What we build12 of 12Safety18 things we build
Nobody can tell you what the AI did.
Every AI action is on record, a person says yes before anything leaves, and the stop switch is yours.
Tested on twenty of your own past actions before it goes live, and kept working as AI changes.
Eashan Gupta, founder. You meet him on the first call.
All 18
Everything we build for safety.
Each one opens with what we build, three examples and what we don't promise.
A sample audit trail for IT: a customer list kept out of a public AI tool, and an access request the IT head approved.
-
Clear rules for which AI your staff may use
Approved AI tools for staff, rules on which data may go where, and a warning before client data leaves.
What we build
- A survey of the AI tools your staff already use, from expense claims, a short form and your own network logs.
- A one page AI policy in plain words: approved tools, banned data and who to ask.
- A browser check that warns or blocks before client files or personal data go into an unapproved tool.
- An approved assistant that's better than the public apps, so staff have a reason to switch.
- A monthly view of AI use by team, with risky patterns flagged.
For example, in your trade
- Law firms. A CA firm sees which staff use public AI apps, and a warning appears when someone pastes a client's PAN or bank statement.
- Recruitment. A staffing firm stops CVs with phone numbers going into public AI tools and gives recruiters an approved one instead.
What we don't promise. No control stops someone typing on a personal phone, so we pair the checks with training and a better approved tool, and don't promise zero leaks.
-
Every AI answer checked before a customer sees it
Each answer is checked against your sources and rules, and held for a person if it fails.
What we build
- A check that every fact in an answer appears in your own documents.
- Your written policy turned into rules: no refunds promised, no medical advice, no prices outside the list.
- Checks for personal data, rude replies and attempts to trick the assistant.
- Failed answers held for a person, with the reason shown.
- A weekly report of what was blocked and why.
For example, in your trade
- Finance. A broker's assistant can explain a policy, but any answer that sounds like a claim decision goes to a person first.
- Diagnostic labs. A clinic chain's booking assistant is stopped from giving advice about symptoms and offers a doctor's call instead.
What we don't promise. Checks cut wrong answers sharply but can't remove every one, so anything that commits money, health or law stays with a person.
-
AI agents a stranger's email can't steerNew
Whatever an agent reads in mail, web pages or files, it can't send, pay or delete without your yes.
What we build
- Everything an agent reads marked as outside text that can't give it instructions.
- Each agent given only the tools and data its job needs, with short-lived access.
- Sends, payments and deletions held for a person's yes, whatever the agent was told.
- Add-ons and plug-ins checked before install, from sources you approve.
- Attack tests run against your agents before launch and after every change.
For example, in your trade
- Moving. A freight firm's AI mail agent ignores a bank detail change hidden in a supplier's email and flags it for the accounts team.
- Software companies. A software company's AI support agent can read tickets but can't run refunds or export data, whatever a ticket says.
What we don't promise. Nobody can yet make an agent fully safe from hidden instructions, so we limit what each agent can do and every action that matters waits for a person.
-
Rules for what AI may do aloneBuilt before
For each job, written rules on what AI does alone, what needs a yes, and what stays with people.
What we build
- A map of each job's actions, sorted into 'do alone', 'ask first' and 'never'.
- Limits by amount, customer and risk, set by you and changed in one place.
- Yes or no cards on your phone with the facts and the AI's reason attached.
- Limits that widen as the AI's track record grows, and only when you agree.
- A monthly review of every automatic action and every override.
For example, in your trade
- Hospitality. A hotel's assistant may move a booking date on its own, but any refund over ₹5,000 waits for the duty manager's yes.
- Moving. A transporter's AI agent books loads at the rate card by itself and sends anything below the floor rate to a manager.
What we don't promise. Rules only cover the cases you've described, so anything new goes to a person by default, and the AI never acts alone on money without your written limit.
Built before
- An agent for every delegate, for an industry body in Asia Pacific, at a leadership workshop.
-
AI tested on your own cases, before launch and every week
A test set from your real work scores every AI system before launch and again after every change.
What we build
- Hundreds of real cases from your files, each with the answer your best person would give.
- A score for accuracy, tone and safety, with a pass mark agreed with you.
- Attack tests: tricky questions, false facts and attempts to leak data.
- A run on every change and every week, with an alert when the score drops.
- A results page you can show your customers or auditors.
For example, in your trade
- Software companies. A software company tests its AI feature on 500 real customer questions before each release and shares the scores with buyers who ask.
- Government. A government helpline's assistant is tested for accuracy in Hindi and English every week, and a drop below the pass mark pauses it.
What we don't promise. A test set covers the cases you've seen, not every case to come, so we keep adding new ones and never call a system perfect.
-
Every AI action on record, ready for an auditor
Every question, answer, source, approval and action kept in one record that can't be quietly edited.
What we build
- A record of each AI step: what it read, what it said, what it did and who approved it.
- Records sealed so any later change shows, kept for as long as your rules require.
- Search by customer, case, date or person, with an export your auditor can read.
- Logs kept in India for the period your regulator asks.
For example, in your trade
- Finance. A wealth firm shows a regulator, for any client, the risk profile, the advice given and the consent, in one export.
- Moving. A customs broker can show who changed each filing, when, and what the AI suggested before the change.
What we don't promise. A record shows what happened but doesn't make a decision right, so people stay answerable for every approval and we don't promise an audit will pass.
-
Records sealed the moment they're made
Photos, signatures and time stamps sealed as they are made, so any later change would show.
What we build
- A phone app that captures photos, video, location and time, and seals each record as it's taken.
- Signatures and sign-offs captured on site, offline if needed.
- A sealed PDF report with each record's fingerprint, ready for a court certificate.
- One archive where every record can be found by job, place or date.
For example, in your trade
- Power contractors. A solar installer keeps geo-tagged photos, panel serial numbers and the customer's sign-off for every rooftop, ready for a subsidy inspection.
- Store chains. A jeweller records each old gold exchange with the purity test, photos, the valuation and the customer's signature.
What we don't promise. A sealed record shows nothing changed after capture, but we don't promise how a court or an arbitrator will weigh it.
-
Ready for India's data protection law
A map of your personal data, consent records, rights requests handled and a breach plan, before the deadlines.
What we build
- A map of every place personal data sits, who can see it and why you hold it.
- Consent notices in plain words and in each language, with every consent recorded.
- A desk for access, correction and deletion requests, with each one tracked to done.
- Retention rules that delete what you no longer need, on a schedule.
- A breach plan and a drill, so the right people are told in time.
For example, in your trade
- Education. A school group records parents' consent for each use of a child's data and can show it on request.
- Associations. An association shares attendee data with sponsors only where consent was given, and every share is logged.
- Diagnostic labs. A skin clinic chain keeps before and after photos in a secure vault, never on staff phones, with every view logged.
What we don't promise. We build the records and processes the law asks for, but we aren't your lawyers, and your counsel signs off how the rules apply to you.
-
An AI policy and register your board signs
A register of every AI system you use, its risks and owner, and a policy your board signs.
What we build
- A register of every AI system and tool in use, with its owner, data and risk level.
- An AI policy and risk rules matched to your sector's regulator and your clients' contracts.
- An impact check before any new AI system touches customers or staff.
- Board papers each quarter on AI use, incidents and results.
- Readiness for an AI management system certificate when clients ask for one.
For example, in your trade
- Finance. A lender's board approves an AI policy that covers every model used in credit and collections, as the central bank's committee recommended.
- Software companies. A software company selling into Europe knows which of its AI features carry labelling and record keeping duties there.
What we don't promise. We prepare the policy, the register and the evidence, but your board owns the policy and only an accredited auditor can certify you.
-
Every ad, claim and AI label checked against the rules
Ads, product claims, labels and AI-made content checked against the law and your approvals before publishing.
What we build
- A library of the claims you can prove, each linked to its evidence.
- A check on every ad, post, pack and page for claims outside that library.
- Your sector's rules built in: health, food, finance and advertising codes.
- AI-made pictures, voices and films labelled and logged the way platforms and the law ask.
- A named approver for each risky piece, with the trail kept.
For example, in your trade
- Store chains. A supplement brand's ads are checked for health claims it can't prove before any money is spent on them.
- Media. A publisher labels every AI-assisted picture and story, and a named editor signs each one off.
- Finance. A wealth firm's posts are checked for return promises and missing risk lines before they go live.
What we don't promise. We never give legal sign-off: we check against the rules and evidence you give us, and your legal or compliance person makes the final call.
-
Your customers' security forms, answered from the evidence
Security questionnaires answered from your real policies, with the evidence kept ready for ISO 27001 or SOC 2.
What we build
- Your policies written or tidied: access, backups, incidents, vendors and AI.
- A library of approved answers, each linked to its evidence.
- Questionnaires drafted from that library, checked by someone on your team and then sent.
- Evidence collected from your systems every month, ready for an auditor.
- A public trust page that answers the common questions before they're asked.
For example, in your trade
- Software companies. A software startup answers a bank's 280 question security form, every answer tied to a document.
- Relocation. A relocation company clears a global client's vendor security review with its policies and evidence already in one place.
What we don't promise. We prepare answers and evidence, but every answer must be true of how you really work, and only an accredited auditor can certify you.
-
The right access for each person, gone when they leave
One sign-in for every system, access by role, and every account switched off when someone leaves.
What we build
- One company sign-in with passkeys or a second step, across your tools.
- Access by role, so each person sees only what their job needs.
- Joining and leaving lists that open and close every account in one go.
- Shared passwords moved into a company vault.
- A monthly access review that flags anything odd, like a leaver who is still active.
For example, in your trade
- Recruitment. A staffing firm closes a departing recruiter's mail, CRM and job board accounts as soon as the exit meeting is logged.
- Diagnostic labs. A hospital's staff reach patient records only for their own ward, and every look is logged.
What we don't promise. Access control only covers the systems connected to it, so we list every tool you use first and say plainly which ones we can't reach.
-
Your company's security, watched and explained in plain words
Logins, devices, backups and data leaving the company watched every day, with a plain note on anything odd.
What we build
- Alerts on risky sign-ins, leaked passwords and laptops missing updates.
- Backups proved every week by restoring a sample.
- A watch on large downloads and files going to personal mail or drives.
- A morning note in plain words: what happened, what it means and what to do.
- An incident plan with who to call, and the six hour report CERT-In's directions of April 2022 require.
For example, in your trade
- Law firms. A CA firm is told when a staff login comes from an unusual city, with what to do next.
- IT firms. An IT reseller runs this watch for 40 small customers and sends each a monthly report under its own name.
What we don't promise. Watching shortens the time an attack goes unnoticed but can't stop every one, so we test your backups and your plan too and don't promise you can't be breached.
-
Security holes found and proved, on every releaseNew
AI testers attack your apps the way a hacker would, and prove each hole with a working test.
What we build
- AI security testing of your website, apps and APIs, run with your written permission.
- Only proven holes reported, each with the steps to reproduce it.
- A suggested fix for each one, and a retest once it's fixed.
- A test on every release, so new code doesn't reopen old holes.
- A human tester's review of the riskiest findings and of the business logic AI misses.
For example, in your trade
- Store chains. An online store learns that changing one number in a link showed other customers' orders, and fixes it before launch.
- Finance. A lending app's AI tester tries every way around its KYC step on each release, and the team closes the one path that worked before the release ships.
What we don't promise. We only test systems you own and authorise in writing, and a clean report never means you can't be hacked.
-
Fake sites, fake calls and fake candidates spotted
Lookalike sites and accounts using your name found and reported, and fake calls checked before any money moves.
What we build
- A daily search for lookalike domains, fake apps and social accounts using your name.
- Takedown requests drafted for each one, with the evidence attached, for your approval.
- Call-back rules and code words for any payment or bank detail change.
- Checks on video interviews for stand-ins and swapped faces.
- Drills for your accounts team with fake calls and mails, made with consent.
For example, in your trade
- Hospitality. A food brand learns when a new site starts selling fake franchises in its name, with the takedown drafted.
- Finance. A finance team refuses an urgent transfer asked for on a video call that looked like the CFO, because the code word didn't match.
- Recruitment. A staffing firm spots a candidate whose face and voice don't match between two interview rounds.
What we don't promise. No tool spots every deepfake, so we pair detection with call-back rules, and takedowns depend on the platforms and registrars acting. Candidates are told and agree before any face or voice check.
-
Customers, suppliers and buyers abroad checked against sanctions and court records
Checks every customer, supplier and overseas buyer against sanctions lists, court records and bad news, then rechecks monthly.
What we build
- Every new name checked against the main sanctions and watch lists, at sign up and before each shipment.
- Indian court records, insolvency notices and company filings searched for each party.
- News about each party read for fraud, bribery and trouble with regulators, in the language it's written in.
- Every possible match sent to a person with the evidence side by side.
- A monthly recheck of everyone you trade with, and a record of every check for your bank.
For example, in your trade
- Manufacturing. A pump exporter checks a new distributor in the Gulf before the first shipment and finds the owner's other company on a sanctions list.
- Moving. A freight forwarder screens every consignee before it books a shipment, and a match goes to the compliance head with the evidence.
- Finance. An NBFC checks each new borrower's directors against court records and insolvency notices before credit sees the file.
What we don't promise. Name matches throw up false alarms, so every hit goes to a person with the evidence, and we never decide who you may trade with.
-
Spam, scams and abuse kept off your pages and platform
Hides spam, abuse and scam replies on your pages and ads, and checks listings and reviews before they're live.
What we build
- Replies on your social pages and ads read as they arrive, with scams, abuse and spam hidden.
- Listings, reviews, photos and profiles on your platform checked against your rules before they go live.
- Accounts pretending to be you or your staff found and reported.
- Takedown requests tracked against the hours the IT Rules allow.
- Appeals sent to a person, and a monthly read of what was removed and why.
For example, in your trade
- Store chains. A fashion brand's ad comments hide replies offering refunds through fake WhatsApp numbers as soon as they are posted.
- Brokerages. A rental platform checks every new listing's photos and text for fake addresses and known scam patterns before it goes live.
- Education. An edtech app keeps abuse and phone numbers out of its student forum, and a moderator sees anything borderline.
What we don't promise. Automatic checks miss some posts and catch some innocent ones, so appeals go to a person, the rules are yours, and takedowns meet the hours the IT Rules set.
Most owners don't know
New threats, and what stops them.
A cloned voice asks for money, and the family's code word stops it.
A code word beats a cloned voice
A call-back rule and a word only your family knows stop the fake call.
An AI hacker working for you
AI testers attack your app the way a criminal would, on every release.
AI agents that ignore orders hidden in email
Agents built so nothing they read can send, pay or delete.
It works today. We keep it working tomorrow.
How it works- Work it out, most consultants stop here
- Build it, most software firms stop here
- Run it
- Answer for it
- We stay
Tell us what your AI must never do.
In 45 minutes with Eashan you leave knowing what we'd build first, and why. Nothing to sign.
What stays yours
- Your accountsin your company's name
- Your codeevery line of it
- Personal dataabout your customers and staff, on your own machine unless you approve otherwise in writing
- Plain files and a how-to guideif you stop
Eashan Gupta, founder. You meet him on the first call.