Assay · AI governance for state and local government

Know every AI use. Show your work.

Your staff are already using AI, some of it on tools nobody approved. Assay helps you find it, decide what’s allowed, and show your council and residents how each decision was made.

Request a walkthrough See it work

Four AI tools already in use that nobody had registered.

The questions every agency is being asked

Sooner or later someone asks: a council member, an auditor, a reporter, a resident. Most agencies piece the answer together from a spreadsheet, old emails and whoever remembers. With Assay, it’s already written down.

What AI do you use?
Every tool and every use in one place, including the ones nobody mentioned.
How risky is each use?
A risk level for each, with the plain reasons behind it.
Who signed off?
Every approval, by name and date, in a record nobody can quietly change.

See it work

For IT and security

Find the AI nobody told you about. Then decide.

People pick up AI tools faster than anyone can review them. Assay spots them in your Microsoft sign-ins and web proxy logs, so you know what's in use and how many people use it. Then you decide: approve it, limit what data it can touch, or block it. A block goes straight onto the list your firewall already checks.

Works with Microsoft Entra ID, Defender for Cloud Apps and your web proxy
Block and allow lists your firewall or proxy can pull
Assay only reads from your Microsoft tenant. It never changes anything there.

Talk to us about this →

For privacy, legal and risk

A risk level, and the reasons behind it.

Departments answer a short set of plain questions about what the AI does and what data it touches. Assay works out the risk as they answer and shows exactly why, so reviewers talk about reasons instead of a number nobody can explain.

Your questions and thresholds, with every version kept
Rules you set, like “anything with personal data is at least Moderate”
Each question tied to the NIST AI Risk Management Framework

Talk to us about this →

For procurement

Ask vendors how their AI works. No accounts needed.

Vendors get a link to a short questionnaire. There's no portal to learn and no password to forget. They answer in their own words and attach their documents, and nothing lands on their record until your staff have read it and accepted it.

Each link works for one request only
Their contracts and test results filed with the vendor

Talk to us about this →

For the AI program lead

The riskier the use, the more eyes on it.

You decide who reviews what: privacy, security, legal, records, equity. Each reviewer answers their own question, and the final decision comes last, with every sign-off kept on the record.

Whoever proposes a use can't approve it
Every approval comes with a date to look at it again

Talk to us about this →

For communications and your council

Tell residents where AI is used, in words they can follow.

Publish each approved use in plain language: what it does, why you use it, and what protects the people it affects. Your staff add the Spanish, and anything not yet translated is clearly marked.

The whole register as open data, for anyone to reuse
Accessibility checks (WCAG 2.1 AA) on every release

Talk to us about this →

For auditors and records

When the auditor asks, the answer is already there.

Every sign-in, change and approval is recorded in order, and each entry is sealed to the one before it, so nobody can quietly edit history. One click checks the whole record.

Export everything for your records team, with a checksum for every file
Your security team's tools can check the record too

Talk to us about this →

How it runs

Built to fit how public agencies already work: your accounts, your records rules, and your choice of where it lives.

How Assay connects to your systems →

The accounts your staff already have: Staff sign in through Microsoft, Okta, Google or any standard single sign-on. When someone joins, moves or leaves, Assay follows your directory.
No AI inside: Assay doesn't send your data to any AI service. It keeps track of how your agency uses AI; it doesn't use AI on your records.
Hosted, or on your own cloud: We run a separate Assay for your agency in US regions, or your IT team runs it in your own AWS or Azure Government account.
Fits what you already run: Your security team gets an event feed, your firewall gets block lists, and your records team gets exports.

See it with your own questions

Tell us a little about your agency and we’ll show you Assay on our demo county, with time for the questions your council, auditors or residents are asking you.

A walkthrough covers

The whole path, from a tool nobody registered to an entry residents can read
How risk levels and sign-offs would fit your own policy
What it takes to run, whether we host it or your IT team does