Governance built in.
Not bolted on.
Most AI vendors treat governance as documentation written after a pilot works. I design the logging, cost controls, and human oversight into the architecture first — so the compliance artifact is a byproduct of how the system runs, not a separate deliverable bolted on afterward.
The three frameworks I build against
Each maps to a productized offer — a concrete deliverable and timeline, not an open-ended retainer.
US federal framework
NIST AI RMF
The four-function model — Govern, Map, Measure, Manage — that structures how I design every agent's logging, cost controls, and human oversight from day one.
Mapped offer
AI Governance Readiness Assessment
$20–35K
See how it maps to ISO 42001 and the EU AI Act →International standard
ISO 42001
The AI management system standard for organizations that need certification-ready documentation, not just internal policy — audit trail structured for a third-party assessor.
Mapped offer
ISO 42001 Implementation Sprint
$50–120K
See how it maps to NIST AI RMF and the EU AI Act →EU regulation
EU AI Act
Risk-tiering, conformity documentation, and technical files for organizations with EU exposure — including the Article 50 transparency obligations phasing in through 2026.
How this shows up in the architecture
The NIST AI RMF's four functions, expressed as engineering requirements rather than compliance checklist items.
GOVERN
A spend policy and oversight structure set once and enforced automatically on every model call — not a quarterly review that discovers drift after the fact.
MAP
Every AI action records what was requested and what actually executed it. No call happens without a named model and a named route.
MEASURE
Token volume and cost are recorded on every call — unsampled, not a spot check run once a quarter. Response quality is scored and attached where evaluated.
MANAGE
Spend and risk are checked and reserved before an action executes — the system is architecturally incapable of the failure mode, not just monitored for it.
Don't take this on faith
The Governance Ledger demo isn't a mockup. It's a real, unedited excerpt of the AI routing gateway this business runs its own infrastructure on — every call logged, costed, and mapped to the four functions above. Real operational data, refreshed periodically — not a live-refreshing feed.
See the live ledger →Compliance & certification status
The three frameworks above are engagements I build for clients — not certifications Tioga AI itself currently holds. Said plainly, not implied:
- My own infrastructure's security controls — role-based access, audit logging, architecture aligned to SOC 2 Trust Services Criteria — are real and demonstrated live in the Governance Ledger demo. No independent SOC 2 report exists yet.
- I am not ISO 42001 certified. The ISO 42001 Implementation Sprint helps a client's AI management system reach that bar — it is a delivery engagement, not a badge I display.
- NIST AI RMF is a voluntary framework with no certification to hold; ISO 42001 and EU AI Act obligations attach to the systems I help build, not to Tioga AI as a vendor.
AI use & disclosure
Required reading under the EU AI Act's Article 50 transparency obligations, and good practice regardless of where you're reading from: here's exactly where AI touches this site, and what it does.
Contact form classifier
When you submit the contact form, Anthropic's Claude reads your message and classifies it (service match, urgency, complexity, fit) to help route it. You see that classification immediately on screen, and it's emailed to the founder — a human reviews it before anyone follows up with you. It doesn't talk back to you and it's not a chatbot.
Chat widget
The chat bubble in the corner of the site is Anthropic's Claude, streaming replies to you live. Nobody reviews its messages before you see them — that's the nature of a real-time chat. It says so at the start of every conversation, not just here.
Nothing on this site publishes AI-generated content to anyone else or takes an action on your behalf without a human in the loop. Both surfaces run on Anthropic's Claude — see the sub-processor table below for what happens to your data. Prefer a human at any point? Email hello@tioga.ai or book a call.
Data handling & sub-processors
Tioga AI is a solo-run practice — no marketing database, no ad tracking, no resale of anything you submit. The full breakdown, endpoint by endpoint, is in the Privacy Policy. Exactly four external parties ever touch your data:
Anthropic
Processes text submitted to demos, the chat widget, and contact-form classification, per Anthropic's own privacy policy.
Google (Gmail SMTP)
Delivers contact-form notifications and optional demo-result emails — nothing beyond that.
Vercel
Hosts this site and its serverless functions.
Cal.com
Processes the name, email, and scheduling details you provide when you book an intro call, per its own privacy policy.
Security practices
What's actually enforced on this site today, not a generic checklist:
- Strict Content-Security-Policy on every response — no inline script execution beyond Next.js's own hydration payload, no framing by other sites (frame-ancestors 'none'), no eval in production.
- X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a locked-down Permissions-Policy blocking camera/microphone/geolocation access sitewide.
- Per-IP rate limiting on every demo and API endpoint, so no single visitor can exhaust the shared model budget or hammer an endpoint.
- No demo or chat submission is retained after the response is generated — see the Privacy Policy for the full breakdown, endpoint by endpoint.
- No API keys or secrets ship to the browser — every model call is proxied through a server-side route.
Availability
Hosted on Vercel's global edge network. As a pre-launch, solo-founder practice, there is no formal uptime SLA published yet — that's a real gap, not hidden. If tioga.ai is down, there is currently no separate status page; check the site directly or email me.
Incident response
No dedicated security team — the founder personally reviews and responds to anything reported. What that means in practice: a fast, direct response from the person who built the system, not a ticket queue.
Report a security issue
Found a vulnerability? There is no formal bug bounty program yet — but every report is read and acted on personally. Email hello@tioga.ai with subject line “Security” and what you found.
Ten of Tioga AI's sixteen engagements are governance-focused.
See all sixteen offers →