Ninety days from first call to a signed proof.
Every step, every day, and who is in the room — on your side, on ours, and the third parties that make the result independent. Thirty days of preparation, sixty days of engagement, six gates, one seal. Then a year of surveillance.
Seven phases at a glance
Scope it, screen it, open the doors
Everything that must be true before Day 0: a shared understanding of what the model is for, proof that we are independent of it, and the access to test it without ever seeing your plaintext weights.
Discovery call
Forty-five minutes with the practice lead. We leave with the intended purpose, a first risk classification and the regulatory regime that applies.
Preliminary questionnaire returned
Model inventory, deployment context, data sources and prior testing. Nothing sensitive yet — enough to size the work honestly.
Conflict & independence screen
Every proposed pod member is checked against your vendors, investors and prior work. Anyone who touched the build is excluded. A signed independence declaration follows.
Scoping proposal & pod composition
Named team, gates, thresholds to be declared, timeline and fee. Engagement letter and NDA drafted; procurement and legal review begins.
Engagement letter signed · escrow appointed
A neutral escrow agent is appointed to hold the sealed evaluation set so neither party can alter it after Day 18.
Access provisioning
Confidential-compute enclave stood up inside your perimeter, read-only artefact vault, named accounts with hardware keys. We test inside it; weights never leave.
Say what the model is for, and what “good” means
The scope gate turns intentions into declarations that can be tested against: an intended-purpose statement, a risk class, and numeric thresholds per metric and protected group — agreed before anyone sees a result.
Kick-off
Both teams in one room. Roles named, escalation path agreed, calendar of gates fixed. Working papers opened.
Intended-purpose statement & risk classification
One page, signed by an accountable executive: what the model decides, for whom, with what human oversight. Mapped to EU AI Act, NIST AI RMF and ISO/IEC 42001 clauses.
Threshold declaration
Metrics, protected groups and acceptable ranges — e.g. equal opportunity difference within ±0.05 — declared and frozen. Your fairness committee signs; we counter-sign.
Gate 1 · Scope
Purpose, risk class and thresholds are locked. Changing any of them later re-opens the gate and is recorded in the certificate.
Fix the artefacts, seal the test
We take custody of what will be tested — model hash, data lineage, documentation — and seal the evaluation set with a third party, so the run is reproducible years later and no one can tune to the test.
Artefact intake
Model weights hashed in place, training-data lineage, model card, prior evaluations and change history. Every item is hashed into the run manifest.
Gate 2 · Artefacts
The manifest is complete and immutable. From here, the model under test has one identity: its hash.
Data validation & lineage
Provenance, consent basis, representation by protected group, duplication and leakage between train and test. Findings here can stop the clock.
Evaluation set sealed in escrow
The frozen test set is hashed, timestamped and deposited with the escrow agent. You may observe; neither party may alter it.
Gate 3 · Data
Data is fit to test against. Any accepted data risk is signed by your data owner, not by us.
Run everything, inside the enclave
Eight evaluation suites and a security assessment run in parallel inside confidential compute. Results are computed against the declared thresholds — not interpreted afterwards.
Evaluation suites
Accuracy, grounding, robustness, calibration, drift, explainability, fairness and load — executed in the attested enclave. Each case hashed into the run.
Mid-point readout
What has run, what is pending, early signals. No conclusions yet — the point is no surprises at Day 42.
Security assessment
Red team against the deployed stack: prompt injection, data exfiltration, supply chain, OWASP LLM Top 10. Weight-storage and key-management review.
Fairness & calibration analysis
Group metrics side by side with the Day 4 thresholds. A breach becomes a named finding automatically.
Gate 4 · Evaluation
All suites complete and reproducible. Preliminary findings register drafted.
Every finding gets an owner, a severity and a date
Findings are yours to fix; we do not touch the model, because we will sign it. Anything not remediated needs an accepted-risk sign-off from someone who did not build it.
Findings register issued
Each finding carries severity, owner, SLA and the required remediation before certification. Ownership is accepted in writing.
Remediation window
Your team fixes; we advise on evidence, never on implementation. Re-tests run against the same sealed set from escrow.
Gate 5 · Fairness
Group metrics within declared thresholds, or an accepted-risk sign-off on file.
Accepted-risk sign-offs
Residual risks are documented and signed by your risk committee. They appear, verbatim, in the certificate.
Gate 6 · Security
Critical and high security findings closed and verified; compute attestation current.
Independent review, then a signature that anyone can verify
The evidence is closed. Assurance reviews the working papers; a signer who took no part in the testing reviews the evidence; the certificate is composed and signed with a post-quantum key.
Assurance review of working papers
Every result traced to a hashed artefact, every finding to an owner, every gate to a signature.
Independent signer review
A practice lead who has not been on the pod reads the evidence cold and may refuse. This is the step that makes the seal worth something.
Certificate composed & signed
Model hash, data lineage, compute attestation, fairness result, security result and policy mapping bound into one certificate. Signed ML-DSA-65, HSM-backed key, timestamped.
Certification issued · board readout
The Trust Proof is published; anyone can verify it without contacting us. Your board receives the seven-page assessment report.
A certificate that watches the model it certifies
Certification is a statement about a hash at a date. Surveillance keeps it honest: runtime attestation, drift monitoring and a scheduled review as models and regulations change.
Runtime attestation & drift monitoring
Population stability (PSI), performance and attestation state watched continuously. A breach re-opens a finding; a hash change voids the certificate.
First surveillance check
Thresholds re-run on production traffic sample. Short letter to the sponsor; entry appended to the transparency log.
Mid-term review
Policy mapping refreshed against new regulation and guidance; accepted risks re-confirmed by the risk committee.
Re-certification
Lighter cycle against the same sealed set plus new cases. Signer rotation rule applies after two consecutive cycles.
Who is in the room, phase by phase
A filled mark leads the phase; a hollow mark participates. The independent signer appears exactly once — and never before the evidence is closed.
Day −30 starts with a 45-minute call.
We leave it with an intended-purpose statement, a risk class and a first read on which regime applies. The rest of the plan follows from those three lines.