Question 1

Is OptimaTrust a GRC platform?

Accepted Answer

No. OptimaTrust is a continuous AI assurance and security platform. It discovers, tests, monitors, and evidences AI systems. Enterprise GRC — Quality, HSE, cyber control libraries, audit calendars — is a different job. OptimaGRC is the GRC product in the same family. The two integrate; they are not the same software.

Question 2

What does a buyer get that a policy portal does not?

Accepted Answer

A production register of 21 AI asset types including agents, MCP, and RAG; security and red-team labs against the HTTP API you ship; a trust graph and AI BOM; an eleven-dimension score that will not fake a pass; and SaaS or on-premise deployment. Policy text without tests is not assurance.

Question 3

What are the editions?

Accepted Answer

Two packages: SaaS and On-Premise. Prices are scoped in a working session — they are not listed as a public catalog. Open /pricing for what each edition includes.

Question 4

What AI systems can you assure?

Accepted Answer

Applications, agents, models and versions, APIs, platforms, RAG systems, workflows, infrastructure, vendors, datasets, vector databases, gateways, tools, MCP servers, services, pipelines, prompt templates, embedding models, memory, and knowledge bases.

Question 5

Do unavailable tests count as a pass?

Accepted Answer

Never. If a scanner or connector is not installed or not applicable, OptimaTrust stores that reason. Empty dimensions stay NOT_ASSESSED. Marketing websites are not model APIs and are marked not applicable for red-team engines.

Question 6

Which frameworks do you overlay?

Accepted Answer

ISO/IEC 42001, ISO/IEC 23894, NIST AI RMF and GenAI overlay, EU AI Act, OWASP LLM, OWASP Agentic, MITRE ATLAS, a SOC 2 AI overlay, sector packs, and custom requirements. Overlays use OptimaTrust language. They are not a certified audit and not a GRC control library.

Question 7

Can we run OptimaTrust on-premises?

Accepted Answer

Yes. Deployment modes include SaaS, private cloud, on-prem, and hybrid. A customer-side collector can send estate signals from environments you host.

Question 8

Does OptimaTrust block agents in production?

Accepted Answer

The Agent Governor decide API records ALLOW or DENY against policy-to-code rules. Declared boundaries are stored. Silent intercept of every third-party agent runtime is not claimed. Use the decide API in your path if you need a recorded decision.

Question 9

How does this relate to OptimaGRC?

Accepted Answer

When both products are in use, OptimaTrust is integrated with OptimaGRC so AI risk and model evidence inform GRC — without turning OptimaTrust into a GRC module. OptimaTrust can also integrate with other platforms you already run. The OptimaGRC Trust module (ESG / questionnaires) is a different capability.

Operator writing for AI assurance buyers.

AI assurance is not GRC — and why that distinction now matters

The agentic attack surface: tools, MCP, memory, and loops

Why an AI trust score that cannot explain itself is worthless

EU AI Act evidence: what software can and cannot do

Shadow AI: discovery without pretending you already scanned the world

What to ask an AI assurance platform before you buy a GRC clone