AI governance and security
Use AI with confidence: clear rules, safe tools, secure deployments.
Most teams are already using AI, often without rules. We put practical guardrails in place: an AI policy people follow, vendor and data reviews, private deployments on AWS Bedrock or Azure AI Foundry, and testing of your AI apps against prompt injection and data leaks. Sized for a growing company, not a bank's compliance department.
Why it matters now
The biggest AI risk for most companies isn't a rogue model. It's employees pasting customer data into personal accounts, AI features switched on inside tools nobody reviewed, and pilots that reach production without anyone checking what they can access.
Good governance makes AI safer and faster to adopt. Clear rules and approved tools mean people stop guessing, legal stops blocking, and the projects that matter get through review.
We work hands-on with enterprise AI platforms and secure cloud deployments, and we turn frameworks like the NIST AI Risk Management Framework into a short set of rules and checks your team can actually run.
What's included
Policy and governance
- AI acceptable use policy and approved tool list
- Inventory of where AI is already used, including shadow AI
- Risk tiers so low-risk uses move fast and high-risk ones get review
- Roles, approvals and a simple intake for new AI use cases
Vendor and data risk
- AI vendor reviews: data retention, training use, residency, access
- Contract and DPA checklists for AI features
- Data classification: what can and can't go into which tools
- Answers for your customers' AI security questionnaires
Secure deployment
- Private model access on AWS Bedrock, Azure AI Foundry or Google Vertex AI
- Single sign-on, least-privilege access and audit logging
- Secrets, network and data boundaries for AI apps and agents
- Monitoring, cost controls and usage reporting
AI app security testing
- Prompt injection and jailbreak testing
- Data leakage and access control checks for assistants and agents
- Guardrails for tools and actions agents can take
- Evaluation sets that catch quality and safety regressions
How it runs
Inventory
Find where AI is used today, what data it touches and who owns it.
Set the rules
A short policy, approved tools, risk tiers and an intake process, reviewed with your leadership and counsel.
Secure the stack
Configure enterprise AI tools and private deployments with the right access, logging and data boundaries.
Test and monitor
Test your AI apps and agents before launch, then monitor usage, cost and quality.
What you get in hand
- AI use inventory and risk register
- AI acceptable use policy and approved tool list
- Vendor review reports
- Secure deployment configuration and runbook
- AI app test report with fixes
What we've built
Real work, described without client names.
Enterprise AI deployments
Hands-on work with enterprise AI platforms and private model deployments on AWS Bedrock and Azure AI Foundry.
Evaluation harnesses
Test sets that score AI answer quality, used to catch regressions before users do.
Agent connectors with guardrails
Model Context Protocol servers that give assistants scoped, auditable access to outside systems.
Pricing for this service
Most companies start with the policy and inventory, then secure their first production deployment. Full terms are on the pricing page.
| Option | Price | What it covers |
|---|---|---|
| AI risk call | $450 | 60 minutes on your current AI use, with the three changes we'd make first. |
| AI policy and governance starter | $5,000 fixed | Inventory, acceptable use policy, approved tools, risk tiers and intake process. About 2 to 3 weeks. |
| AI vendor review | $1,500 per vendor | Data, security, contract and retention review with a written risk summary. |
| AI app security test | from $6,000 | Prompt injection, data leakage and access testing of an assistant or agent, with fixes. |
| Secure AI deployment | from $10,000 | Private model access, SSO, logging, data boundaries and cost controls on your cloud. |
| Fractional AI advisor | $3,500 / month | Ongoing governance, vendor reviews and approvals. |
Common questions
Do we need an AI policy if we're small?
Yes, a short one. A one-page acceptable use policy and an approved tool list prevent the most common problem: customer data in personal AI accounts.
Does the Colorado AI law apply to us?
Colorado's SB 26-189 takes effect January 1, 2027 and applies to AI tools that materially influence consequential decisions about Colorado residents, like hiring, lending, housing, insurance or health care. Most internal productivity tools aren't in scope. We help you inventory and flag likely obligations; your counsel makes the call.
Which frameworks do you use?
We align with the NIST AI Risk Management Framework and borrow from ISO/IEC 42001 where it helps, but keep the output practical: a few rules, a few checks, and owners.
Can you secure an AI app we already built?
Yes. We test it for prompt injection, data leakage and over-broad access, then fix or recommend fixes.
Is this legal advice?
No. We handle the technical and operational side and work alongside your attorney on legal questions.
Often paired with
Not sure what your team is putting into AI tools?
Book a free 30-minute call. We'll walk through the three risks most companies have today and the quickest way to close them.