AI & SaaS Risk Audits
End-to-end review of model usage, data flows, vendor terms, disclosures, and automated decision risk across your product surface.
- Model & data flow mapping
- Training-data and vendor terms
- Disclosure gap analysis
Services
Every risk surface an AI or SaaS company actually gets caught on.
Seven review domains, one methodology, one report. Run the full audit or start with a focused review.
Privacy & Cookie Reviews
Tag, tracker, and consent-banner analysis mapped to GDPR, CPRA, and state privacy expectations — with evidence you can hand to counsel.
- Tracker inventory
- Consent banner behavior
- Policy-to-practice mismatch
TCPA & Marketing Consent Reviews
Forms, SMS flows, call scripts, and lead-gen paths reviewed for express written consent, revocation, and record-keeping defects.
- Form & disclosure capture
- Opt-out handling
- Lead vendor exposure
Accessibility Reviews
WCAG 2.2 AA testing combining automated scans with manual keyboard, screen-reader, and contrast validation on real user journeys.
- Keyboard & AT testing
- Contrast & semantics
- Remediation backlog
Public Security Reviews
Externally observable security posture: headers, exposure, authentication surfaces, and disclosure readiness — no intrusive testing.
- Header & TLS posture
- Exposed surface review
- Disclosure program setup
Technical Remediation
Engineers who ship the fix: consent plumbing, accessibility refactors, policy generators, and CI guardrails in your codebase.
- PR-ready fixes
- Consent & CMP wiring
- CI regression checks
Ongoing Monitoring
Continuous checks that catch regressions before they become claims — with quarterly executive reporting for your board.
- Scheduled re-scans
- Drift alerts
- Quarterly exec reporting
In practice
Evidence, not checklists.
Every domain produces reproducible artifacts your engineers can act on the same day.
Consent & privacy
We replay your banner against real tag firing order, revocation, and record retention.
Accessibility
Keyboard, screen reader, and contrast passes on the journeys that actually convert.
Public security
Externally observable posture — headers, TLS, exposure — with zero intrusive testing.