Frequently asked questions
12 questions people actually ask before they buy — answered plainly, each one linking to the page where you can verify it rather than take our word for it.
The questions
What does it cost?
Practitioner is $500 a month, Firm is $1,500, and Enterprise is quoted. Annual is ten months’ worth. Everything the registry publishes — scores, sources, the method, the corrections log — stays free to read.
Can I see it before talking to anyone?
Yes, and without an account: score a document, run a policy decision, verify the evidence chain, and watch a document change. Four steps on the live system, about five minutes.
What exactly is this?
A registry that reads what AI vendors publish about governing their systems and scores it against a published method, plus a policy router that applies your own policy before a model is called and writes a tamper-evident record of each decision.
Do vendors pay you?
No, and they never will — not for a score, a preview, a delay or a briefing. There is no code path that would take the money, and any relationship with an assessed party withdraws the independence claim automatically. A vendor gets a free right of reply and nothing else.
Why should I trust a score?
Because you do not have to. The method is published so anyone can re-derive a score, every claim carries the source it came from and the date it was read, and the corrections log records every review — including the ones that changed nothing.
What does a score actually measure?
The documentation located about a system at a stated URL on a stated date. Not the system, not the vendor, and not anyone’s compliance. A low score means what was published does not answer the questions — not that the system is unsafe.
Which frameworks do you cover?
101 controls across 12 instruments, including the EU AI Act (with Article 27), ISO/IEC 42001 and 42005, NYC Local Law 144, NIST AI RMF and SR 26-2. Each control is cited to its source, and a law not yet in force is marked as such rather than sold as urgency.
Does the router carry live traffic today?
No. It works end to end and you can try it now, but no organisation has put production traffic through it yet. Every recorded request is simulated or refused. A first deployment is work we would do together, not a switch to flip.
Can I see which vendor scored what?
Not on the public pages yet. Named findings are withheld until media liability cover is bound — a liability decision, not a gap in the findings. What is public is the method, the aggregate figures and the record of which documents are watched.
Who is behind it, and is it a real company?
Rtavan AI LLC, a North Carolina limited liability company, SOSID 3388209. It is founder-led: no sales team and no ticket queue, so a reply comes from the person who built it.
What about our security review?
Ask and you get a list, not a dodge. Today: no SOC 2 report, no independent penetration test, and a single server rather than a multi-region deployment. Sign-in is two-factor, secrets are encrypted, the audit log is hash-chained and backups are tested daily.
How do I pay, and what happens then?
Card or invoice through Stripe. Access is granted by hand in the console against the payment record, usually the same day, and an entitlement cannot be granted without a note saying how it was settled. Cancel any time; access runs to the end of the period you paid for.
Not answered here?
There is no sales team and no ticket queue. A message reaches the founder, and gets a reply from a person.