AI governance for Software & SaaS

Answer your customers’ AI questions
fast, with evidence.

Record how your team uses AI in coding, support and documentation. Then answer each customer question from a reviewed answer bank, cite the record behind it, and send a response your team has checked.

AI your staff use

Coding, support and documentation tools your team works with.

AI in your product

Features that send customer data to a model.

Product AI Bundle · three kits · $799

One customer question, answered with evidence.

Here’s a question from the AI Questionnaire Response Kit’s answer bank, with the reviewed answer and the evidence it cites.

See the AI Questionnaire Response Kit

Import brings in action records (follow-ups, owners, dates) or past questions and answers. Past answers arrive as unreviewed drafts; reuse one through the response register, where the usual review applies.

Sample answer, with its evidenceCedar Cloud Software · fictional company · R-01 for Brightline Retail (fictional)

Customer question

Is customer data used to train AI models?

Starting text from the answer bank

Our AI tools do not train on customer data. Where a vendor offers it, we disable it.

What was checked

Tool: SupportDraft, the AI assistant the support team uses to draft replies to customer tickets
Account tier: Business plan, company-managed workspace
Data scope: Support ticket text and customer contact details typed into draft replies. No production databases or code repositories are connected.
Setting checked: Admin console › Data controls › “Use workspace content to improve models”: Off

Evidence

E-03 Vendor AI assessment records

SupportDraft, Business plan, company workspace. Checked October 6, 2026 in Admin console › Data controls. “Use workspace content to improve models” is Off. Screenshot saved with this record. Personal accounts are not covered by this check.

Scoped answer, as reviewed

SupportDraft is the AI assistant our support team uses to draft replies to customer tickets. On our company Business plan, the setting that lets the vendor use our workspace content to improve its models is off. We checked it on October 6, 2026. This answer covers SupportDraft in our company workspace.

Unresolved

Two contractors have not confirmed which personal assistants they use, so any tools they use are not covered by this answer.
Redaction of logs pasted into support tickets is still being verified. It is tracked as a separate action, and this answer makes no claim about it.

Reviewed by

Engineering manager · October 7, 2026

The starting text is the kit’s answer bank row, with one choice filled in, and E-03 is the evidence the kit suggests for it. The check, the excerpt and the scoped answer are a fictional example: adapt every answer to your own facts and review it before sending.

One product feature, recorded with evidence.

Here’s F-01 from the AI Feature Record Kit’s fictional register: what Smart Reply does with ticket data, checked against the provider settings, and the disclosure it feeds.

See the AI Feature Record Kit

A question from a customer

“Does Smart Reply send our ticket data to a third party, and is it used for training?”

Recorded as

F-01 · Smart ReplyPublished

Provider: Northwind Models API, business tier
Training on customer content: Off, checked Oct 6, 2026 (E-01)
Data in: Ticket subject, ticket body and requester name from the support desk. Attachments are not sent.
Retention: Provider 30 days, Cedar 90 days
Oversight: The agent edits or discards every suggestion before it is sent. Nothing is sent automatically.
Open item: Logs pasted into tickets may contain personal data; the redaction check is open (A-02).

Reported as

Cedar Cloud SoftwareLast reviewed Oct 9, 2026AI in our productCustomer disclosure · Smart Reply and the other published featuresLimits and open itemsFeatureOpen itemSmart ReplyLogs pasted into tickets may contain personal data; the redaction check is open (A-02).

From a customer question to a verified record to the disclosure.Fictional Cedar Cloud Software records. Reports need your review before sharing.Open the sample disclosure · Download it (PDF) · Open the sample report

When the evidence isn’t enough, the answer waits.

R-01 above is backed by its evidence. Here are two more records from the same fictional response register: one held because its evidence does not yet cover everyone, and R-01’s reviewed answer reused for a second customer with its evidence and limits kept.

Held for review

R-02 · Kestrel Logistics (fictional)

Customer question: Which AI tools and systems do you use?
Draft answer: Our inventory lists three AI tools that employees use: CodeDraft for test ideas, SupportDraft for support replies and DocsDraft for documentation outlines. We update it monthly.
Evidence: E-02 AI system inventory
Why it is held: Two contractors have not confirmed their personal assistants or repository connections, so the inventory does not yet cover everyone who works on our code.
Next action: The engineering manager collects both confirmations by October 22, 2026. The answer is reviewed again before it is sent.
Reviewer: Engineering manager

Reused, evidence and limits kept

R-03 · Kestrel Logistics (fictional) · from R-01

Customer question: Do you use the data we send you to train or improve AI models?
Adapted answer: Our support team drafts replies to your tickets with SupportDraft. In our company workspace on the Business plan, the setting that lets the vendor use workspace content to improve its models is off, checked October 6, 2026. This answer covers our support team’s use of SupportDraft.
What changed: Reworded for this customer’s question. The evidence, the checked date and both open limitations are carried over unchanged.
Evidence kept: E-03 Vendor AI assessment records checked October 6, 2026
Limits kept: Two contractors have not confirmed which personal assistants they use, so any tools they use are not covered by this answer.
Redaction of logs pasted into support tickets is still being verified. It is tracked as a separate action, and this answer makes no claim about it.
Reviewer and re-check: Engineering manager · re-check the setting by January 6, 2027

Fictional Cedar Cloud Software records and fictional customers. Technical scope only; your own answers need your own evidence and review.

Make AI use easier to manage.

Is the buyer asking about staff tools or AI embedded in your product?
Which repositories, ticket fields and customer data may be processed?
Who verifies a technical claim before it reaches procurement?

Use the kits to record the answers and keep the next steps clear.

Free field guide · A buyer asks whether your company uses AI

Start with a free tool: Shadow AI Check · Policy Starter · Readiness check · Questionnaire Starter · Feature Record Starter · Help me choose

AI governance dashboard with fictional Cedar Cloud Software records — **Cedar Cloud Software · Fictional worked example**Tool inventory, decisions, owners and open actions.Enlarge dashboard

One approval, fully supported.

Here’s one record from Cedar Cloud Software’s fictional Toolkit: the use is disclosed, the evidence is attached, the decision states its reason, and the follow-up has an owner and a date. The leadership report is built from the same record.

See the full sample report

Fictional example. Review your own report before sharing.

01 Disclosure
Product lead disclosed DocsDraft
Date
Oct 8, 2026
Purpose
Draft documentation from public product information
Information
Published release notes and synthetic examples
02 Evidence
Vendor assessment attached
Vendor assessment
Attached
Information boundary
Published release notes and synthetic examples
03 Decision with a reason
Approved with conditions by the engineering manager
Reason
Vendor assessment attached and inputs limited to published release notes and synthetic examples.
Condition
Product owner checks actual behavior and avoids unsupported security or AI claims.
04 Follow-up
Two contractors have not confirmed personal assistants or repository connections
Owner
Engineering manager
Due
Oct 22, 2026

Example of a gap the kit flags

CodeDraft · Approved with conditions

No vendor assessment or reason recorded

Next action: attach the vendor assessment, or record why the use is approved without one, before relying on this approval. Owner: Engineering manager.

Also open: A suggested dependency still needs provenance and license review. Owner: Engineering manager, due Oct 22, 2026.

Choose the kit for your task.

Each kit includes a guided dashboard, editable materials and a worked example.

What does the AI in our product actually do with customer data?

Keep one verified record per AI feature and publish a disclosure your team has reviewed.

AI Feature Record Kit · Software edition

$399 USDOne-time purchaseView kit

Which AI tools are people using?

Gather staff disclosures and build a tool inventory, then assign follow-up actions for unknown uses.

Shadow AI Risk Kit · Software edition

$199 USDOne-time purchaseView kit

What rules should our team follow?

Adapt the policy, record approval and give staff a clear briefing and acknowledgment process.

AI Policy & Rollout Kit · Software edition

$249 USDOne-time purchaseView kit

Who decides what is allowed?

Record uses, owners, decisions and open actions in one dashboard. Export a leadership report for review.

AI Governance Toolkit · Software edition

$299 USDOne-time purchaseView kit

How do we answer customer AI questions?

Prepare answers with evidence references and reviewer decisions, keeping unresolved claims visible.

AI Questionnaire Response Kit · Software edition

$399 USDOne-time purchase

See what your client receives (sample PDF)

View kit

Customers asking about the AI in your product, and about your staff AI tools? Product AI Bundle · $799 · Save $198

Need discovery, a policy and customer answers together? AI Readiness Bundle · $649 · Save $198

Need discovery, a policy and a record of AI decisions together? AI Foundation Bundle · $599 · Save $148

Need all four, including customer answers? AI Management Bundle · $849 · Save $297

What you’re buying

Downloadable tools for desktop browsers. A blank workspace for your own records, editable materials and a completed example. One company. One-time purchase.

Staff AI use is recorded in the Shadow AI, Policy and Toolkit kits. Customer-facing AI features are recorded in the AI Feature Record Kit. The AI Questionnaire Response Kit answers customer questions from both. The AI Questionnaire Response Kit covers the AI questions in a customer review. Answer the other security questions from your existing security answers.

Preparing for ISO 42001 or Microsoft SSPA?

Answer your customers’ AI questions fast, with evidence.