A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Fill in a few details about how your team should use AI, and get a clean, copyable starter AI acceptable use policy. Everything is generated in your browser. Nothing you type is sent anywhere.
The tools employees are allowed to use, ideally on business/enterprise tiers.
Leave blank if you prefer an approve-first model where anything not on the approved list is off-limits.
Not ready for a call yet?
A few short notes from Jacob on writing an AI policy people actually follow, plus what to build around it. No fluff, unsubscribe in one click. Reply anytime; it reaches him directly.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Want it done for you?
AI Acceptable Use Policy
We tailor a defensible AI acceptable use policy to your business and wire it into an approved-tool list your team will actually follow.
Explore AI Acceptable Use Policy →We turn this starter into a defensible AI acceptable use policy for your organisation, wire it into an approved-tool list and controls, and align it to the governance frameworks your customers and auditors expect. If your AI products need deeper testing, pair it with our AI / LLM security assessments.
About our AI policy service Book a callThis gives you the shape of the problem. The full picture is all 38 Annex A controls and 29 AIMS clauses (4-10) of ISO 42001, each one explained in plain English, with somewhere to attach the evidence and a readiness score that moves as you close gaps. Start a free assessment and walk every control.
No credit card, no trial clock, no locked features. TrazTech makes money when someone wants help closing the gaps, not from the Workspace itself.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.