Loading the next page…
AI for trust work
deploy agents;
dictate trust
AI governance, privacy, security, risk, and compliance, work delivered by experienced practitioners with a blended agent and human team. Agents do the work, while humans retain judgement and deliver outcomes.
AI governancePrivacySecurityRiskCompliance
Proposal · Q14
Awaiting reviewIs access to production reviewed on a schedule?
Yes. Access to production is reviewed quarterly and enforced through SSO.
SOC2-Type-II-2025.pdfaccess-review.csv
The problem
The evidence sits in too many files.
A single audit request can need a PDF policy, a spreadsheet export, three screenshots, and an email thread. A scan shows how a system is configured. An integration log shows what happened. Someone still has to read both against the control and write down what they prove.
Workspace fragments
6 of 6 linked- policy_v3.docxCC5.3 PolicyLinked
- risk_register_final.csvCC3.2 RiskLinked
- SOC2_evidence/CC6.1 AccessLinked
- vendor_questionnaire.xlsxCC9.2 VendorsLinked
- access-review.csvCC6.3 ReviewLinked
- audit_asks_Q1.mdAudit ask 14Linked
Products
CASK (Compliance ASK)
- A desktop agent workspace for drafting reports, answering questionnaires, and reviewing evidence.
- You write the instruction and approve the final document.
- CASK Pro adds automated scanning, live collaboration, and deeper agent work.
Services
Put our experts on the work
- Outcome as a Service (OaaS) for a defined project.
- Compliance as a Service for work that continues.
- Our practitioners run CASK on your records, then edit and sign off each draft.
Our solution
Safe and effective use of AI for trust.
Agents draft the work, check claims against your records, and propose the changes. Experienced practitioners keep the judgement, review the result, and deliver the outcome across AI governance, privacy, security, risk, and compliance.
CASK is the workspace that team shares. When you want our practitioners to run an engagement, see services.
See how CASK works CASKLocal workspace
Evidence
- SOC 2 report
- Policy v3.2
- Access review
- Risk register
Security review
Access to production is reviewed quarterly and enforced through SSO and role-based approvals.
SOC 2 CC6.1Policy v3.2
Cited
Subprocessor DPA is on file and matches the SOC 2 report.
Agent
Ready for you
- Read workspace
- Cite sources
- Ready to accept
Why choose us
Your AI. Your data. Our agent.
CASK keeps your files on your desktop, and you choose what goes to the AI provider.
A privacy-focused desktop app
- Keep your workspace and working records on your desktop.
- Choose the information you share when a task needs AI assistance.
Privacy assessment, Q3
- RoPA-2026.xlsx On this device
- DPIA-onboarding.docx On this device
- processors.csv On this device
- retention-schedule.pdf On this device
Shared with your AI provider for this task: 2 excerpts
Work on a privacy assessment from your desktop, with the records and draft in the same workspace.
Workspace on your desktopYou choose what is shared
Your AI. Your data. Our agent.
- Use your chosen AI provider or a local model with CASK's agent.
- Cloud AI receives the content sent in a request under your provider's terms.
Cloud provider you chooseYour account, your key
Local modelRuns on this device
Sent in this request
The instruction and 2 excerpts
Stays on your desktop
The workspace
Choose an approved provider for a questionnaire task, or use a local model when the work calls for it.
Your provider or a local modelRequest content only
Human in the loop, always
- You give instructions. The agent analyses, drafts, and proposes changes.
- You review the result, apply judgement, and approve the final artifacts.
Proposed changeAwaiting review
Access reviews are performed annually.
Access reviews run every quarter, owned by the IT Lead.
Access Review Procedure v2
Reject Accept
The agent drafts a risk assessment. Your reviewer checks the evidence and decides the rating and treatment.
You give the instructionsYou approve the artifacts
Grounded in your organization's context
- Fight hallucination and fabrication by checking claims against your records.
- Enforce citations and make missing evidence visible for human review.
Security questionnaire, 2 of 240
Do you encrypt customer data at rest?
Yes, in managed storage.
Encryption Standard v2, section 3
Was your continuity plan tested this year?
Not Provided · no record in the workspace
A questionnaire asks about a control with no supporting record. The answer is flagged as Not Provided for review, instead of treating an assumption as evidence.
Claims checked against your recordsMissing evidence stays visible
Services
A project to finish. A program to keep running.
Outcome as a Service (OaaS) puts our practitioners on one defined project, such as an AI governance plan, a privacy assessment, or audit preparation. Compliance as a Service runs the recurring work, with scheduled reviews, evidence refreshes, and open actions tracked to their owners. On both, CASK writes the first draft from your records, and a practitioner edits it and signs off.
Explore our servicesInventory, risk, policy, and readiness
By hand
AI tools, owners, risks, and policies are collected team by team, then copied into a new sheet for each review.
With us
We inventory the AI you build and buy, assess risk and impact, write the policy, and prepare what an ISO 42001 audit asks for. CASK drafts each file. A practitioner checks it.
Examples of how we work. Scope and timing are agreed for each engagement.
The team
Founded and run by practitioners.
Our founders have more than two decades of combined experience in privacy, compliance, and security engineering. We have used AI agents on this work for several years, and we built CASK around what held up under review.
Read our story
