T

Trustible

Trustible's homepage shows a live governance feed in which a vendor's data processing agreement is parsed and mapped to seven ISO 42001 controls, a model provider's API is analyzed and twelve risk signals surfaced, and an assistant answers questions about the AI inventory. The methodology page adds that policy controls are satisfied by checking, with AI assistance, that a customer's policy text addresses a control's guiding questions.

The rest is not model work: experts curate the risk and regulatory layer, applied through what the vendor calls a rules based engine, and they build the framework mappings by hand. Without the models, the inventory, control library, mappings, routing and evidence trail remain.

Framework readiness percentages, the count of controls a parsed agreement maps to and the risk signals surfaced from a vendor review all appear without a method, test set or error rate. Nothing states how often the AI policy analysis reaches the right conclusion on a control, what happens when it does not, or whether a person checks before the control is marked met. Compliance claims trace to logged governance activity, which grounds the record rather than the model's judgment. The outputs are control mappings and risk scores rather than legal assertions citing authority.

Agentic workflows are said to do the heavy lifting while human experts keep the customer in control, and the governance agent automates tasks with context and rules while preserving human judgment where it matters. Structured intake routes each use case by risk, low risk AI moves through in minutes, and the dashboard shows 72 percent of use cases approved automatically with an average review time of 1.8 days. The review surfaces are named: a task queue with review types and statuses, routing to the right stakeholders, and an activity feed showing what was triaged, analyzed and reassessed, with timestamps.

Nothing defines low risk, no criterion for the automatic approval path is published, and nothing says what happens when a use case approved automatically should not have been.

Three customer stories carry attributed quotations: at Leidos, a VP of AI Strategy and Governance says the platform turbocharged use case throughput across a program spanning forty countries; at Nuix, the General Counsel says AI governance became an operational reality that is evidence based; and at Ashoka, a Vice President for Global Integrity describes a small team doing the work of a much larger one. The wider roster names Guardian Life, Boston Scientific and Databricks, among others.

The figures, ten times faster intake, four times more use cases approved, sixty percent shorter cycle times and documentation time cut from twelve hours to two, carry no method and no customer. A third party account of a Leidos proof of concept describes intake compressed from weeks to hours or minutes.

The customer agreement is not published, so there is no confidentiality clause, no statement of who at the vendor may access customer content and no segregation position to read before signing. The privacy policy's AI commitments, no training on and no retention of personal information, cover personal data, not the governance material a customer loads, such as contracts and policies. Nothing covers isolation between customers or what the model host may retain.

Designations of High Risk, Provider, Deployer and GPAI decide which EU AI Act obligations attach to a customer's system, gap analysis by article shows where a program falls short of named articles, and the assistant will say which use cases qualify as high risk AI systems under the Act. These are legal conclusions in substance. Nothing published says they are not legal advice, that counsel remains responsible for the classification, or what jurisdictional limits apply.

The only disclaimer is a boilerplate one in the website terms of service, which govern the site rather than the platform.

In the SOC 2 announcement, the chief executive says governance is the product, so the company holds itself to the standard it asks customers to meet, and it is constituted as a Public Benefit Corporation. That holds for security, where the SOC 2 Type II is renewed and its audit areas named. For its own AI, nobody is named as accountable for the governance agent's behavior, no evaluation before release is described or reported, and no bias or reliability disclosure exists for the policy analysis that decides whether a control is met.

The company claims no ISO 42001 certification of its own while selling ISO 42001 readiness to others. It publishes model ratings for outside generative systems on a separate site, which is a product capability rather than governance of itself.

The SOC 2 Type II certification includes data and privacy controls among its audit areas. The privacy policy lists four subprocessors, states US hosting, and commits to deleting personal information, or removing what identifies it, when no longer needed, describing the criteria that set the period. Uploaded personal information is not kept by the AI tools. No incident or breach notification practice is published, no access control or personnel restriction is described, and the security section promises reasonable efforts while expressly disclaiming any guarantee. The trust center is said to carry a controls breakdown and a hosting FAQ.

Nothing published states who bears the loss when the product is wrong. The terms of service of 3 October 2025 govern the website and state that the services are provided under separate agreements negotiated individually with each customer. No indemnity, liability cap, warranty, service level commitment, exclusive remedy or insurance statement is published anywhere. The platform produces the regulatory classifications and evidence packages an organization would rely on before a regulator, and nothing published says what the vendor stands behind if one is wrong.

An integration surface is described, and no integrations are named. The platform takes in outside material: the governance feed shows an outside data processing agreement parsed and a model provider's API analyzed, and the implementation plan commits to connecting the customer's systems in the first thirty days. No named connector, direction of data flow, integration list, API or SDK documentation or partner directory is published. A third party assessment describes the platform as working on metadata rather than in the data path.

One region is stated and the deployment model is not. The privacy policy says the services are hosted in the United States and intended for visitors there, that use from Europe or elsewhere means transferring personal information to the United States, and that European transfers rely on Standard Contractual Clauses approved by the European Commission or the United Kingdom. Amazon Web Services and Microsoft Azure appear among the subprocessors, with Azure hosting the AI tools.

No region selection, hosting option outside the US, tenancy model, dedicated or self hosted arrangement is described, and processing location is not addressed beyond the transfer mechanism.

Trustible's announcement of 18 August 2026 calls its SOC 2 Type II the third in a row, explains that Type II tests whether controls operated effectively over a period, and names the five areas examined, among them infrastructure, product, and data and privacy controls. A trust center launched alongside it is said to carry a compliance overview, a breakdown of controls, a subprocessor list and a hosting FAQ. No auditor, report period, date or scope statement is given, and the report is available on request to customers and prospects doing due diligence.

A host is named and the models are not. According to the privacy policy, the AI tools are hosted through Microsoft Azure, which also appears among the subprocessors, with hosting in the United States. No model or model family is named, no commitment is given to notify customers of a change, and nothing says which parts of the platform send customer content to the tools on Azure. Anthropic and OpenAI appear on the homepage only as vendors being governed in a demonstration, a Claude API vendor review and an OpenAI data processing agreement being parsed, so they are not part of Trustible's own stack.

No pricing information is published at any level, including the unit of charge. There is no pricing page, and every path in the site navigation ends at a demo request. No tier, unit, range, minimum or term is stated, and the customer agreement that would carry the commercial terms is not published. The only adjacent fact is the shape of implementation: a thirty, sixty and ninety day plan with a named advisor and hands on enablement, with no price attached.

Fifteen frameworks are published individually with jurisdiction and type, separating binding regulation, certifiable standards and voluntary frameworks, among them the EU AI Act, Colorado's AI Act and South Korea's AI Basic Act. Designations decide which controls apply to each system. Four industries have their own pages, among them financial services and healthcare, and the customer roster adds defense and nonprofit.

The trust center metadata describes the platform as built for enterprise AI and legal teams. No jurisdiction, sector or organization size is named as out of scope, and no coverage depth is given for frameworks beyond the three the site treats in detail.