Frequently asked questions

Who do you work with?

Companies with a lot of document work done by hand, and software companies whose AI feature is now part of a contract. Many have tried AI once and stopped.

What do you need from us to begin?

A person who owns the outcome, access to the systems involved, and a specific problem. We do not write AI strategies with no work attached.

Where should we start?

With the opportunity assessment, even if you already have a project in mind. It is the shortest engagement and the one that most often changes the plan.

How is pricing structured?

A fixed price per engagement, quoted after a scoping call and invoiced by milestone. If it is over budget, we cut the scope, not the rate.

Do you do penetration testing or red teaming?

No. Offensive testing shows what is reachable in a system today. We work on the design that decides what is reachable at all. We will recommend firms that do the offensive work.

How is your security work different from an audit?

An audit checks you against a list of controls. We check whether the design is sound: whether an index keeps the permissions of its source, whether a support ticket can steer an automated process, and whether logs hold customer data.

Can you certify us?

No. We are not auditors and cannot issue SOC 2, ISO 27001 or ISO 42001. We prepare you for the questions and show which design decisions match which controls.

Why are there no names on your site?

We want to be judged on method. On a call you get our full background, references and code we have written.

Do you have case studies?

Not published ones. Clients rarely want this work written up. We can walk you through the method and a sample deliverable, and start with a small engagement.

Why not use the AI features in the tools we already have?

Often you should, and we will say so. Built-in features work inside one product. They do not cover work that spans several systems.

Should we wait until the technology settles?

No. Models change fast. The work around them does not: clean data, a mapped process, a review step and clear permissions. You need all of it whatever the model.

Our data is not ready.

Nobody's is. Finding what needs fixing is part of the assessment. The real blocker is not knowing where the data is, or not getting access to it.

Could we hire someone instead?

Later, yes, and we will help write the role. Hiring first means committing before you know what the job is. Assess, build one thing, then hire.

What happens when you leave?

You keep the source, the docs, the evaluation suite and the runbook. We agree who owns the result on your side before we start.

How do we know the build works?

Every build has an evaluation suite and a baseline measured first. You get a score at the start and a score at the end. If the second is not better, we report that.

We are worried about our data reaching a model provider.

On business terms, providers do not train on your data. The bigger risks are logs, retrieval indexes and personal accounts. If data cannot leave your environment, we design around a self-hosted model and tell you what it costs in quality.

Our security team will not approve this.

Bring them to the first call. We start with the threat model.

Do you work on site?

Remote by default. We come on site when it helps, usually at the start of a build.