Know exactly where your AI tools send patient data — and prove it holds up to HIPAA.

AISS (Ayliea AI Security Standard) is the open methodology behind every assessment on the platform — 10 control domains, 59 sub-controls, 9 framework crosswalks, published under CC-BY-4.0 at github.com/Ayliea/aiss. Most compliance scoring is opaque because opacity is where vendor pricing leverage lives. We took the opposite position: practitioners, auditors, and forks have full access to the methodology. Your auditor can reproduce any score using only the published spec and the answers your team provides.

Vanta, Drata, and Sprinto are compliance-automation platforms — software you operate, with proprietary scoring an auditor can't independently verify. Ayliea is an independent, expert-led assessment: a named assessor maps your AI surface, scores it against HIPAA and NIST using the open AISS standard, signs the report, and stands behind it when an auditor, insurer, or hospital partner asks. A SaaS license can't put its name on that. We're happy to run alongside whatever GRC tool you already use.

Because AI risk is fundamentally a security problem, not a paperwork problem. The questions that decide whether your AI is safe with patient data — where your tools send it, who can access them, what they retain, and whether your vendor agreements actually cover AI — are security and assessment questions. We bring rigorous security assessment expertise and score your AI surface against the HIPAA Security Rule and NIST AI RMF using AISS, an open standard you and your auditor can verify line by line. We don't replace your healthcare counsel or your compliance team — we're the independent, accountable security assessment that makes your AI posture defensible, signed by a named assessor who answers for it.

We map every place AI touches patient data — sanctioned tools, shadow AI, and the AI features embedded in your existing SaaS — and assess them against the HIPAA Security Rule and NIST AI RMF. You walk away with an AI inventory and data-flow map, findings scored by HIPAA control with severities, and a prioritized remediation roadmap. Fixed scope, fixed price, a clear start and end.

A signed assessment report your auditors, cyber-insurers, and hospital partners accept as proof — an executive summary, the AI tool inventory, findings by HIPAA control, a prioritized remediation roadmap, and a dated assessor sign-off. Not a dashboard score: a defensible document a named human stands behind.

It starts with a 30-minute scoping call to map the engagement to your AI surface and the requirements that gate you. From there it's a fixed-scope assessment — the timeline depends on the size of your AI footprint, which we'll estimate on the call. Optional recurring refreshes keep the report current as your tools, vendors, and standards change.

Book a 30-minute scoping call — we'll map an engagement to your AI surface and the requirements that gate you, and tell you exactly what it costs. No obligation. If you'd rather look first, the AISS standard is open on GitHub.

Yes. AISS is CC-BY-4.0 — attribution required, but commercial use, modification, and redistribution are all permitted. You can run the standard against your AI surface using nothing but the published spec, fork it, or use it as the methodology in an audit you're delivering to a client. The standard stays free forever; the engagement is for organizations that want an accountable assessor to do it and sign it.

Yes. We assess what you share for the engagement and nothing more — we don't sell data, we don't train models on it, and we never will. Data is encrypted in transit and at rest. The Trust Center at /trust details our security posture and policies.