For the AI Stack
Your security review
grew an AI annex.
Whether you ship models, AI products, or the infrastructure they run on, enterprise buyers now attach AI-specific questions to every vendor review — model provenance, training-data rights, LLM sub-processors, prompt retention, ISO 42001 readiness — and generic tools have no answers there. Matterlyt answers the security and AI-governance questionnaires that stand between companies in the AI stack and their enterprise deals.
Already on buyers' questionnaires
Even if you're not "AI"
Enterprise buyers send the AI annex whether or not you're legally “AI.” Sometimes the strongest answer is proving you're out of scope — and that answer has to be just as defensible. Matterlyt's backbone covers it.
The Problem
Due diligence changed. The tooling didn't.
Selling AI into an enterprise now means a security review plus an AI-governance review — and the second one has no answer library, no template, and no owner but you.
The AI annex is already here
Enterprise security teams now staple AI-specific questions to the standard vendor review — model provenance, training-data rights, LLM sub-processors, prompt retention, ISO 42001. It arrives attached to the SIG or CAIQ you were already expecting.
Generic tools go blank exactly there
Questionnaire automation was built for the security core — access control, encryption, incident response. Ask it about model provenance or prompt retention and you get an empty field. Nobody has written the opinionated answers yet.
And "the vendor" means you, personally
At 10–100 people there is no compliance department. The questionnaire lands on the CTO, between sprint reviews, with the deal blocked until it ships back.
What Ships in the Box
The AI Vendor Trust Backbone.
A shipped, versioned library of the ~200 questions enterprises ask AI vendors — the SIG/CAIQ security core plus the AI-governance annexes nobody else answers — each with an editable template answer and an evidence checklist. This is what you get on day one.
Model provenance
Which models power the product, from which providers, under which terms — and what changes when you swap one out.
Training-data rights
What was trained on what, who holds the rights, and the customer-data question every buyer asks first: do you train on ours?
LLM sub-processors
Which AI providers touch customer data, in which regions, under which DPAs — the sub-processor list, extended to inference.
Prompt & output retention
What is stored, for how long, where, and who can see it — for prompts, outputs, and everything logged in between.
Evals & hallucination practices
How you test model behavior before and after release, and what you tell a buyer who asks how wrong answers are caught.
ISO 42001 readiness
Where you stand against the AI-management-system standard buyers are starting to reference — stated honestly, not aspirationally.
Unverified until you confirm it
Every template ships marked unverified — a draft to react to, not a claim to forward. You confirm or edit it; only then does it carry your name. Cited and confidence-flagged throughout.
An evidence checklist per answer
Each question lists the evidence a reviewer asks for next — the policy, the diagram, the DPA clause — so you know what to attach before they ask.
Day one, honestly
Day one is the Backbone plus what Matterlyt ingests from your existing docs, and it compounds from there. Matterlyt builds and flags what goes stale; you keep it true.
We Take Our Own Questionnaire
Matterlyt answers AI-governance due diligence credibly because it lives it.
A vendor that bolted AI on has to hedge on its own annex. Matterlyt is AI-governance-correct by construction — so the answers it hands you are ones its own architecture can pass.
Read our full security postureBring-your-own AI account
Inference runs on your own Anthropic, Bedrock, or Vertex account — Matterlyt is never the AI sub-processor in your stack.
Never trains on your data
Your knowledge is used to answer your questionnaires. It is never used to train a model.
EU-region hosting, or yours
Pin inference to an EU region via Bedrock or Vertex. Self-hosting available where your buyers require it.
A Word on the EU AI Act
Yes, the Act matters. Calmly.
Buyers will ask about it. But for most AI vendors the real question isn't a conformity checklist — it's applicability: does the Act even apply to us, in which role, and how do we defend that answer?
Matterlyt is not an AI-Act compliance service. What it does is narrower and more useful in a deal: it keeps the answers you give buyers consistent with the regulatory posture you've actually taken — so this week's questionnaire matches last quarter's DPA, and both match what your product does.
Build It With Us
The Backbone gets sharper with every company in the AI stack that stress-tests it.
We work with a handful of companies in the AI stack as design partners, by invitation — teams with live enterprise deals and real questionnaires. If the AI annex is in your inbox right now, you're who we want to build with.
See the design-partner program