Skip to content
Talk to Us
Menu
info@geniusoffice.com
All Offerings

Governance, Risk & Compliance

Clear Ownership, Access, and Controls, with the Records to Show They Hold.

A policy needs a practical place in the systems and processes people use. We work with your business and technical owners to translate agreed requirements into controls, responsibilities, and records that can be reviewed.

Talk to Us

A Situation We Hear Often

Follow One Problem from Start to Finish.

This is how the problem usually shows up, and what changes at each step of the fix. Switch to By Service to see the work behind it.

Choose how to explore this offering

The Rules Exist. Who Owns Them Is Less Clear.

Sooner or later every business is asked how it protects information. Follow the request, what changes, and how the same questions apply to AI.

The Rules Exist. Who Owns Them Is Less Clear.

Someone Asks How You Protect Their Information

A customer, an auditor, or an insurer asks how you protect their information

  • Ownership

    It is unclear who owns the system or the information

  • Access

    Access has built up over the years, one request at a time

  • Evidence

    The evidence is spread across inboxes and folders

These arrangements grew with the business. Writing them down makes them easier to run and to show.

What We Can Work On Here

  • Technology & Data Ownership (applies to this view)
  • Access & Information Policies (applies to this view)
  • Risk & Control Planning
  • Compliance Support & Auditability (applies to this view)
  • AI & Machine Learning Governance

Scope of Work

What We Can Work On Here

Each of these can be a project on its own or part of a larger one. We start with the one your situation calls for.

Case Studies

See This Work in Practice.

Real projects in this area: the business problem, what we built, and what changed.

<5 Sec
To answer a business question in Slack, down from hours
1
Governed data layer across HubSpot, Stripe, and the rest of the stack
200
Metrics defined once and read by every dashboard and answer

Technology & SaaS

How a B2B SaaS Company Unified Its Data Across HubSpot, Stripe, and Everything Else, and Put an AI Analyst in Slack.

At a B2B SaaS company, every team pulled its own numbers from its own tool, and the numbers never matched. We unified HubSpot, Stripe, and the rest into one governed warehouse and added an AI data intelligence layer for Slack and the AI tools their teams already use, so there is one answer and everyone can ask for it.

  • HubSpot
  • Stripe
  • Gong
  • Google BigQuery
  • MetricFlow
  • Apache AirflowApache Airflow
  • Terraform
  • Claude
  • Slack
Read the Case Study
~10%
Need manual review, down from all submissions
<1 Min
Per typical single page, down from hours or days
20×
More documents processed per day

Logistics & Supply Chain

How a Freight Business Stopped Reviewing Every Document by Hand.

A freight settlement business moved from manual paperwork to automated extraction, evidence checks, and structured results. The supplied estimates put manual review at roughly 10% of submissions, with typical single-page processing under a minute.

  • Python
  • AWSAWS
  • Amazon Textract
  • OpenAI APIOpenAI API
  • SST
  • TypeScript
Read the Case Study
View All Case Studies

How We Work

How We Approach the Work

Start with the requirement, the systems and information it applies to, and the person accountable for it. Work with the business owners and relevant advisers to identify what must change and how it will be demonstrated.

  1. Start with the Requirement

    The audit finding, customer review, or law in front of you, read together with your advisers, so the work answers what actually applies.

  2. Name the Owner and the Scope

    Which systems and information the requirement covers, and the person accountable for it.

  3. Put the Control Where the Work Happens

    Access rules, approvals, and records are built into the systems people already use, so following the rule is the normal way of working.

  4. Make It Easy to Demonstrate

    Evidence is gathered as part of daily work and reviewed on a schedule, so the next audit starts from a report, not a search through emails.

Measuring It

What Useful Progress Looks Like

  • An owner can explain who has access, and why.
  • Every control has a stated reason.
  • An exception follows a known path.
  • The evidence is kept where it can be found.
  • Reviews and follow-up actions each have an owner.

These questions help define the improvement with your team and the measures appropriate to the engagement.

For Technical Leaders

Technical Considerations

Technologies We Work With

These are the platforms and tools we use most for this work, and we are not limited to them.

Where Do Your Systems Run?
Identity & Access
  • Okta
  • Auth0
  • Keycloak
  • AWS IAM
PII Detection & Data Protection
  • Microsoft Presidio
  • Amazon Macie
  • BigQuery Policy Tags
Compliance Automation
  • Thoropass
  • Vanta
  • Drata
Consent & Privacy Management
  • OneTrust
  • Osano
AI & Model Governance
  • MLflow
  • Amazon Bedrock Guardrails
  • Amazon SageMaker Model Monitor
Cloud Security Posture
  • Wiz
  • AWS Security Hub
Code & Dependency Security
  • SonarQube
  • Snyk
  • Dependabot
  • Trivy
  • GitGuardian
  • Terraform
Secrets Management
  • HashiCorp Vault
  • AWS Secrets Manager
Activity Records & Monitoring
  • AWS CloudTrail
  • Datadog
  • GrafanaManaged Grafana
  • PrometheusManaged Prometheus

If your business runs on a different stack, we adapt to it and build on what you already have.

How It Connects

Governance establishes the rules, owners, and evidence requirements. Workflows put approvals into daily work. Security operations maintains and monitors the relevant protections. Compliance support follows the applicable requirements agreed for the engagement.

When a Smaller Change Is Enough

An existing control or clearer ownership may resolve the issue. Buying another tool does not itself establish governance or meet a compliance requirement.

A Useful Starting Point

Common Questions

Does this certify our business as compliant?

No. We put the agreed technical controls and evidence in place. Certification and assurance depend on the applicable requirements, the wider business, and the relevant assessment process.

Which standards or regulations can you work to?

We work from the requirements that apply to you, agreed with you and your advisers or auditors. That may be a customer’s security review, a privacy law, or an industry standard. We turn them into controls in your systems and evidence you can show. We do not replace legal advice or the assessor.

We are a small team. Is governance more than we need?

It should be sized to the risk. Often the answer is clearer ownership and a few controls where they matter most, such as who can reach sensitive records and how that access is removed when someone leaves. Buying another tool does not establish governance on its own.

Can this include data and AI governance?

Yes. Data ownership, quality standards, access, permitted AI actions, evaluation, and review responsibilities can be included in the agreed scope.

Who owns the policies, controls, and evidence?

You do, always. The policies, the controls built into your systems, and the evidence they produce belong to your business, and they stay with you if the engagement ends.

Tell Us Which Requirements Need Clearer Ownership or Support.

Share the problem, its business impact, and any systems or constraints involved. We can work from the business context, the technical detail, or both.

Talk to Us