Ways to start
Compliance readiness assessment
What a reviewer will ask for, what you can already answer, and what you cannot.
A gap analysis against the regime that applies to you, delivered as an evidence pack rather than a verdict. You are told what exists, what is missing and what a reviewer will ask for first.
What is examined
- Where personal data enters, rests and leaves — including logs, error trackers and backups
- The authorisation matrix: every role against every action
- Audit trail design, and whether it can answer what a value used to be
- Access logging, including reads rather than only writes
- Retention, and the place in the code that enforces it
- Third-party processors, model providers included
What you get
The evidence pack: a data flow map, the authorisation matrix, the retention schedule, access log design, a processor list, and written answers to a standard vendor security questionnaire. Plus what is missing, ordered by what a reviewer asks for first.
Suited to
- A review or audit with a date on it
- A customer security questionnaire nobody can answer
- An AI feature that has quietly added a processor
- Handling personal or clinical data without having mapped where it goes
Not this
- Needing an attestation issued — that belongs to your organisation and no vendor can hold it for you
- Wanting a certificate rather than the evidence behind one
Ways to start
The other doors.
Fixed scope, one to two weeks
Production readiness review
Someone reads the system end to end and writes down what is actually true about it.
Project
Build
The system, with the parts that are expensive to add later included from the first release.
Monthly
Accountable architect
A named person owns the boundary, and is still there in eighteen months when it breaks.