Frequently Asked Questions

We put Claude to work inside your business, governed by your own standards, and then we score it. Claude runs on your own desktop and mobile devices. We specify the configuration, train your staff, and give you a number you can show a client, an auditor, or your own board.

Three phases. Assess: two weeks establishing what your people are already doing with AI, ending in a baseline Company Skoor and a written finding you keep either way. Implement: a certified deployment on your devices, with permissions scoped, connectors allowlisted, audit wired, and staff trained. Maintain: every agent scored continuously, with backports when a rule or a connector changes, a support SLA, and an annual re-score.

An Company Skoor measures posture — is there a policy, are permissions scoped, is anything written down, is there an audit trail at all. It is scored at deployment and again each year. An Agent Skoor measures behaviour — did this agent stay inside policy, was its output reviewed, was drift caught inside the window we committed to. It is scored continuously, per agent.

The ones that already bind your business. We do not invent criteria and ask you to trust them — the rubric is assembled from your real obligations, published for your industry before the engagement starts, and versioned as those rules change. A firm handling client tax data is scored against a different set than one handling patient records or payment data. You are never scored against a standard that does not apply to you.

Nowhere near us. Claude holds the connection to your systems on your own devices, using credentials issued to you. We specify the configuration and verify it from the outside — the same relationship an auditor has to your books. Your audit trail is written to a store you control; we read it to compute a score and keep no copy of the records it describes.

No. A subprocessor is a party that processes your data on your behalf. We never hold your credentials and never see your data, so there is nothing to disclose. That independence is also what lets our assessment mean something — a score from a party sitting inside your data path is not an independent score.

Implementation, ongoing maintenance, and third-party assessment. Your Claude seats are billed by Anthropic at Anthropic's published price and we do not mark them up; if you want the procurement off your plate we will handle it at cost. The assessment is a fixed fee quoted on the size of your business, and it is credited in full against implementation if you proceed.

It is the normal finding, not the embarrassing one. Most businesses discover during the assessment that people have already connected things nobody approved — usually because they were trying to do their jobs and nobody gave them a governed way to do it. Establishing what is actually happening is the first phase for exactly this reason.

No, and we will not say otherwise. A Skoor says your configuration meets the technical safeguards in a standard. Whether your programme as a whole meets that standard is a legal conclusion and it belongs to your counsel. Knowing precisely where our number stops is part of why it is worth something.

Because the rubric is published and fixed before we start, and every Skoor is computed from measurement rather than opinion. You can read exactly what is scored before agreeing to be scored. If a rubric bent to suit each client it would stop being evidence and start being a favour.

The person at your firm who keeps the skoorboard — the standing record of which agents run, what each may reach, the refusals in force, where the audit trail lands, and the current scores. A bookkeeper keeps the books current so an accountant can render an opinion; a Skoorkeeper keeps the skoorboard current so counsel or an examiner can get a straight answer. It is a role we have named because firms need it, not a certification we sell.

It fits best where AI already touches information you are accountable for — client records, financial data, anything a regulator or a customer could ask you about later. If nobody would ever ask you to account for what your AI did, you probably do not need us yet. The assessment is the cheapest way to find out, and you keep the report regardless.