How it works
No jargon, no diagrams you need an engineering degree to read. What the problem is, what IndexTracer actually does about it, what happens in a single moment, and exactly how it gets switched on in your company.
The problem
You have given AI assistants real jobs. One handles refunds. One answers support tickets and can look up customer records. One files documents. They act thousands of times a day, and nobody is watching each action.
Three things keep a finance director awake. The assistant does something it should never have done, like refunding four thousand pounds when the limit is five hundred. The assistant sends customer data somewhere it should not go. And when the auditor asks you to prove these things were allowed, nobody can, because there is no record.
What it is
Three parts, and they are easiest to understand as three physical things.
Part one
A written list of what each assistant is allowed to do. The refund assistant may refund up to five hundred pounds. The support assistant may read names and emails but never card numbers. Anything touching medical details goes to a named person first.
The rules are written once, in plain terms, by the person who owns the risk. Not buried in code by whoever built the assistant.
Part two
Software that sits between the assistant and the real world. Every action has to pass through it. It reads the rulebook, decides in a fraction of a second, and either waves the action through, stops it, or holds it for a person to approve.
The assistant cannot go round it, in the same way a passenger cannot go round passport control.
Part three
Every decision is written down permanently. Who asked, what they asked for, what was decided, and why.
The entries are chained together so that changing an old one breaks the chain visibly. Nobody can quietly edit the past. Not your staff, not us.
One moment, start to finish
Here is the entire product doing its job, from the assistant's decision to the auditor's question three months later.
It believes it is helping. It has no idea there is a limit.
The rulebook is held in the checkpoint's memory, so it does not need to phone home. It sees the limit is five hundred pounds.
The assistant is told why, so it can tell the customer a person will review it. This takes about as long as a blink. Your customer never sees a delay.
The time, the assistant, the amount, the rule that stopped it.
You filter the logbook to refunds and show them every one: allowed, stopped, or sent to a person. You show the rulebook as it stood on each date, and who approved every change to it. That is the whole audit conversation.
Getting set up
Most compliance tooling takes a quarter before it tells you anything. This is the honest timeline, step by step.
Day oneAbout ten minutes
Most companies do not know how many AI assistants they have. People build them in corners of the business. So the first thing we do is look, without touching anything.
You connect your code repositories and cloud accounts in read only mode. We hand back a list: here are your eleven assistants, here is what each one can reach, and here are the four nobody told you about. Nothing in your systems has changed. No risk, no downtime.
Week oneHalf a day
Pick the one that worries you most, usually the one touching money or health data. You register it: what it is for, which model, what it can reach. It is scored for risk automatically, with the score explained rather than asserted.
Then you set its rules on a screen, not in a configuration file. Before anything is published you can replay the last few weeks of real activity and see exactly what would have been stopped. That is the step that removes the fear of breaking something live.
Week oneAn hour of engineering
Your engineer installs the checkpoint inside your own network. It runs on your infrastructure, not ours. Sensitive content never leaves your building unless you switch that on yourself.
It starts in watch mode: it sees everything and stops nothing. For a week or two it simply reports what it would have stopped, and you tune the rules until that list looks right.
Week two or threeOne setting
One change, and the checkpoint starts actually stopping things. You have already watched exactly what that will do for a fortnight, so the moment is deliberately undramatic.
Week three onwardOngoing
Repeat for your other assistants. Then switch on the frameworks you are judged against. Eleven are included, covering a hundred and fifty four requirements, from SOC 2 and ISO 42001 to the EU AI Act, HIPAA, PCI and GDPR.
The product maps what it is already doing to what each framework asks for, shows your coverage, and names the gaps. At audit time you press export and get an evidence pack. You can also give your auditor their own read only login, time limited, so they look for themselves instead of asking you for screenshots. Every page they open is itself recorded.
Before you start
Four things, said plainly, because finding them out in week three is worse than hearing them now.
Afterwards
The first month is the inventory and the relief that comes with it. After that the value is quieter and it compounds. The rules stay enforced as staff come and go. The logbook keeps filling on its own. The coverage numbers stay current instead of being reconstructed in a panic every spring, and the audit that used to take six weeks of gathering screenshots takes an afternoon.
And when a regulator, a customer or your own board asks the question everyone is starting to ask, which is whether you can prove your AI only did what it was allowed to do, you can answer yes and show them.
Get started
The inventory takes an afternoon and changes nothing in your systems. Tell us where to reach you and we will start there.
We send one confirmation and reply personally. No newsletter, no tracking pixels, and your address is never passed to anyone. Or write straight to [email protected].
Got it. Someone will reply personally within one working day, usually sooner.
That did not send. Please write to [email protected] and we will pick it up.
11 frameworks. 154 requirements. Running in production today.