Home / Services
Four services that take a business from "we have no idea what our people are doing with AI" to "we know, it's governed, and it's making us money."
Everything starts here. Over roughly two weeks we build an honest picture of how AI is already moving through your business — the sanctioned tools, the ones on personal accounts, the data flowing to each — and turn it into a plan your leadership team can actually act on.
You keep the deliverables whether or not you engage us for the work that follows. Several clients have taken the roadmap to their in-house team and run it themselves. That's a fine outcome.
Time from you: about three hours total — a kickoff, a few short interviews, and a one-hour readout.
A policy nobody reads protects nobody. We write AI governance the way it has to work in a real small business: short enough that people finish it, specific enough that they know what to do on Tuesday morning.
Then we make it real — the approved-tool list gets configured, the data line gets enforced technically rather than hopefully, and everyone gets thirty minutes of training that uses examples from your actual business.
Increasingly not optional. Cyber insurance renewals, client security questionnaires, and SOC 2 / HIPAA reviews have all started asking how AI is governed. Having a documented answer is now part of doing business.
This is the part that returns money. We deploy the tools your teams will use every day — and we configure the security posture before the first user logs in, not after an incident.
Copilot inheriting over-permissive SharePoint access is the single most common self-inflicted wound we see. Getting permissions right first is unglamorous work. It's also the difference between a rollout that helps and one that quietly surfaces the salary spreadsheet to the whole company.
Microsoft 365 Copilot, Google Gemini for Workspace, and Claude or ChatGPT enterprise tiers — with tenant controls, DLP, and retention set correctly.
A retrieval assistant over your own SOPs, contracts, or knowledge base — scoped to existing permissions so it can never answer beyond what the asker may already see.
Document intake, quoting, ticket triage, meeting notes into your PSA or CRM — automation with a human checkpoint wherever a mistake would cost real money.
SSO, conditional access, least-privilege review, and permission remediation on the data sources AI will read. The boring layer that makes everything else safe.
AI is not a project you finish. New tools ship weekly, vendors quietly change their terms, and staff turn over. A policy written in March is out of date by August unless someone owns it.
We own it. Continuous visibility into what AI is being used, alerting when something new shows up or sensitive data heads somewhere it shouldn't, and a quarterly review you can hand straight to your board, auditor, or insurer.
Roughly 20 to 500 people, no dedicated AI staff, and a real obligation to protect somebody's sensitive information.
PHI never reaches a consumer chatbot. HIPAA-aligned controls and BAAs reviewed before any tool goes live.
Client confidentiality, privilege, and retention obligations mapped to concrete AI controls.
Bid documents, drawings, and supplier pricing kept out of public models while estimating gets faster.
Client contracts and deliverables governed, so an AI question on an RFP is a strength, not a scramble.
Almost everyone starts with the assessment — it's designed to answer exactly that question in two weeks.
