Pass the security review that's standing between you and the deal.
AI does the evidence work. People who've reviewed vendors from the bank side make the calls.
We prepare you. Independent auditors certify you.
It usually starts with
an email from a buyer.
A buyer sent a 300-question security questionnaire
“We'll lose this deal if we answer badly.”
Questionnaire supportAn RFP or enterprise contract requires SOC 2
“How fast can we get a report, and what will it cost?”
SOC 2 readinessA European or global buyer asks for ISO 27001
“Do we need certification, or is alignment enough?”
ISO 27001 readinessA DND prime flags CPCSC in the supply chain
“Are we about to lose our defence contracts?”
CPCSC readinessA bank or FRFI vendor risk team starts due diligence
“They want evidence we never wrote down.”
Vendor due diligenceA buyer asks how your LLM feature is governed
“We passed the checklist. Now what?”
AI governanceDeals stall at security review.
Even when you're secure.
Most teams of 10 to 200 have nobody who speaks the buyer's compliance language.
- Frameworks overlap. Same questions, different words.
- Evidence is scattered. Across tools, tickets and people.
- Tools show gaps, not pushback. Software flags what's missing, not what a reviewer will challenge.
Access control policy?
Show me your last access review.
Encryption at rest?
Which keys, and who can reach them?
Incident response plan?
When did you last test it?
Passing a template isn't readiness.
Four ways we get you ready.
Each named for what you get.
We prepare you. Independent auditors certify you. We don't issue SOC 2 reports or ISO certificates.
Readiness Sprint
Audit-ready controls, policies and evidence, handed to your auditor.
We confirm what your buyer requires, close the gaps Fulcrum finds, and get you ready for the auditor.
- Gap read and roadmap
- Policies and controls
- Evidence in Fulcrum and Vanta
- Audit-day support
- For
- Companies facing a certification requirement in an RFP or contract.
- Typical duration
- Typically 8 to 16 weeks
- Frameworks
- SOC 2ISO 27001CPCSC
Security Questionnaire and Vendor Due Diligence Support
Answers you can defend, backed by real evidence.
We tie each answer to a real control and flag missing evidence before the buyer finds it.
- For
- Companies mid-deal with a bank, FRFI or large enterprise.
- Typical duration
- Typically 1 to 3 weeks
Fractional Compliance Lead
A named person running your compliance program every month.
After the sprint, we keep your controls running, handle new questionnaires and prepare you for surveillance audits.
- For
- Companies that need someone to own compliance long term.
- Typical duration
- Ongoing, billed monthly
AI Governance Readiness
Controls and evidence that show how your AI is governed.
We document how your AI is governed and build the evidence buyers ask for, aligned to the EU AI Act where it applies.
- For
- Teams shipping LLM features to regulated buyers.
- Typical duration
- Set when we scope your product
Fulcrum does the evidence work.
Our people make the calls.
Fulcrum is our own AI-native platform. It maps where you are today against the framework and your buyer's likely questions, drafts policies, and matches questionnaire answers to your controls. Every judgment call goes to a person.
Tap a step
Confirm what your buyer actually requires
We read the questionnaire, RFP clause or contract with you and confirm which framework applies. Fulcrum then runs a gap read against that framework and the questions your buyer is likely to ask.
- InferredCC6.1 Logical access
Policy exists. No record of quarterly access reviews.
- UnverifiedCC7.3 Incident response
Plan cited in questionnaire Q14. Not found in evidence.
- VerifiedCC8.1 Change management
Pull request approvals enforced on main branch.
- Reviewer callCC9.2 Vendor management
Buyer is a bank. Expect questions on your own subprocessors.
Every finding is labelled verified, inferred or unverified. Not client data.
Scroll or click a step
- InferredCC6.1 Logical access
Policy exists. No record of quarterly access reviews.
- UnverifiedCC7.3 Incident response
Plan cited in questionnaire Q14. Not found in evidence.
- VerifiedCC8.1 Change management
Pull request approvals enforced on main branch.
- Reviewer callCC9.2 Vendor management
Buyer is a bank. Expect questions on your own subprocessors.
Every finding is labelled verified, inferred or unverified. Not client data.
1 / 3We know what the reviewer looks for.
We were the reviewer.
Nearly two decades in commercial banking across West Africa and Canada, including vendor risk reviews from inside the bank.
Kayode watched good companies lose deals because they couldn't prove they were secure. Aidrome exists to fix that.
Team, by role
- Chief of Staff and Senior Program ManagerLeads government relations and operations
- GRC LeadISO 27001 Lead Auditor, CISA
Recent
- Vanta service partner
- OWASP Ottawa talk, October 2026: “Your LLM App Passed the Checklist. Now What?”
We practise
what we sell.
We hold ourselves to the standard we prepare you for, and we're clear about our role.
We prepare companies for the audit. Independent auditors and certification bodies certify them. Aidrome isn't an auditor or a certification body, and doesn't issue SOC 2 reports, ISO certificates or audit opinions.
Evidence over assertion
We label every finding verified, inferred or unverified, and we don't claim more than the evidence shows.
Start from the buyer
We prepare you the way a bank's vendor risk team or a defence prime will actually assess you.
Real readiness
Passing a template isn't enough. Controls have to work in the live system.
Your documents stay confidential
Questionnaires are often marked confidential. We'll sign an NDA before you send anything.
Send us the questionnaire you're stuck on.
Upload the questionnaire or RFP clause holding up your deal. Within two business days we'll send back a short gap read: what your buyer is likely to push on, and what evidence is missing.
How we handle your documents
These documents are often marked confidential. If yours is, ask for an NDA first and don't upload anything until it's signed. Our Privacy Policy explains how we store uploads, who sees them and when we delete them.
Rather talk first? 30 minutes, free.
Online booking opens shortly.