access control and excessive permissions for AI agents
• Output handling and misinformation risks
• Report with reproduction steps and fixes

For organizations that need ongoing AI oversight without a full-time hire.

A monthly retainer that gives you a named, credentialed AI governance lead who keeps your inventory, policy and vendor reviews current and runs the quarterly review.

• Monthly check-in and on-call questions
• New AI tool and vendor reviews
• Quarterly AI governance review and board-ready summary
• Policy and training updates as tools and rules change
• Coordination with your IT provider and counsel
• Tiers, pricing and FAQ →