Your buyers ask AI if they can trust you.

And it answers from whoever published credible, current material. If that isn't you, it's a competitor — or a two-year-old claim you'd never make today. Assay gets you cited in those answers, using only the claims you've approved.

Run the audit See what the AI engines say about you today
See how drift reaches a buyer
Composed from approved claims only Independent veto Every claim to its source
The short answer

What is Assay for security and privacy vendors?

Your buyers vet you by asking AI engines whether they can trust you, and those engines answer from whoever published credible, current material. Assay gets you found and cited in those answers using only claims you've approved. The AI SEO & GEO agent composes every published claim from your approved source and files it to the log. AI Legal holds an independent veto. When a fact changes, governed surfaces re-render within 48 hours, so the version an AI repeats about you is the current, approved one. It governs what you say. It doesn't certify your posture.

The bind

Three forces, closing at once.

None of them is new. What's new is that they now arrive together, and the usual answer, move faster, is the one thing a security vendor can't safely do.

The shortlist moved

Buyers ask AI engines who to trust.

The answer is assembled from whoever published credible, current material. If a rival is the citation, you're not on the list the buyer ever sees.

Your claims face review. Your own.

A false posture claim is existential.

You hold others to a standard. Your own market claims meet it too, and review at that grade loses to the calendar every time.

The standstill

Marketing wants the AI tools. The veto-holder says no.

The veto-holder hears "an AI can invent an encryption claim under our logo." Both are right, so nothing ships.

The drift, caught

A claim drifts. An AI repeats it. A buyer hears the wrong thing.

You tightened a policy months ago. The dead whitepaper never got the memo, so when a buyer's AI answers from it, the version it repeats is the one you retired. Governed publishing closes the gap.

Your source of truth · updated Retention 90 days30 days policy.retention · v7 · signed by you
Answered from a dead whitepaper

Buyer's AI: "How long do they keep customer data after termination?"

"They retain customer data for up to 90 days."

!Stale · last true 14 months ago · nobody approved it today
Answered from governed publishing

Buyer's AI: "How long do they keep customer data after termination?"

"They delete customer data within 30 days of termination."

Assay seal · policy.retention v7 · verify →
every published claimits approved sourcethe log

Sample workspace · illustrative data. On a live workspace, governed surfaces re-render within a 48-hour SLA of an approved change.

The resolution

Two agents resolve the standstill. One brain keeps them honest.

Marketing gets the AI velocity it wanted. The veto-holder gets a gate that can't be talked around. Both run on the same living source of truth.

The OS · the Truth Graph
DPA, sub-processor, and cert changes propagate within 48h
Living Winning Governed

The dead version is the whitepaper still promising a feature you sunset two releases ago. The living version drops the claim the hour the node changes.

The receipts

A page clean enough that a CISO trusts it.

No logos we didn't earn, no case studies we can't show, no proof we invented. What we offer instead is the mechanism, documented, and our own posture on the record.

Per-claim provenance

Every published claim traces to its approved source. Hover any figure on your governed surfaces and the source is right there.

A tamper-evident log

Every verdict, override, and suppression lands in a chain you can export for a buyer's security review in one click.

§

An independent veto

AI Legal answers to you, not to marketing. A claim with no approved source behind it is blocked, and the block is logged.

Our own posture, documented

We hold ourselves to the standard we sell. The residency, retention, and sub-processor detail lives on our security page. Read it →

Two ways in

Start with what the AI engines already say about you.

The audit reads your public surfaces and shows, claim by claim, what Google and the AI engines are repeating about you right now. Free, yours to keep. Or start with the kit your GC will ask for.

Run the audit First pass on your public surfaces · nobody calls you unless you ask
Get the GC kit
Composed only from claims you've approved. No invented posture, ever. An independent veto that fails closed on an unapproved claim. Every published claim wired to its source, within a 48-hour SLA.

Where this stops

Assay governs what you say to the market. It doesn't audit your controls, practice law, or certify you compliant, because no software can. It gets your approved, current claims in front of the AI engines your buyers ask, and proves every one to its source.

Facts on this page are wired to our Truth Graph · last verified 2026-07-04 · Verify →