Q01
What's free and what's a subscription?
Free, forever, no login: the Glossary and full reference library (/under-the-hood) — about 290 pages distilling thousands of pages of standards, frameworks, methodologies, and terminology; the 12-question Shadow AI Check; the printable governance templates. The Coach, included with the platform or on its own: an agent for the corpus. The same open library, on demand — ask anything by voice or text, get a cited answer in seconds with the next step attached. You're paying for the answer at the moment of need, not for access to the knowledge. The Academy: structured training with a Tutor — a teacher, not an agent. The Tutor walks CISOs, CEOs, board members, and employees through the material on a curriculum; the Coach answers the question you have right now. Different jobs, deliberately. The full audit: the artifact layer — the regulation-anchored AI Acceptable Use Policy, Executive Risk Report, Board Memo, and verification URL. Each product stands alone; none requires the others.
Q02
What is SanctumShield?
SanctumShield is an AI governance platform for mid-market organizations of 50–2,000 employees. It generates the Executive Risk Report, AI Acceptable Use Policy, Board Memo, AI Posture Summary from a guided assessment of your industry, frameworks, AI tools, agents and optional network logs: the time you choose: one sitting at Light, a longer session at Standard, and a full working session at Complete, with the same four documents at every level. Each document carries a Verification URL. The free Shadow AI Check runs without an account; the full platform is a monthly or annual plan, cancellable any time (see sanctumshield.com/pricing).
Q03
What is shadow AI?
Shadow AI is any generative AI tool that an employee uses in their work without the knowledge or approval of IT, security, or procurement. The phenomenon is defined by invisibility, not intent — employees are usually trying to be productive, not malicious. Approximately 80%+ of enterprise AI tools are unmanaged today, and roughly 59% of employees admit to hiding their AI usage from IT.
Q04
How is shadow AI different from shadow IT?
Shadow IT moved files — employees using Dropbox instead of SharePoint, Slack instead of email. Shadow AI moves reasoning, context, and proprietary intelligence to unmonitored external systems. An employee pasting a contract into ChatGPT exports the actual IP of the business, not just a document. The data exposure is structurally larger and the legal consequences are more severe.
Q05
Who founded SanctumShield?
SanctumShield was founded by Lindsay Hiebert, a CISSP-credentialed cybersecurity executive with 15+ years at Cisco Systems and 7+ years at Intel Corporation, where he led the Intel Network Builders program with 550+ partners. Lindsay specializes in Agentic AI security governance, Agentic AI, end-to-end network security, shadow AI discovery, and regulation-anchored security policy. SanctumShield is operated by PIGENAI LLC, a Missouri limited liability company.
Read Lindsay's full bio →Q06
How much does SanctumShield cost?
Two pricing tiers: the Shadow AI Check is free with no account, no email, and no credit card required. The full platform — Executive Risk Report, AI Acceptable Use Policy, AI Tools Registry, network log analysis, and all seven compliance frameworks — is billed monthly or annually and cancellable any time; current prices are at sanctumshield.com/pricing. Business and Scale tiers are in active development.
Q07
Does SanctumShield install software on employee laptops?
No. SanctumShield is browser-based and requires no agent, extension, or endpoint installation. The Shield evidence layer ingests firewall, proxy, or DNS exports that you upload directly. There is nothing to deploy, nothing to maintain, and no impact on user workstations or corporate device images.
Q08
What size company is SanctumShield built for?
SanctumShield is purpose-built for organizations of 50 to 2,000 employees. Smaller organizations can use the free Shadow AI Check. Larger enterprises typically already have dedicated security teams and prefer enterprise procurement-style platforms.
Q09
Can a department inside a larger organization use SanctumShield?
Yes. Many large organizations — 2,000 employees and above — use SanctumShield at the department or line-of-business level. A 500-person clinical operations group inside a 12,000-person hospital system, a 300-person legal team inside a Fortune 500 financial services firm, a 200-person engineering line of business inside a global manufacturing company. Each unit gets its own customized AI Acceptable Use Policy and Executive Risk Report scoped to its industry context, jurisdictions, and tool inventory — on the same plan price. This pattern works because most large organizations manage AI use semi-autonomously across business units. Central security teams cannot reasonably author a single AUP that covers every department's industry-specific obligations — a clinical operations group has HIPAA exposure a corporate engineering team does not; a legal team has privilege concerns marketing does not. Department-scoped artifacts produce more defensible governance than a one-size-fits-all corporate document.
Q10
Does SanctumShield support HIPAA compliance?
Yes. The generated AI Acceptable Use Policy maps to HIPAA §164.502(e) (business associate agreements with sub-processors) and §164.312 (technical safeguards for ePHI). The Executive Risk Report cites the specific clauses governing your AI use, not boilerplate. Healthcare organizations using SanctumShield receive HIPAA-anchored language that legal counsel can review without rewriting.
Q11
Didn't the EU delay the AI Act?
It split it, not simply delayed it. The 2026 Digital Omnibus — adopted by the European Parliament (June 16, 2026) and the Council (June 29, 2026), published in the Official Journal as Regulation (EU) 2026/1744 on July 24, 2026, and in force since July 27, 2026 — moved the heaviest high-risk regime to December 2, 2027 (standalone Annex III systems) and August 2, 2028 (AI embedded in regulated products). What did NOT move: Article 4 AI literacy has been in force since February 2, 2025 (the Omnibus reworded it: it now requires measures that support AI literacy, suited to each person’s role and context, with no fixed level per person); Article 50 transparency still applies August 2, 2026; and new Article 5 prohibitions on AI-generated intimate imagery and CSAM apply December 2, 2026. Grandfathering also rewards shipping compliant systems early, so the runway is for building deliberately — not for waiting.
The two-tier regulatory timeline →Q12
What firewall and proxy log formats does SanctumShield support?
SanctumShield accepts firewall, proxy, and DNS exports from major vendors via paste or CSV upload — including Palo Alto Networks, Fortinet, Cisco, Zscaler, Netskope, and Cloudflare. The Shield evidence layer matches outbound traffic against a registry of 118 AI API endpoints (OpenAI, Anthropic, Google AI, Cohere, Mistral, and dozens more) to produce real hit counts rather than self-reported usage.
Q13
How long does it take to generate an AI Acceptable Use Policy?
The assessment takes the time you choose: one sitting at Light, a longer session at Standard, and a full working session at Complete, with the same four documents at every level. The assessment captures your industry, organization size, jurisdictions, applicable compliance frameworks, AI tools in use, and (optionally) a paste or upload of firewall, proxy, or DNS hostnames. The platform then produces a ~3,500–4,500 word AUP of up to 16 sections plus 3 appendices, sized to your organization, customized to those inputs. The output is downloadable as PDF, Word, HTML, Markdown and plain text for direct review by your legal counsel.
Q14
How does SanctumShield compare to Palo Alto AI Access Security?
Palo Alto AI Access Security is an enterprise AI security platform built for large organizations with dedicated security teams. SanctumShield is built for the mid-market (50–2,000 employees) and is fully self-serve: a review runs at the level you choose (Light, Standard or Complete, with the same four documents at every level) and produces the dated governance record a board, auditor or insurer asks for. The two work together where an organization runs both.
Q15
How does SanctumShield compare to Cisco AI Defense?
Cisco AI Defense is a runtime agent governance product designed to protect AI agents enterprises deploy. SanctumShield is a discovery and policy product designed to surface unmanaged AI use that governance hasn't reached yet. The two are complementary: Cisco AI Defense protects agents you deployed; SanctumShield finds the shadow AI you didn't know existed.
Q16
What is the difference between SanctumShield and a SIG questionnaire?
SIG (Standardized Information Gathering) questionnaires are vendor self-attestations — point-in-time claims a vendor makes about their own controls, with no observation. SanctumShield uses observation over attestation: matching observed network traffic against a 118-domain AI endpoint registry. Evidence rather than promise. See the /beyond-sig page for a full structural comparison.
Q17
Does SanctumShield train AI models on customer data?
No. SanctumShield uses paid API tiers from its underlying AI providers (Google Gemini), which contractually commit to not training models on paid-API inputs. Customer prompts, uploaded logs, and generated reports are not used to train models. The full sub-processor list is published at /trust.
Q18
Where is SanctumShield data hosted?
SanctumShield is hosted on Vercel with Cloudflare DNS and SSL. Inference runs on Google Gemini paid API. Payment processing is handled by Stripe. Transactional email is sent via Resend. The complete sub-processor list, including data residency notes, is published at /trust.
Q19
Can SanctumShield generate evidence for SOC 2 audits?
Yes. The generated AI Acceptable Use Policy maps to SOC 2 Common Criteria CC6.1 (logical access controls) and CC7.2 (system operations and monitoring). The Executive Risk Report provides documented findings, regulatory citations, and a 90-day action plan that auditors accept as evidence of an active AI governance program. Continuous evidence (log analysis re-runs) is supported by re-uploading current exports.
Q20
Is there a free version of SanctumShield?
Yes. The Shadow AI Check is permanently free, with no account, no email, and no credit card required. It is a 12-question self-assessment that produces an instant departmental risk score (0–100) and three headline findings tailored to your answers. You can run it as many times as you want.
Q21
How is SanctumShield different from Vanta?
Vanta is a leading GRC automation platform for SOC 2, ISO 27001, ISO 42001, HIPAA and EU AI Act programs. SanctumShield produces a specific set of AI governance records from observed AI use: a regulation-anchored, board-voice AI Acceptable Use Policy, an Executive Risk Report, a Board Memo and a Verification URL for each, generated in one guided session with no sales call. Organizations can use both: Vanta for the continuous compliance program, SanctumShield for the board and underwriter record. See /vs-vanta.
How SanctumShield works alongside Vanta →Q22
We already use Vanta. Why would we add SanctumShield?
Three reasons. (1) SanctumShield generates an AI Acceptable Use Policy of up to 16 sections plus 3 appendices, sized to your organization, customized to your industry, jurisdictions and the AI tools your people actually use, including local tools such as Ollama and agents built in Microsoft Copilot Studio. (2) SanctumShield's verification URL is portable: your cyber insurance underwriter can check it directly from the link. (3) SanctumShield's policy includes controls for researched AI failure modes such as persuasion bombing (research from Harvard Business School, Working Paper 26-021, Randazzo et al. 2025). Vanta keeps running your compliance program alongside it.
Using SanctumShield and Vanta together →Q23
Will SanctumShield replace our Vanta subscription?
No. They serve different jobs. Vanta is the platform you keep to run your SOC 2/ISO/HIPAA program continuously. SanctumShield is the per-organization or per-department AUP + risk assessment + board artifact. Layer them.
Q24
How can my cyber insurance underwriter or external auditor check that SanctumShield produced a report, and when?
Every paid SanctumShield report — both the AI Acceptable Use Policy and the Executive Risk Report — carries a unique verification URL printed in the document footer (something like sanctumshield.com/verify/abc123xyz). When you submit the report as part of a renewal application or audit packet, your underwriter or auditor pastes that URL into a browser and immediately sees a confirmation page listing the verification ID, document type, organization name, date generated, AI endpoint registry version and a content fingerprint. The report's contents are never exposed — the record shows only that SanctumShield generated a document with that ID for that organization on that date. Records are kept for six years so the same URL works across multiple renewal cycles. Anyone you share the document with can use the same URL to confirm the record.
See an example verification page →Q25
What does SanctumShield keep?
SanctumShield delivers AI governance you can prove, with privacy by design. Your answers and documents stay with you. All we keep is a small verification record, so anyone you share a document with can confirm when it was made and that it matches. The record holds the verification ID, document type, organization name, date generated, AI endpoint registry version and a content fingerprint, and is kept for six years. Full details are on our Trust page.
Trust page