AI reviews · production systems · security & compliance

Production AI that holds up — a written plan in a week, then a build if it's justified.

We find where AI can give hours back, or where data is already leaving your tenant into ChatGPT — then hand you a document, not a workshop. If your MSP introduced us, we work with them. If you found us yourself, we still take the work.

MSP partner? Quoting, talk tracks, and what to send a client live on the partner kit — not on this page. How we work together →

Two one-week reviews. Same shape, different lens.

30-minute discovery, a one-week analysis window, 30-minute readout, written deliverable. Implementation is optional — and only after you've seen the findings.

productivity 1 week· written brief

AI Opportunity Review

Where is this team losing 4+ hours a week to work AI could absorb? A map of operational drag and what to fix first — no vendor pitch, no slideware.

  • 30-minute discovery — workflow drag, tool stack, current AI usage
  • One-week analysis — opportunity inventory and tool recommendations
  • 30-minute readout + written brief you can act on
  • Implementation stays optional, scoped after the findings

Read the full sample report →

Your MSP stays in the relationship. We do the specialist work.

01 · intro

You're on the thread

Often a CC from the MSP you already work with. We join as the AI specialist. They stay in the relationship — we don't replace them.

02 · 30 min

Discovery call

Workflows, tool stack, where AI is already in use, and the question that brought us in — hours back, leakage, or an auditor.

03 · 1 week

Written brief

Analysis window, then a 30-minute readout with a document you can act on. Not a workshop. Not a vendor pitch.

04 · yours

The stack stays put

Policy, M365, monitoring, and day-to-day IT stay with your existing partner. We only stay if you want us on the build.

Interview-led, framework-backed, written down.

The sample report is the actual shape of the deliverable — a document, not a slide deck.

methodology

Conversation first. Tenant telemetry where you grant it.

We start with a structured 30-minute interview. With permission, via standard OAuth and admin scopes, we review telemetry from tools you already run (Google Workspace, Microsoft 365, AI vendors) so the inventory is grounded in what is happening, not what people remember. Prefer not to grant access? We work from exports.

"Conversation first. Tenant telemetry where you grant it, exports where you don't. No 'we'll look through your email.'"
frameworks we map against
HIPAA GDPR CCPA SOC 2 EU AI Act NIST AI RMF ISO 27001 / 27701 GLBA FERPA US state privacy
acme-corp · ai-review-deliverable.pdf sample
Deliverable structure
01 Executive summary What's working, what isn't, what's urgent
02 AI usage inventory Tools, workflows, owners, data flows
03 Findings & risk register Severity × likelihood, with examples
04 Control gap analysis Mapped to applicable frameworks
05 Prioritized action plan Phased, with effort estimates
06 Follow-on scope (optional) If you want the plan executed — by you or with us

When the findings point to a build.

Reviews stand on their own. If you want the plan executed, we scope a fixed engagement — prompt measurement, a production build, advisory, or ongoing ownership.

start here

Productized AI Review

One week, written plan. Opportunity or Compliance & Privacy.

when a prompt is the bottleneck

Prompt Optimizer

Two-week fixed scope. We build the eval layer around a production LLM, then make the prompt measurably better.

when you need it shipped

Engineering & Advisory

Scoped builds, technical advisory, and fractional AI leadership — quoted per engagement.

see the full catalog →

Enough depth for regulated work.

18 SOC 2 engagements delivered
30+ years building software & delivery systems
$10T+ platform context (BlackRock Aladdin)
0→1 through enterprise scale

Shipped work lives on Projects. Background: About and the technical profile.

FAQ

What people usually want to know after an intro — especially if their MSP just CC'd us.

Who's behind the work?

Production AI systems, security, and compliance — 18 SOC 2 engagements, ISO 27001, and engineering that ships. The short version is on About; the long version is the technical profile.

Will you replace our MSP?

No. We don't sell managed services, Microsoft seats, or the stack they already run. If they introduced us, they stay in the relationship. Policy, monitoring, and day-to-day IT stay with them. We do the specialist work.

What do we actually get from a review?

A 30-minute discovery call, a one-week analysis window, a 30-minute readout, and a written brief — executive summary, findings, and a prioritized plan. Read the sample report to see the document. Implementation is a separate, optional step after you've seen the findings.

Why isn't there a price on the site?

Fees are quoted per engagement so they match the work, not a published menu. If your MSP introduced us, they'll have the number. If you found us directly, we quote after the 30-minute call.

Can we book without going through an MSP?

Yes. Same 30-minute call. If you already have an MSP, tell us so we can work with them rather than around them.

Your MSP just CC'd us — or you found the domain yourself.

Either way: 30 minutes, then a written next step. If you already have an IT partner, they stay in the work.