Question 1

Is OptimaTrust a GRC platform?

Accepted Answer

No. OptimaTrust is a continuous AI assurance and security platform. It discovers, tests, monitors, and evidences AI systems. Enterprise GRC — Quality, HSE, cyber control libraries, audit calendars — is a different job. OptimaGRC is the GRC product in the same family. The two integrate; they are not the same software.

Question 2

What does a buyer get that a policy portal does not?

Accepted Answer

A production register of 21 AI asset types including agents, MCP, and RAG; security and red-team labs against the HTTP API you ship; a trust graph and AI BOM; an eleven-dimension score that will not fake a pass; and SaaS or on-premise deployment. Policy text without tests is not assurance.

Question 3

What are the editions?

Accepted Answer

Two packages: SaaS and On-Premise. Prices are scoped in a working session — they are not listed as a public catalog. Open /pricing for what each edition includes.

Question 4

What AI systems can you assure?

Accepted Answer

Applications, agents, models and versions, APIs, platforms, RAG systems, workflows, infrastructure, vendors, datasets, vector databases, gateways, tools, MCP servers, services, pipelines, prompt templates, embedding models, memory, and knowledge bases.

Question 5

Do unavailable tests count as a pass?

Accepted Answer

Never. If a scanner or connector is not installed or not applicable, OptimaTrust stores that reason. Empty dimensions stay NOT_ASSESSED. Marketing websites are not model APIs and are marked not applicable for red-team engines.

Question 6

Which frameworks do you overlay?

Accepted Answer

ISO/IEC 42001, ISO/IEC 23894, NIST AI RMF and GenAI overlay, EU AI Act, OWASP LLM, OWASP Agentic, MITRE ATLAS, a SOC 2 AI overlay, sector packs, and custom requirements. Overlays use OptimaTrust language. They are not a certified audit and not a GRC control library.

Question 7

Can we run OptimaTrust on-premises?

Accepted Answer

Yes. Deployment modes include SaaS, private cloud, on-prem, and hybrid. A customer-side collector can send estate signals from environments you host.

Question 8

Does OptimaTrust block agents in production?

Accepted Answer

The Agent Governor decide API records ALLOW or DENY against policy-to-code rules. Declared boundaries are stored. Silent intercept of every third-party agent runtime is not claimed. Use the decide API in your path if you need a recorded decision.

Question 9

How does this relate to OptimaGRC?

Accepted Answer

When both products are in use, OptimaTrust is integrated with OptimaGRC so AI risk and model evidence inform GRC — without turning OptimaTrust into a GRC module. OptimaTrust can also integrate with other platforms you already run. The OptimaGRC Trust module (ESG / questionnaires) is a different capability.

Runtime enforcement