Building a trust line from our promises to our practice

Every firm that works with AI or sensitive data makes promises about trust. Few can show you, line by line, how those promises connect to what they actually do.

At Phase2, our promise is reflected with our three Trust Pillars:

  1. Compliant Architecture
  2. Governed Data
  3. Responsible AI Design

However, a promise only means something if you can trace it to what you actually do. For a long time, that trace was the hard part for us. So we built a governance, risk, and compliance (GRC) platform to make it visible. We call it Trustline.

What is a GRC platform? A GRC platform is software that connects an organization's controls, policies, risks, and compliance obligations in one place, so teams can show which requirements are met, how, and where the gaps are.

Why spreadsheets fail for compliance tracking

As Phase2 grew, so did what we answered to. We started with HIPAA, have since included state data privacy laws, other regulatory frameworks like SOC 2, and are now working on ISO 42001, an international standard for an AI management system. On top of that, we carry the security and privacy requirements our clients write into their contracts, and no two clients write them the same way. Keeping all of that connected in spreadsheets became a job of its own. Every new client requirement meant hunting for the control that covered it, or discovering that none did.

Why I built it instead of buying it

We looked at off-the-shelf GRC platforms. Enterprise tools carry enterprise price tags, and they are built around regulatory frameworks. Tracking client-specific requirements, the part we needed most, was the part they handled worst. We also wanted the flexibility to shape the tool around how we work with our clients.

We also had the expertise in-house. Helping clients with data privacy, information security, and AI governance is what we do. So I designed and built Trustline in the same way we approach client work: experts oversee the direction and the right tools do the heavy lifting, including using AI.

How Trustline connects promises to controls

The name Trustline is a play on words, and it describes the design. I wanted a demonstrable line of trust that runs from what we promise to what we do:

  1. Our Trust Pillars are the commitments we make publicly
  2. Each pillar maps to the internal controls that substantiate it
  3. Those controls map to the frameworks we comply with and the requirements our clients ask of us
  4. The controls are backed by our policies and procedures.
    ‍
Diagram of Phase2’s Trustline. Three Trust Pillars at the top (Compliant Architecture, Governed Data, Responsible AI Design) are substantiated by a shared layer of internal controls. Below, regulatory frameworks such as HIPAA and state privacy laws, client requirements (each treated as its own framework), and policies and procedures all connect up to those same controls.

Follow any pillar down and you can see exactly how we deliver on it. Follow any client requirement up and you can see which promise it supports. Nothing sits in a gap between what we say and what we do.

How we map client security requirements to controls

What sets Trustline apart is how we treat a client's security and privacy requirements. We treat them as a framework of their own, mapped to the same controls, policies, and procedures we already map to regulatory frameworks.

When a new client brings requirements, we add them to Trustline and map each one to our existing controls. 

Trustline screenshot: a grievance resolution requirement traced to one control, three policies, and five procedures.

Most of the time, the coverage is already there. When it isn't, we close the gap the same way every time:

  1. If a control doesn't exist, we add it to our control set.
  2. If a policy or procedure is missing, we write it.
  3. Once approved, we roll it out with the project teams.

What building a GRC platform taught us

Building Trustline taught us how to run a GRC program well: how to structure controls so they can be tested, how to schedule meaningful tests, and how to capture risks and see them through to mitigation.

All of it serves two goals: staying aligned with the frameworks we answer to, and keeping the commitments we make to our clients. Those lessons now shape how we advise the organizations we work with, because we have done this work ourselves.

Complex problems are what we do

Trustline came from a hard problem: keeping a growing set of frameworks, client requirements, and our own commitments connected and demonstrable, in a way no off-the-shelf tool handled. We solved it by putting our experts and AI governance to work on it, with AI as a force multiplier. And this is the same approach we take with our clients on their hard problems..

If you are facing a challenge at the intersection of data, compliance, and AI, and it feels too tangled for a standard answer, that is where we do our best work. Reach out to us. Bring us the hardest version of the problem.

‍