How We Keep You Secure
Guardrails first. Then AI.
A clear fence is one you can see through. You should always be able to see what AI can reach, who approved it, and how to switch it off. That idea shapes every engagement.
Our principles
Six rules we work by
Look before connecting
We review identity, access, and data exposure before any AI tool is connected to your systems.
Least access, for the least time
We begin read-only. Any change access is agreed in writing, limited in scope, and removed when the work is done.
Write it down
Approved tools, data rules, and exceptions live in a short policy your staff can actually follow.
Humans approve
Every AI assistant we build has human approval points, logging, a named owner, and an off switch.
Check the fine print
We review vendor terms on data training, retention, single sign-on, and BAAs before recommending a tool.
Train people, not just tools
Role-based training and a simple “can I use AI for this?” guide help your team make good calls every day.
The engagement
What happens at each step
Discovery Week 0
Intake form and owner call; inventory of the tools you use; goals and pain points; the types of data you handle (patient, personal, financial, or privileged). You get a discovery summary and a proposal.
Risk assessment Weeks 1–2
Read-only review of Microsoft 365 / Entra accounts (MFA, conditional access, admin roles, guests); SharePoint and OneDrive oversharing; connected AI apps; labels and data-loss prevention; AI vendor and BAA terms; a short staff AI-use survey. You get a risk scorecard rated Critical, High, Medium, or Low.
Policy Weeks 2–3
AI acceptable-use policy, approved-tools list, data classification rules, an exception and incident process, and a checklist for evaluating new AI vendors.
Pilot Weeks 3–6
Pick one or two use cases, fix blocking findings, set up the tool for 5–10 pilot users, and measure time-per-task before and after.
Rollout Weeks 6–10
Expand licenses, single sign-on and conditional access, data-loss-prevention rules, sensitivity labels on key sites, and any assistant builds with approval steps.
Training Weeks 6–10
Role-based workshop, prompt library, decision card, and office hours, with attendance records you can keep on file.
Ongoing support Monthly
Monthly check for new AI apps, usage and value reporting, quarterly AI review, policy refresh, and a backlog of new ideas.
Your data
Which AI can touch which data
We help you sort information into four simple tiers and decide which approved tools may use each one.
| Tier | Examples | Typical AI guidance |
|---|---|---|
| Public | Website copy, published price lists | Any approved tool |
| Internal | Procedures, internal memos | Business-plan AI tools signed in with company accounts |
| Confidential | Client files, contracts, financials | Only tools whose terms and settings you've approved for this tier |
| Regulated | Patient health information, privileged legal material | Only tools and plans covered by the right agreements (such as a BAA), set up and reviewed for that use |
Illustrative example. Your tiers and rules are set during the Policy step with your own advisors.
Straight talk
What we don't promise
No compliance guarantees
We help you make informed, documented choices about AI. We don't certify or guarantee compliance with HIPAA or any other law or standard.
We're not your lawyer
We keep track of Texas AI rules, such as the Texas Responsible AI Governance Act (HB 149) and SB 1188 for health care, and we flag questions for your attorney. Nothing we provide is legal advice.
See your AI risk in 30 minutes
Request a free AI Risk Snapshot and get a one-page summary of where to start.