Security & trust

How we scope testing and handle evidence:

Understand the access, testing boundaries, and evidence handling for your assessment.

Assessment boundaries
Target Permitted actions Access Evidence handling
Data handling

Agree on the scope and access before testing:

For model red teaming and agent red teaming work, we agree on the target, permitted actions, access, and evidence handling before testing.

Findings are delivered to your team, with reproduction steps and remediation ownership, under the engagement terms.

Getting started with Fisher

We may ask for tool descriptions, safety rules, and representative tasks. Production access, source code, and live customer data are not required to start.

Fisher deployment options →

Compliance

Map findings to the frameworks your team uses:

Relevant findings can be mapped to agreed standards, frameworks, and regulatory requirements. Mapping supports internal review; it is not certification, legal advice, or a determination of compliance.

  • OWASP Top 10 for LLM Apps
  • OWASP Top 10 for Agentic Apps
  • NIST AI RMF
  • MITRE ATLAS
  • EU AI Act
  • ISO/IEC 42001
  • GDPR
  • HIPAA
  • GINA
  • FCC / CPNI
Our own trust surface

An assurance vendor should be easy to assess:

Our public legal and policy documents:

SOC 2 — In progress

Mace Ai is working toward SOC 2.

Trust Center →

Responsible testing

Disclosure:

All testing is authorized and scoped in the engagement record. Findings are delivered to the authorized customer team under the agreed engagement terms and are not published against you. Our model benchmarks measure capability and guardrail behavior on the same harness, with the full run recorded.

Discuss your security requirements before testing:

Tell us what you need assessed and what access or evidence-handling requirements your team must meet.

Contact Us →