Scarlet AI Governance
See every AI tool your employees are actually using — before it becomes a breach.
Unsanctioned assistants, browser extensions, and unmanaged API keys are moving your customer data through systems nobody approved, logged, or reviewed. This module finds them, scores them, and writes the policy that governs them.
Prefer to buy now? Start checkout.
Pricing
$20,000 for year one, billed annually upfront. Quarterly payments on an annual contract are also available.
After year one, keep it current for $10,000 per year. Multi-year agreements available.
Prefer to buy now? Start checkout.
Self-serve checkout. No sales call required.
The shadow AI problem
Your team adopted AI faster than your policies did.
Nobody asked permission. Someone pasted a customer contract into a free chatbot. Someone installed a note-taking extension that reads every meeting. Someone left an API key in a personal account with no rotation, no logging, and no owner. None of it shows up in your vendor list, none of it is covered by a policy, and all of it is your liability the moment a customer, insurer, or regulator asks what AI you use and what data goes into it.
Risk-scored inventory
Every tool gets a data-sensitivity rating, a sanctioned/unsanctioned flag, and a risk score you can take to a board or an auditor.
Policy drafted to findings
An AI governance and acceptable-use policy written against what you actually found — not a generic template you have to rewrite.
Depth nobody prices for SMBs
Enterprise AI-governance programs start in the six figures. This is the same discipline, priced for a company without a CISO.
Enterprise-grade reporting
Exportable inventory and gap reports built for customer security reviews, insurers, and SOC 2 / ISO 27001 evidence.
How it works
Three steps to a defensible AI inventory.
- 01
Share what you know is in use
Send a list of your SaaS and AI tools — a CSV export from your IdP or expense system, or just a written list. No agents to deploy.
- 02
AI risk scoring and gap analysis
Each tool is scored on data exposure, vendor posture, and sanction status, then checked against the gaps your list implies: unmanaged API keys, browser extensions, and personal-account usage.
- 03
Governance policy tailored to findings
You get a drafted AI governance policy, an approved-tool list, and a prioritized remediation plan for the highest-risk exposures.
Optional
Request a walkthrough.
Checkout above is the fast path — this form is only here if you'd rather have a conversation first. We'll reply by email.
FAQ
Questions, answered.
How long does it take?
Your inventory, policy and remediation plan are delivered within 10 business days of receiving your complete tool list.
What do you need from us?
A SaaS or AI tool list, either a CSV export or a written list. There are no agents to deploy. We run intake with you during onboarding.
What happens after year one?
Year one builds your baseline. From year two, the ongoing program is $10,000 per year and includes:• Two re-inventories per year: you send an updated tool list, and we score every new or changed tool• Updated risk scores and sanctioned or unsanctioned status• Policy updates when your tools or findings change• An updated remediation plan• Refreshed reports for audits, customer reviews and insurers
How is our data handled?
See our Security page for how we protect your data.
Who is this for?
Companies without a full-time CISO that use AI tools and face customer security reviews, audits or insurance questionnaires.
Looking for something smaller? Start with Shadow AI Lite (requires Scarlet Pro or above).
Part of the Scarlet Risk platform
AI Governance sits alongside the rest of the suite.
Compliance, simplified.
Scarlet Comply
Policies, controls, deadlines, and audit evidence for SOC 2, HIPAA, CMMC, and ISO 27001.
Intelligence, delivered.
Scarlet Intel
Daily threat briefings and World Watch updates.
Governance, organized.
Scarlet Governance
Risk register, AI governance and vendor risk in one place.