Confidentiality isn't aspirational.
Neither is the security questionnaire your biggest client just sent.
We do information security and AI governance for the firms whose product is judgment, advice, and client trust — law firms, accounting practices, consulting and advisory firms, RIAs, and financial professionals where one breach is one too many.
Three places we usually find people.
If one of these sounds familiar, you're not alone. Most professional services firms walk into our office because of a procurement email, an ethics question, or a near-miss at a wire desk.
Your biggest client sent a 30-page security questionnaire.
Procurement attached it to the renewal. Half the answers are "we'll get back to you," half are guesses, and the deadline is Friday. The client representative is friendly. The questionnaire is not. You can tell a real answer from a hopeful one — and so can they.
An AI tool quietly entered your practice.
Maybe it's contract drafting. Maybe it's research summaries. Maybe a paralegal pasted a privileged document into a tool whose terms of service nobody read. The work is genuinely better. The ethics rules haven't moved, and your engagement letters don't say what you'd want them to say if a client asked.
A wire transfer almost went to the wrong account.
A spoofed email. A timing coincidence. Someone's good instinct caught it at the last step. You don't want "almost" to be the policy. The next one might not have a happy ending — and the carrier renewal is asking pointed questions about what happened.
Six concrete pieces of work. Done in plain language.
Compliance vendors love acronyms. Clients want to see receipts. Your ethics rules want both. We translate among all three.
Client security questionnaire response.
We draft the answers your enterprise clients can verify, with the underlying documentation that backs each line. So you can return the questionnaire on time, on accurate, and without a junior associate guessing what "logical access controls" means.
AI governance for client work.
Which AI tools your team can actually use on confidential matters, what your engagement letters should say, what your conflicts process should ask. Practical answers your partners can defend, not a 60-page policy nobody will read.
Wire fraud prevention & response.
Multi-channel verification, BEC training that survives a busy week, controls on the wire desk that don't require courage to follow. And when "almost" stops being almost — we know what to do, who to call, and how to get the money back if there's any chance.
Document retention & e-discovery readiness.
Retention policies that match your practice areas, not generic templates someone bought off the internet. ESI handling, legal-hold workflows, and a paper trail your clients' counsel can verify if they ever need to. Discovery shouldn't be a fire drill.
SOC 2 / ISO 27001 readiness.
When you actually need it for sales. When you don't. What it really requires versus what your auditor's brochure said. We sit on your side of the table — if a Type II report unlocks revenue, great; if it doesn't, we'll tell you that too and save you the cycle.
Cyber insurance renewal support.
Answering the questionnaire so the answers earn the renewal. We've sat in calls with brokers and underwriters — we know which line items move premium, which create exclusions, and which require a phone call before you submit anything in writing.
Three things you won't get from a commodity IT shop.
We understand professional ethics rules, not just IT controls.
Privilege. Conflicts. Confidentiality obligations that survive an engagement. Bar advisory opinions on AI. AICPA guidance. SEC rules for advisors. The control catalog matters, but it's the second thing — the first is whether what you're doing is consistent with the rules of your profession. We start there.
We design controls that fit billable-hour reality.
If a control breaks the workflow, it gets bypassed at the worst possible moment. We build controls that survive a partner's bad day, a deadline week, and the moment a client calls and needs the file in fifteen minutes. Compliance that breaks the work doesn't last.
We've sat in client procurement calls.
When your enterprise client wants to "talk to your security team," that's us. We know which questions to expect, which answers earn the engagement, and which ones quietly cost you the next renewal. Worth more than another PDF policy in the folder.
The questions firm leaders actually ask us.
Bring better questions to the readiness call and we'll go further. These are the starters.
Do we actually need SOC 2?+
Can our team use ChatGPT for client work?+
What about purpose-built AI tools for legal or accounting research?+
A wire transfer didn't go through. What do we do?+
What's the difference between confidentiality and privilege, technically?+
What does this actually cost?+
Three ways in. Pick what fits.
No qualifying call before the qualifying call. Each path is real, each one's free or fixed-fee, each ends with you having a better answer than you walked in with.
Security readiness call.
Bring the questionnaire your client just sent, the AI tools your team is already using, the carrier's renewal questions, the wire-fraud incident you're not sure how to handle. We'll tell you where the real gaps are and roughly what it'll cost to close them.
Schedule the call →Take the AI Readiness Scorecard.
Especially relevant for professional services — AI tools in client work are the new exposure surface. Twelve questions, a real grade, no email gate. Worth taking even if you're not asking AI questions yet — your associates probably are.
Start the Scorecard →Read about the Exposure Report.
Same engagement style we'd run for a security pre-assessment, applied to AI exposure. Worth a look if you want to see how we run paid diagnostics — and to gauge fit before the call.
See deliverables →