Governance built in.
Not bolted on.
Most AI vendors treat governance as documentation written after a pilot works. I design the logging, cost controls, and human oversight into the architecture first — so the compliance artifact is a byproduct of how the system runs, not a separate deliverable bolted on afterward.
The three frameworks I build against
Each maps to a productized offer — a concrete deliverable and timeline, not an open-ended retainer.
US federal framework
NIST AI RMF
The four-function model — Govern, Map, Measure, Manage — that structures how I design every agent's logging, cost controls, and human oversight from day one.
Mapped offer
AI Governance Readiness Assessment
$20–35K
See how it maps to ISO 42001 and the EU AI Act →International standard
ISO 42001
The AI management system standard for organizations that need certification-ready documentation, not just internal policy — audit trail structured for a third-party assessor.
Mapped offer
ISO 42001 Implementation Sprint
$50–120K
See how it maps to NIST AI RMF and the EU AI Act →EU regulation
EU AI Act
Risk-tiering, conformity documentation, and technical files for organizations with EU exposure — including the Article 50 transparency obligations, which are already in effect.
How this shows up in the architecture
The NIST AI RMF's four functions, expressed as engineering requirements rather than compliance checklist items.
GOVERN
A spend policy and oversight structure set once and enforced automatically on every model call — not a quarterly review that discovers drift after the fact.
MAP
Every AI action records what was requested and what actually executed it. No call happens without a named model and a named route.
MEASURE
Token volume and cost are recorded on every call — unsampled, not a spot check run once a quarter. Response quality is scored and attached where evaluated.
MANAGE
Spend and risk are checked and reserved before an action executes. If the check or reservation fails, the call is blocked instead of being flagged after the fact.
Don't take this on faith
The Governance Ledger demo isn't a mockup. It's a real, unedited excerpt of the AI routing gateway this business runs its own infrastructure on — every call logged, costed, and mapped to the four functions above. Real operational data, refreshed periodically — not a live-refreshing feed.
See the ledger excerpt →Compliance & certification status
The three frameworks above are engagements I build for clients — not certifications Tioga AI itself currently holds. Said plainly, not implied:
- My own infrastructure's security controls — role-based access, audit logging, architecture aligned to SOC 2 Trust Services Criteria — are real, and illustrated by the dated excerpt in the Governance Ledger demo (an excerpt, not a live feed). No independent SOC 2 report exists yet.
- I am not ISO 42001 certified. The ISO 42001 Implementation Sprint helps a client's AI management system reach that bar — it is a delivery engagement, not a badge I display.
- NIST AI RMF is a voluntary framework with no certification to hold. ISO 42001 certifies an organization's AI management system, and EU AI Act obligations attach to legal actors by role (provider, deployer, and others) — so Tioga AI's own obligations depend on its role in each deployment, and I don't assume a vendor is exempt.
AI use & disclosure
Required reading under the EU AI Act's Article 50 transparency obligations, and good practice regardless of where you're reading from: here's exactly where AI touches this site, and what it does.
Contact form classifier
When you submit the contact form, Anthropic's Claude reads your message and classifies it (service match, urgency, complexity, fit) to help route it. You see that classification immediately on screen, and it's emailed to the founder — a human reviews it before anyone follows up with you. It doesn't talk back to you and it's not a chatbot.
Chat widget
The chat bubble in the corner of the site is Anthropic's Claude, streaming replies to you live. Nobody reviews its messages before you see them — that's the nature of a real-time chat. It says so at the start of every conversation, not just here.
Apart from the automated classification of your contact message (a human reviews it before anyone follows up) and demo-result emails you explicitly request, nothing on this site publishes AI-generated content to anyone else or takes an action on your behalf without a human in the loop. Both surfaces run on Anthropic's Claude — see the sub-processor table below for what happens to your data. Prefer a human at any point? Email hello@tioga.ai or book a call.
Data handling & sub-processors
Tioga AI is a principal-led practice — no marketing database, no ad tracking, no resale of anything you submit. The full breakdown, endpoint by endpoint, is in the Privacy Policy. Exactly four external parties ever touch your data:
Anthropic
Processes text submitted to demos, the chat widget, and contact-form classification, per Anthropic's own privacy policy.
Google (Gmail SMTP)
Delivers contact-form notifications, build-log sign-up notifications, and optional demo-result emails — nothing beyond that.
Vercel
Hosts this site and its serverless functions, and provides its web analytics and page-performance measurement (Vercel Web Analytics and Speed Insights).
Cal.com
Processes the name, email, and scheduling details you provide when you book an intro call, per its own privacy policy.
Security practices
What's actually enforced on this site today, not a generic checklist:
- Content-Security-Policy on every response — scripts and connections limited to this site plus Vercel's analytics endpoints, no framing by other sites (frame-ancestors 'none'), no plugin/object embeds, no eval. Inline scripts are currently allowed (needed for Next.js hydration today). A stricter nonce-based policy that removes that allowance is not in place.
- X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a locked-down Permissions-Policy blocking camera/microphone/geolocation access sitewide.
- Per-IP rate limiting on every demo and API endpoint, so no single visitor can exhaust the shared model budget or hammer an endpoint.
- No demo or chat submission is retained after the response is generated — see the Privacy Policy for the full breakdown, endpoint by endpoint.
- No API keys or secrets ship to the browser — every model call is proxied through a server-side route.
Availability
Hosted on Vercel's global edge network. As a pre-launch, principal-led practice, there is no formal uptime SLA published yet — that's a real gap, not hidden. If tioga.ai is down, there is currently no separate status page; check the site directly or email me.
Incident response
No dedicated security team — the founder personally reviews and responds to anything reported. What that means in practice: a fast, direct response from the person who built the system, not a ticket queue.
Report a security issue
Found a vulnerability? There is no formal bug bounty program yet — but every report is read and acted on personally. Email hello@tioga.ai with subject line “Security” and what you found.
Ten of Tioga AI's sixteen engagements are governance-focused.
See all sixteen offers →