The problems this exists to solve.
Built for enterprise AI.
How it works for your team, day to day.
1,400+ tools, already assessed
Each catalog entry carries the assessment your team would otherwise do by hand: data handling, model-training use, retention behavior, hosting region, and authentication posture, condensed into a risk score your analysts can defend.
Current because it has to be
Entries are re-scored as vendors ship new models, change terms, or alter data practices. The catalog is maintained as a living dataset. The point is not that it was accurate once, but that it stays accurate while the market moves weekly.
Assessment wired to enforcement
A catalog verdict is one click from becoming a control: sanction, restrict, or block flows straight into the policy engine, and the sanction state shows up in discovery views so the whole loop (find, assess, decide, enforce) lives in one place.
The questions we hear most.
What goes into a risk score?
Vendor data handling, whether prompts are used for training, retention behavior, hosting region, authentication options, and observed usage patterns, decomposed so an auditor can see why a tool scored the way it did.
Can employees request a tool?
Yes. Request workflows route through the catalog entry, so the reviewer starts from the assessment instead of a blank page.
Can we add internal AI tools?
Yes. Internal and custom tools get catalog entries with the same scoring dimensions, so one inventory covers bought and built.
Can we export the catalog view?
Yes. Filtered exports (CSV/JSON) for GRC platforms and third-party-risk reviews.