Ask the awkward question. Get a useful answer.

SundAI offers six scoped services: compliance and AI governance, secure business automation, private AI assistants and RAG, authorised security testing, DevSecOps, and cloud security. Training and talks can be booked separately. Start with one process, product or risk you want to address.

Choose automation for repeated operational work, private AI and RAG for approved knowledge retrieval, governance for requirements and ownership, pentesting for defined attack paths, DevSecOps for delivery controls, or cloud security for identities and configuration. We can discuss the fit before preparing a proposal.

No. Fixed rules and documented APIs may be simpler and more predictable. AI is useful when its capability fits the task and its behaviour can be bounded and evaluated. The service choice follows the business process, rather than the other way around.

Yes. The private assistant service starts with a defined AI knowledge assistant pilot: one source, one interface, one cloud and a limited set of roles and users. The evaluation evidence informs whether broader deployment makes sense.

GRC consulting for SMEs can connect a relevant framework to practical ownership, controls and evidence. A scoped compliance readiness assessment helps a small team prioritise its next steps without assuming that every standard or regulation applies.

ISO readiness versus certification is a distinction worth keeping clear. Readiness work reviews an agreed scope and supports preparation. Certification is a separate decision by an appropriate certification body. SundAI does not issue ISO certificates or SOC 2 assurance reports.

We can review agreed policies, responsibilities and compliance control evidence so answers reflect what your organisation can substantiate. Unsupported claims remain gaps to resolve; a questionnaire is not a reason to invent a control, certification or customer result.

No assessment guarantees complete compliance. Applicability, implementation and residual risk depend on the organisation and agreed framework. Legal opinions, full ISMS implementation and formal assurance are separate from the entry readiness sprint.

A private assistant is scoped around your approved source, roles and data-handling terms. Permission-aware RAG applies access before retrieval; AI answers with source citations help users check the basis of an answer. Private does not automatically mean on-premises or EU-only processing.

AI agent tool permissions must be explicitly scoped. Human approval and limited access control sensitive writes and auditable AI agent actions. A model response or an instruction embedded in a document does not authorise a consequential action.

SundAI provides 100% European service delivered by experts from the European Union. This describes service delivery. Data locations, endpoints, suppliers and processing terms depend on the agreed architecture; EU-only processing is not implied by the service statement.

No. Describe the business problem and the systems involved without credentials, restricted records or personal case files. The enquiry starts a scope discussion; authorised access and any necessary secure transfer arrangements are agreed later.

The appropriate asset owner must give written authorisation. Targets, test accounts, third-party restrictions, stop conditions and emergency contacts belong in the pentest rules of engagement before testing begins.

No. Vulnerability scan versus pentest compares different work: scans identify possible issues; manual investigation examines agreed attack paths and interprets the findings. A report from the scoped assessment explains methods, evidence and limitations.

No. Secure CI/CD pipelines combine defined checks, restricted identities and review gates. Scanners have limitations; release owners must maintain the controls and assess exceptions. The proposal defines which controls are delivered.

No. The foundation covers a defined provider, identities, resources and controls. Monthly cloud security maintenance and incident-related work need separate scope. Emergency coverage and response commitments require staffing, an on-call agreement and an SLA.

Tell us about your organisation, team and product or process. We review fit and delivery capacity, then agree scope, deliverables, timing, price, third-party costs and acceptance criteria before work begins. The enquiry itself does not place an order.

No. The form sends a meeting request. A date and time are confirmed separately after availability is checked. Please include your time zone and useful context so the follow-up can focus on the actual question.

The responsible lead and contributors are agreed before an engagement is accepted. Qualifications, relevant experience, availability and review needs are assessed for the scope. Recruitment goals do not mean every specialism is already staffed.

Yes. SundAI invites relevant junior collaborators and senior specialists to share a portfolio and experience. The commission is agreed upfront and never exceeds 12.5% of agreed net service revenue. The agreement defines allocation, responsibilities and payment; application does not guarantee projects or income.