The problems this exists to solve.
How it works for your team, day to day.
1,400+ tools, already assessed
Each catalog entry carries the assessment your team would otherwise do by hand: data handling, model-training use, retention behavior, hosting region, and authentication posture — condensed into a risk score your analysts can defend.
Current because it has to be
Entries are re-scored as vendors ship new models, change terms, or alter data practices. The catalog is maintained as a living dataset — the point is not that it was accurate once, but that it stays accurate while the market moves weekly.
Assessment wired to enforcement
A catalog verdict is one click from becoming a control: sanction, restrict, or block flows straight into the policy engine, and the sanction state shows up in discovery views so the whole loop — find, assess, decide, enforce — lives in one place.
The questions we hear most.
What goes into a risk score?
Vendor data handling, whether prompts are used for training, retention behavior, hosting region, authentication options, and observed usage patterns — decomposed so an auditor can see why a tool scored the way it did.
Can employees request a tool?
Yes — request workflows route through the catalog entry, so the reviewer starts from the assessment instead of a blank page.
Can we add internal AI tools?
Yes — internal and custom tools get catalog entries with the same scoring dimensions, so one inventory covers bought and built.
Can we export the catalog view?
Yes — filtered exports (CSV/JSON) for GRC platforms and third-party-risk reviews.