Services

Fixed scope.
Clear deliverables.

Every engagement is fixed-scope with a clear deliverable. Start with the package that fits where you are now.

AI Trust Sprint
$9,000CAD
For teams with an enterprise deal blocked by a security questionnaire
2–3 weeks
  • ✓Security questionnaire response (SIG, CAIQ, and custom enterprise questionnaires)
  • ✓Security and AI policy pack: Information Security, Access Control, Vendor Management, AI Acceptable Use, Model Vendor Management, Data Retention
  • ✓A public Trust Page for your website
Book a call
MOST POPULAR
SOC 2 Readiness for AI Companies
$19,500CAD
For teams that need SOC 2 Type I or Type II to sell to enterprise
Scoped to your audit timeline
  • ✓AWS security review: IAM, logging, encryption, misconfigurations
  • ✓Gap assessment, including AI-specific controls: LLM data flows, prompt retention, model providers as subprocessors
  • ✓Incident response plan and a tabletop exercise with leadership
  • ✓Hands-on remediation, including EDR/SIEM selection, deployment, and tuning
  • ✓Auditor coordination and compliance platform integration
Book a call
AI Governance & ISO Readiness
$16,500CAD
For teams whose customers or markets expect formal AI governance
Scoped to the frameworks you need
  • ✓ISO 42001 gap assessment, AI risk and impact assessments, model documentation
  • ✓ISO 27001 readiness, on its own or combined with ISO 42001
  • ✓HIPAA and PIPEDA support for healthtech and Canadian companies
Book a call
Fractional AI Security & Compliance Lead
$5,500/mo
For teams that are audit-ready and need to stay that way
Monthly retainer
  • ✓Continuous compliance: evidence collection, access reviews, Vanta/Drata management
  • ✓Ongoing security questionnaires and customer security calls
  • ✓Threat-informed risk assessments and quarterly threat briefings relevant to AI companies
  • ✓Year-over-year audit preparation
Book a call

All prices in CAD. Final price depends on scope, confirmed on the intro call. Need something not listed, like incident response planning or a cloud review on its own? Ask on the intro call.

See What You Get

See what a review looks like.

Illustrative example. Real reviews are tailored to your environment.

aws-security-review
$ review --scope aws --access read-only
✓ Root account MFA enabled
✓ S3 public access blocked account-wide
✗ CloudTrail disabled in 2 regions
✗ IAM access key unused for 143 days
! LLM provider missing from subprocessor list
Result: 3 findings, remediation plan ready
Services FAQ

Questions about how
engagements work.

What's the difference between SOC 2 Type I and Type II?

Type I checks that your controls are designed properly at a single point in time. Type II checks that they actually operated over a period, usually somewhere between 3 and 12 months. Many startups start with Type I to unblock deals, then move to Type II.

How long does SOC 2 readiness take?

It depends on where you're starting from and how much needs fixing. On the intro call we'll give you a realistic timeline for your situation.

Do I need Vanta or Drata?

No, but they can save a lot of time on evidence collection. If you already use one, we'll work inside it. If you don't, we'll help you decide whether it's worth it.

Ready to get started?

Book a 30-minute intro call and we'll figure out which package fits.

Book a 30-minute call