A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →An AI acceptable use policy is an internal policy that sets out how employees may and may not use AI tools: which tools are approved, what data may be entered into them, where human review is required, and what is off limits. It is the practical control that turns a general wish to use AI safely into rules people can follow. It is also the first thing that brings shadow AI under governance.
A good policy is short and specific enough that people remember it. The useful content is the data rules, the approved-tool list, and the review expectations, not pages of principle that nobody consults mid-task.
It has to be paired with enablement. If the sanctioned tools are worse than what people can reach on their own, the policy loses, so the durable version makes the compliant path the convenient one.
traztech delivers an AI acceptable use policy for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
An acceptable use policy is what you reach for once you discover how much AI is already in use. It converts a vague unease about staff pasting data into chatbots into clear lines: these tools, this data, this review step. We draft and roll out an AI acceptable use policy.
The policy only works if it is realistic. One that bans useful tools outright pushes usage into shadow AI, while one that approves sensible tools and names what data is off limits gets followed. Pair it with sanctioned options that are actually good.
At a minimum: which AI tools are approved, what categories of data must never be entered, when human review is required, how AI-assisted output is checked, and who to ask when something is not covered.
No. A policy without an inventory, sanctioned tools, and an owner is a document nobody follows. It is one part of AI governance, not a substitute for it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.