Which regimes you are actually in
Mapped from what your systems do rather than from what your industry usually needs. Most companies are in fewer than they fear and one they had not noticed.
Compliance Readiness
The deal does not die on the product
It dies in the security review, four months after the demo went well. We work out which regimes your systems actually fall under, find the gaps, and get the answers written down before a buyer asks for them.
- Certified AI systems auditor
- Preparation not certification, and we say which you need
- Weeks instead of months in review
Built for you if
- Your buyers are enterprises, and their reviews keep stalling your deals
- A questionnaire arrives and nobody internally owns the answer
- You have shipped an AI feature and the AI questions have started
- You are told to get certified and nobody has said which scope
Not for you if
- Anyone needing a certificate issued. We are not a certifying body and cannot audit you as one
- Companies wanting the answers written to sound better than the truth
What you get
01
02
03
Three things you walk away with
One answer bank, written once
The questionnaire, the data handling summary, the sub-processor list and the AI governance answers, consistent across every salesperson and every deal.
A public trust page
The part of it that can be public, published, so a third of the review is answered before anybody sends it and the reviewers you never meet can read it.
What the work covers
- Regime and scope mapping across security, privacy and AI
- Gap assessment against the standard questionnaires
- AI governance review: models, data flows, sub-processors and sign-off
- A maintained answer bank for sales to work from
- Trust page content and structure
- Certification scoping, when a certificate is genuinely required
The content and the creative work are produced in house, by the people who built the strategy. Nothing is briefed out.
How it works
Three steps, then we are inside your team
-
01
Map
What your systems do, what data moves through them, who else sees it, and which regimes that puts you inside. This is usually the first time it has been written down.
-
02
Close and write
Fix what is cheap to fix, decide what to disclose, and write the answers once so two salespeople cannot send a buyer two different ones.
-
03
Publish and hold the line
What can be public goes public. The rest sits ready. Reviews stop being the stage where deals quietly disappear.
What happens on the first call
Twenty minutes. Tell us what your product does with data and whether there is AI anywhere in it, and we will tell you which questions are coming and whether you need a certificate at all. No deck, no pitch.
What the Growth Audit coversCan Sarpea certify us?
No. Sarpea prepares you for certification and cannot issue a certificate or audit you as a certifying body. Preparation is the work that happens first: establishing scope, finding gaps and writing the evidence down, which is what makes the formal process short instead of expensive.
We are not an AI company. Why are we getting AI questions?
Because a support assistant, a summarisation feature or an enrichment step is enough to trigger them. Reviewers now ask which models you use, whether their data trains them and who signed the system off, regardless of how you describe yourself.
Is this a marketing service or a compliance service?
It is a go-to-market service. The review is a stage in your funnel that decides revenue, and it is handled badly because internally it belongs to nobody. We treat it as part of how you sell, not as paperwork.
Do we have to publish any of this?
No, but the companies that do move fastest. A reviewer who can find your answers without a sales call does not have to wait for one, and the people deciding your deal are mostly people you never meet.
Related reading
See All
More on compliance readiness
You built a brilliant solution. Let’s take it global.
A quick 20-minute strategy call. No pitch, just a straight conversation about your growth.