FAQ — Plumbline AI

Question 1

What frameworks does Plumbline map to?

Accepted Answer

Plumbline ships a pre-built evidence package for NIST AI RMF (Map / Measure / Manage), the EU AI Act (logging, post-market monitoring, technical documentation), HIPAA (PHI-aware retention + access scopes), SOC 2, and SOX §404 (ITGC audit-trail retention + change-management attestations). Vertical packages for FinServ and healthcare sit on the same substrate — the same record satisfies the regulator-shaped question, regardless of which framework the buyer is mapping to.

Question 2

Do you sign every record?

Accepted Answer

Yes. Every evaluation record is hashed with SHA-256 and chained to its predecessor, with a signature anchored to a key that is not on the production write path. Tampering is detected at fetch time, not at audit time — when an auditor opens a record, the chain walks them back to the input, and any break in the chain is surfaceable in the same view rather than discovered by a forensics exercise the week of the exam.

Question 3

How is retention tuned?

Accepted Answer

Retention is set at write time, scoped to the regulatory window the buyer needs — 7 years for SOX, 6 years for HIPAA-adjacent operational data, NIST AI RMF defaults sized to the risk profile of the model. The retention policy is itself a record, so the auditor sees the policy and the record it captures under the same hash chain.

Question 4

Is there a BAA?

Accepted Answer

A Business Associate Agreement is available on the enterprise tier. PHIs are flagged at write time, scoped by access role, and excluded from the default retention window unless the buyer explicitly opts in to long-form retention under a signed BAA.

Question 5

How long is a typical pilot?

Accepted Answer

A pilot runs sixty days against one model and one or two evaluators. We co-write the scope in week one — data surface, access scopes, retention window, examiner-read-only role, and the control rows your evidence package will satisfy. The replays are real-data, sixty days deep, before any contract is drawn up — so the audit walk-through is, by definition, a replay of evidence you have already collected.

Question 6

What does the first 30-minute demo walkthrough cover?

Accepted Answer

You bring one model and one auditor-shaped question. We open the same record the auditor would open, walk the chain back to the input, and surface the drift and incident timeline on the way. No slides. The replay is the deliverable.

Question 7

Where is data hosted?

Accepted Answer

The production ledger runs in your region of choice — primary deployment is on Postgres in the buyer-named cloud account, with optional on-prem install for the enterprise tier. The signing key is anchored to your KMS, not the Plumbline write path, so the chain holds even if the substrate is replaced.

Question 8

How is this different from a hyperscaler governance platform?

Accepted Answer

A hyperscaler governance platform is sized to thousands of models and a full vendor evaluation. Plumbline is sized to regulated mid-market teams running one to ten production models with a real auditor in the room. The replay is the deliverable; the contract is the deliverable; the lawyer-shaped escrow-style review cycle is not.

The questions evaluation teams ask first.

Want a 30-minute walkthrough with us?