Procurement is where most AI engagements slow down. Here is exactly what we provide, what we can evidence today, and where we will tell you no.
All AI for Enterprise →
We are a small engineering firm, and we do not hold SOC 2 or ISO 27001 certification, nor any HIPAA attestation (HIPAA has no certification scheme). If your procurement process has a hard certification gate, we will not clear it, and it is better for both of us that you know that on the first call rather than in week six.
What we can do is implement the controls those frameworks describe, document them, and support your own compliance obligations — including building systems that generate the evidence your auditors will ask for. Clients that hold certifications we do not can have the systems we build designed to sit inside that scope rather than beside it.
When we do complete a certification, it will appear here with its audit date and scope. Until it does, this page says what is true.
These options can be contracted, and we configure and verify them. At the time of writing, hosted model providers offer enterprise endpoints with no training on inputs and, on some tiers, zero-retention configurations; availability varies by provider, model and tier, and several retain inputs for a period for abuse monitoring unless a specific agreement is in place. We record the exact retention and training terms in the architecture document and verify the configuration against them. The terms themselves are between you and the provider — confirm them against the provider's current contract. Where that contractual position is not sufficient for your risk appetite, the alternative is open-weight models on infrastructure you control, where the question does not arise.
As an authorisation problem rather than a filtering one. Content retrieved from documents, emails or web pages is treated as untrusted data, never as instructions. Tools are scoped to the minimum permission needed and the destructive ones require confirmation. Filtering helps at the margins but cannot be the primary control, because the attack surface is the entire content of everything the system reads.
Wherever your requirements dictate. For EU data residency we deploy in EU regions and select model endpoints in EU regions, or run open-weight models entirely inside your perimeter. The residency requirement is captured in discovery because it constrains the model choice, and discovering it late means rework.
Deleted on your schedule, with written confirmation. Where systems run in your own infrastructure the question is largely moot — we never held the data. Access credentials are revoked at handover and we ask you to verify the revocation rather than taking our word for it.
We would rather answer it in week one than discover a blocker in week six.
30-minute technical call · no deck
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
Apps, platforms and campaigns for these teams, long before the AI work. Every one is written up on the work page — what we did, and where our part ended.
