AI assurance, so your firm can grow at the speed of AI, safely.
Assure is AI assurance done by people, for law firms, accounting firms and financial services firms putting AI to work and preparing for EU AI Act compliance. Software watches, our people judge, your firm decides.
We are currently working with law and accounting firms in Portugal.
What AI assurance covers.
We cover four areas, and one account manager looks after all of them.
AI audit and inventory
Every AI tool, model, agent and connector your firm uses, sanctioned or not.
- Shadow AI, brought into the open
- An AI risk assessment for each tool
- A human in the loop on every new tool
AI data security
Safe paths for client data, and a watch for AI data leakage.
- Safe architectures for AI tools
- A safe place to vibe code
- AI privacy settings, checked
Information governance
The right permissions on every tool, written down and kept true.
- An AI acceptable use policy
- An owner for each AI tool
- AI third-party risk management
Cyber resilience
Backups and recovery checked, so people can experiment with confidence.
- Backups out of reach of AI tools
- A recovery plan your IT team has tested
- Cyber insurance prep
How it works.
We work on 12-month contracts, scoped and quoted for each firm. You keep everything we deliver, including an evidence file to show clients, auditors, insurers and regulators.
- 01
A conversation
How your firm uses AI, and where you want to take it.
- 02
A scoped quote
One contract, scoped to your firm.
- 03
The audit
Your AI inventory, with findings and recommendations.
- 04
Monitoring and sign-off
We review what the software finds. Your account manager signs a report every month.
Read-only access, under your control.
When we find something
We tell you at once, with our advice. Your IT team or provider makes the change, and we confirm it worked.
An extra pair of hands
Need something built? We recommend AI-native development companies we have vetted, and keep watching their work.
Independence
We sell no tools and take no commission from any vendor, those developers included.
- Access
- Read-only
- Approved by
- Your firm
- Before we connect
- An NDA and a GDPR data processing agreement
- Logged
- Every time we connect
- Withdrawable
- At any time
- We store
- Our findings, in the EU
- Client data kept
- None
Who does the work.
Each firm gets a senior developer as its account manager, trained in computer science and cyber security: one named person who knows your systems, backed by the team behind them.
Tiago Martins leads the technical team.
- 2013
notacompany
Founded notacompany. Backed and advised Superstables, Ern, xMoney and the charity Acreditar.
- 2018
Coinvision
Founded Coinvision, which ran technical due diligence on blockchain investments to protect people from scams.
- 2020
Polkastarter
Co-founded Polkastarter, one of the first open fundraising platforms, as CTO. In its first 18 months: 700,000 users and more than $100M in investment volume.
No breaches, no hacks.
- Now
Assure
The same care, for firms adopting AI: AI due diligence, every month.
Questions firms ask.
How does Assure help with the EU AI Act?
Preparing for the EU AI Act starts with knowing which AI systems your firm uses, what they reach and who owns each one. Our AI inventory, monthly reports and evidence file keep that record current as the Act's obligations phase in through 2026 and 2027. The legal reading is your lawyers' call, and the record is built to help them make it.
What does an AI audit include?
An AI inventory of every AI tool, model, agent and connector in use, sanctioned or not, and a review of the data each one reaches, its settings and access, and the firm's policies, owners and recovery plans. You receive the findings with our recommendations, and they are yours to keep.
Is vibe coding safe for a firm?
It can be, and we like seeing people build. What makes it safe is the setup: a place to build, permissions that keep client data out of reach until a tool is approved, and a person reviewing what goes live. We recommend it, your IT team sets it up, and we keep an eye on it.
Is this a software platform?
Assure is a service run by people, and monitoring software is one of their instruments: it watches all the time, our people judge what it finds, and your firm decides. In your budget it sits with data protection consulting and data governance consulting, for the AI tools your firm uses, every month.
Who is Assure for?
Law firms, accounting firms and financial services firms that use AI to grow. AI for law firms reaches privileged files and client correspondence, and at an accounting firm it reaches every client's ledgers, so the AI tools are now part of cyber security for law firms and cyber security for accounting firms alike. We are currently working with law and accounting firms in Portugal.
Do you help with cyber insurance?
Yes. Before your policy is placed or renewed, we work through the insurer's questionnaire with you, from your evidence file, and flag any gap early enough to close. Your insurer sets the terms, and we help you show them what you already do well.
Do you certify?
Certification is done by accredited bodies, and we prepare you for it: the evidence and readiness that AI compliance asks for, in a file you keep. We are glad to work alongside your auditors and lawyers.
How is it priced?
Every firm is different, so we quote after a first conversation, once we know how you use AI. Contracts run for 12 months.
What is AI assurance?
AI assurance is independent, ongoing checking of how an organisation uses AI: which tools it runs, what data they reach, and whether the rules around them are followed. At notacompany our people do it, so a firm can use more AI, safely.
What is shadow AI?
Shadow AI is any AI tool used at a firm without anyone approving it, often on a personal account. It usually means someone found something useful, so we bring it into the open and help you keep what is safe.
What is AI resilience?
AI resilience is a firm's ability to keep working, and to recover, when an AI tool fails, is misused, or deletes, corrupts or encrypts data. We check the parts of data resilience that tend to fail quietly: backups out of reach of AI tools, a recovery plan your IT team has tested, and no single tool or person able to break critical systems. That is what lets people experiment with confidence.
Start with a conversation.
Tell us how your firm uses AI today. A person on our team replies within two working days to set up a first conversation, and your quote follows it.
Request a quoteOr write to us at hey@notacompany.com.