Elpista already runs an LLM over the evidence you upload. A GRC platform holds a map of each customer's weaknesses — so the AI that reads it has to be the hardest part of the product, not the softest. Here is our AI inventory, the controls in place against the OWASP LLM Top 10 (2025), and an honest roadmap.
Text inside an uploaded document, a connector feed, or a questionnaire response can never change a control's status, a risk rating, or trigger an action — no matter how it's phrased, framed, or hidden. Only Elpista's own prompts and an authenticated user's in-app actions are trusted. The AI suggests; a human signs off.
We can't secure what we haven't mapped, so we hold ourselves to our own AI-inventory discipline. Every call routes through a single AI gateway — no feature talks to the model directly — with PII redaction, residency, budgets and a kill switch applied centrally.
| AI system | Type | Risk | What its output can do |
|---|---|---|---|
| GRC Copilot | Agent (gpt-4o) | High | Answers grounded in your records; proposes actions that require human confirmation + RBAC. |
| Vendor-Document Review | Agent (gpt-4o) | High | First-pass read of uploaded SOC 2 / ISO / pentest docs. Cannot change a status or lower a risk on its own. |
| Policy Generator & Gap Analysis | Agent (gpt-4o) | Medium | Drafts framework-aligned policies. Accepting creates a DRAFT only — AI never publishes. |
| Control-Mapping & Evidence Assistant | Agent (gpt-4o) | Medium | Suggests crosswalks and evidence links — a human confirms before anything is written. |
| Per-tenant retrieval index | Vector store | Medium | Grounds the Copilot. Isolated per tenant at the data layer; proven by a cross-tenant test. |
| Azure OpenAI | Vendor (model provider) | High | gpt-4o + embeddings in a Canadian region. Prompts are not used to train the provider's models. |
These same systems are registered in Elpista's own AI governance module and mapped to NIST AI RMF 1.0 — we run the module on ourselves.
These are live controls in shipped product — not future features. Where something is still partial, we say so.
Document text is fenced as data with a rule never to follow instructions inside it. A deterministic heuristic is the backbone — the model can't change a status or lower a risk. Hidden channels (invisible render mode, white or sub-point fonts, DOCX vanish runs, metadata, image alt-text, zero-width splicing) are scanned, flagged to the reviewer, and audited. Never acted on.
Answers cite the records they rest on; ungrounded output is downgraded to "insufficient evidence". No AI output sets a status, closes a finding or sets a rating — a human ACCEPT/EDIT/REJECT is the record of authority, written to a hash-chained audit trail with the exact model and prompt version. AI-suggested and human-confirmed are distinct in the data and the UI.
Retrieval runs through a tenant-scoped database client that stamps the tenant id onto every query; embeddings are stored per tenant. An automated test proves a second tenant running an identical query gets none of the first tenant's data back. PII is redacted before anything leaves for the model.
The model has a single read-scoped tool. Any state change — risk updates, task creation, policy drafts, reminders — is a proposed suggestion that needs explicit human confirmation plus the action's own permission before it runs, and is audited. No destructive or outbound action without a human in the loop.
Model free-text is neutralized — markdown images removed, links and URLs defanged, HTML stripped — so no external image auto-fetches (a data-exfil channel) and nothing auto-clicks. Every CSV export is hardened against spreadsheet formula injection, and accepted AI policy drafts pass through HTML sanitization.
A per-tenant daily token budget and a short-window request rate limit guard against runaway loops and abuse; both fail safe — they degrade, they don't crash the app. A global kill switch and per-feature toggles stop AI instantly. Provider-side billing alarms on the Azure subscription are an operator runbook step — tracked, not yet asserted as done.
We label against the OWASP Top 10 for LLM Applications 2025 (LLM01–LLM10) — the current edition. Our AI governance maps to NIST AI RMF 1.0 (AI 100-1, Jan 2023); there is no "AI RMF 2.0", and we never label anything as one.
Elpista prepares and maintains an AI governance program — it does not certify one. A control is shown "in place" only when it genuinely is; anything partial is labelled partial.
Roadmap, not yet built: ISO/IEC 42001 certification, an AI red-team evidence pipeline (garak / PyRIT / promptfoo), and automated discovery of shadow AI. Sources: OWASP GenAI — LLM Top 10 · NIST AI RMF
The same move as "we run our own SOC 2 on Elpista" — we register our AI systems in the product's AI governance module and hold them to the controls above.
Elpista's own LLM calls are inventoried in the AI governance module and mapped to NIST AI RMF 1.0 — the exact workflow we sell, run on ourselves.
Injection attempts, human sign-offs and AI usage are all recorded on a tamper-evident, hash-chained audit trail. Claims here trace back to controls in shipped code.
The model runs in a Canadian region, prompts aren't used to train it, and your evidence stays in Canada — the record you'd want behind a regulated program.
Elpista's AI governance module gives you a crosswalked NIST AI RMF 1.0 program and an AI inventory — the same foundation we use on ourselves. See it on your data.
Request a demo →Control descriptions reflect Elpista's shipped product as of the latest release. Elpista does not certify AI governance and is not an accredited assessor. "AI Trust" describes Elpista's own controls; it is not a warranty.