Twenty-one of them, and they are the same twenty-one every time. What does an audit check, what does it cost, when am I charged, who sees my data, and are you actually certified for any of this. Each has a real answer, and each one is on this page rather than behind a form.
SUPPORT · HELP CENTRE · ONE BUSINESS DAY
How can we help with your audit, your report or your data?
Browse the answers below, or reach the right inbox. Most questions about scope, pricing, your report and your data are covered here.
Getting started
Scope & pricing
Your report
Data & confidentiality
Standards
Our promise
“Free to read. And a person answers.”
Every answer here is free to read, and none needs an email first. Write in and a person replies within one business day - someone who can answer it, or knows who can. No bot, no ticket, no queue.
Reach the right inboxBefore you write in
Most of it is already here
Written to be useful, not reassuring. Where the honest answer is no - we hold no certification, an audit is not a guarantee, some data is kept where law requires - the answer is no, said plainly. Those are the ones worth reading first, and the ones a page like this leaves out.
For everything else there are three addresses, and they reach three different readers: general questions, security reports, and concerns about our own independence - which deliberately does not route through the people it might be about. All three reply within one business day.
What this page is
An answer, not a queue.
Everything below is free to read, and a person replies within one business day.
- How an audit is requested, scoped and priced
- What it checks, and against which standards
- What lands at the end, and who may see it
- How your data is handled while we hold it
- Give legal advice, or bind us to anything
- Answer a question about your specific system
- Stand in for the Terms of Use or the Privacy Policy
- Replace a scoping conversation - that is still a conversation
Still need help
Reach the right inbox
connect@idharma.us
Questions about an audit, its scope, pricing, your report or your account. This is the default and it is the right one for almost everything - if you are unsure which of the three you want, it is this one. Nothing here needs a ticket number, and nobody is asked to describe the problem twice.
security@idharma.us
To report a vulnerability, or to ask about our security posture before you send us anything. Reports are read the day they arrive. The honest detail on what we do and do not hold is on Security & Compliance. Send it here rather than the general address, so it reaches the people who can act on it.
conduct@idharma.us
To raise a concern about our independence, a finding, or how we have behaved. It goes to a different reader than the engagement does. An auditor with no route for this is an auditor that nobody can hold to anything at all. It is answered on the same one-business-day promise as everything else on this page.
What most people expect
“A ticket number, and a reply next week.”
What actually happens
A person reads it. You hear back within a day.
There is no queue to be in. There are three addresses and three readers.
- Who it is for
- Prospective clients
- Clients mid-engagement
- Security researchers
- Auditors & partners
- Anyone with a concern
What you can expect
Four things this page promises
02
A person reads it - not a router and not a bot. There is no ticket number, because there is no queue for one to hold a place in.
03
Where the answer is on a page we link the page. Where we do not know yet, the reply says that instead of saying something else.
04
Asking costs nothing. No question on this page starts a meter, and nothing is charged until you approve a scope.
Not sure where to start?
Three questions. Then you’ll know.
No email. No signup. It points at an answer, or the right desk.
Opens in a panel. Close it any time - your answers are kept.
Help centre
Where to look
When people ask
Four moments, and an answer at each.
Not deadlines - the four points at which people actually write in. Every one of them is answered below, before you have to.
-
Deciding
Before you askWhat an audit checks, what it costs, how long it takes. All of it is below, and none of it needs an email first.
-
Scoping
Before you payWe agree the systems, the dimensions and the depth with you. Nothing is charged until you approve that scope.
-
Underway
While it runsWhat we will ask you for, what we will not, and how your data is handled while we have it. Answered below.
-
Afterwards
After the reportSharing it, disagreeing with a finding, or re-auditing when the system changes. Also below, also free to read.
Worth knowing
The moment people most often skip is the second. Scope is agreed before anything is charged, which means the conversation that decides what the audit costs is itself free - and a scope agreed in a hurry is the single most common reason an engagement runs long.
Knowledge base
The question, and the answer
12 answers, paired. The short form is on the left - read the right-hand column only where it is not enough. Nine more are in the FAQ below.
- How do I request an audit? Start from Request an AI Audit
- Tell us the system and what you need to prove. We scope it with you before anything is charged, and you approve that scope first.
- Do I need an account first? No
- You can request an audit without one. We set you up as the engagement begins, so the account follows the work rather than gating it.
- What do I need to provide? The system, or the documentation for it
- Model details, data lineage, logs and any prior assessments. We say exactly what is needed when we scope, and never ask for more than the work requires.
- What does an audit check? Five dimensions, each scored
- Governance, data, fairness, security and compliance - each scored Low, Medium or High against a published standard. The method is on the Verification Methodology page.
- What standards do you measure against? NIST AI RMF, ISO 42001, EU AI Act, SOC 2, HIPAA, DPDP
- Each mapped to the five dimensions, so a finding names the clause it answers rather than a general area of concern. The full mapping is in the methodology.
- How is scope decided? With you, and before you commit
- We agree the systems, the dimensions and the depth up front. The scope is what the fee is fixed against, which is why it is agreed before it exists.
- How long does it take? Typically 1-4 weeks
- From approved scope, depending on system complexity and the access we are given. Slower access is the single biggest cause of a longer engagement.
- When am I charged? $0 until you approve the scope
- Fixed-scope tiers, quoted before you commit. No surprise invoices and no meter running while we talk. Pricing and tiers are published.
- What do I get at the end? A board-ready report, prioritised
- A rating per dimension, findings with the evidence behind each one, and a remediation roadmap ordered by consequence rather than by ease.
- What if I disagree with a finding? Raise it - every finding traces to evidence
- We walk through that evidence with you. We do not inflate findings to sell more work, or soften them to please. An audit informs your decisions; it is not a certification or a guarantee that a system is safe.
- Is my audit data confidential? Yes, and it is never used to train AI
- Access is limited to what the audit needs, handled under confidentiality, and retained no longer than necessary. What you share is used for that audit and never reused to build products.
- Are you SOC 2 or ISO 27001 certified? No - and we do not claim to be
- We audit against those frameworks; we hold no certification in them. When that changes we will show the certificate, not just the claim.
How support runs
Ask, and somebody answers
Three steps, and none of them is a queue.
-
Ask
Search above, or send it to the inbox that fits. No ticket number, no queue position.
-
A person reads it
Not a bot and not a router. Someone who can answer it, or who knows who can.
-
You get an answer
Within one business day - including the answer that we do not know yet, when that is the answer.
Struck in your favour
What you can expect every time
One business day
Every channel, every question. If it will take longer than that, the first reply says so.
A person, not a router
No ticket number and no queue position. Someone who can answer it reads what you sent.
Answers, not deflection
If the answer is on a page, we link the page. If we do not know yet, we say that instead.
Free to ask
Nothing on this page costs anything, and no question here starts a meter running.
Four marks, on every channel.
Browse the basics
Popular topics
Seven topics, one knowledge base. Start where your question is - the count on each card is what it actually holds.
Getting started
Requesting an audit, whether you need an account first, and exactly what you have to hand over - which is the system or the documentation for it, and nothing beyond what the work requires.
Every answer in this topic is below, and none of it needs an email first. If what you are looking for is not here, the general inbox is the right one and it replies within a business day.
What an audit checks
The five dimensions, the standards each is measured against, and whether an audit is a point-in-time assessment or an ongoing arrangement.
Scope, timeline & pricing
How scope is agreed, how long it takes from approved scope, and the one that matters most: nothing is charged until you approve it.
Your report & findings
What lands at the end, whether you can share it, and what happens when you disagree with something the report says.
Data & confidentiality
How audit data is handled and retained, whether it trains anything, and the technical detail of how it is protected in transit and at rest.
Standards & independence
What we audit against, what we are certified for - which is nothing - and the published route for a complaint about our independence or our conduct.
Account & security
Resetting a password, turning on two-factor authentication, and closing an account - including what is retained afterwards and why.
Reply & cost
One business day, and free.
- Reply
- Within one business day, every channel
- Read by
- A person who can answer it
- Escalation
- Security and conduct reach separate readers not the engagement team
Asking costs nothing, and no question here starts a meter. The first thing that has a price is a scope, and you approve that before it does.
Email connect@idharma.us
Help centre · Every channel
1 business day
- connect@idharma.us - general & audits
- security@idharma.us - vulnerabilities
- conduct@idharma.us - independence
- Read by a person, not a router
Where we stand
Four things we will not do
Every answer on this page rests on these. If one of them stopped being true, the rest would stop being worth reading.
Your data,
unreused
What you share for an audit is used for that audit and nothing else. It is never reused to build or train products, and it is retained no longer than the work requires.
Our certificates,
unclaimed
We audit against SOC 2, ISO 27001 and HIPAA. We hold no certification in any of them and will not imply otherwise - when that changes, the certificate goes up, not the claim.
Your findings,
unsoftened
We do not inflate a finding to sell more work, or soften one to keep a client comfortable. Every one of them traces back to evidence you can ask to see for yourself.
Our conduct,
answerable
A published address for a complaint about our independence, reaching a different reader than your engagement does. An auditor without one is unaccountable.
Four cards, and every one of them is checkable.
FAQ
Plain answers
The five most-asked, in full. Twelve more are in the knowledge base above.
Ask us insteadWhat does an AI audit cost, and when am I charged?
Fixed-scope tiers, quoted before you commit - and $0 until you approve the scope. No surprise invoices, and no meter running while we talk about it.
How long does an audit take?
Typically one to four weeks from approved scope, depending on system complexity and the access we are given. Slower access is the biggest single cause of a longer engagement.
Is my audit data confidential, and do you train on it?
Yes, and no. Access is limited to what the audit needs and retained no longer than necessary. What you share is used for that audit and is never reused to build or train products.
Can I share the audit report?
Yes - it is yours. It stays confidential to you, and we do not publish it or name you as a client without your written consent.
Are you SOC 2, ISO 27001 or HIPAA certified?
No - and we do not claim to be. We audit against those frameworks; we hold no certification in them. When that changes we will show the certificate, not just the claim.
Get started
Prefer to just get started?
Tell us the system and the question you need answered, and we scope it with you before anything is charged.
What we need from you
Nothing you do not already have, and nothing binding. This is a conversation about what an audit would cover, and it costs nothing whether or not it becomes one.
- Which system, and what it decides
- What you need to be able to prove, and to whom
- Whether anyone has assessed it before
- Any documentation that already exists
- Your target date, if you have one
What happens next
- You send those five, or as many as you have.
- We return a scope within one business day.
- Nothing is charged until you approve it.
What this page is
General help, not a contract
What the answers here are worth, and what they are not - stated, not assumed.
Where it comes from
- Terms of Use - the binding version
- Privacy Policy - retention and rights
- Reply within
- One business day
- Answers checked
- 9 September 2026
What it is worth
- General help and information about iDharma’s services - it is not a contract, and the answers here are general guidance rather than legal advice.
- Where the honest answer is no - we hold no certification, an audit is not a guarantee - the answer here says no rather than something more comfortable.
What it is not
- For binding terms, see the Terms of Use and the Privacy Policy. Where those and this page differ, those govern.
- Nothing here answers a question about your specific system. That is a scoping conversation, and it is also free.
- iDharma LLC, Greenwood, Indiana.
An answer here out of date, or missing?
Tell usFrom Insights
Read next
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
Read the notes
METHODOLOGY NOTES
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
STANDARDS EXPLAINED
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
METHODOLOGY NOTES
How Much Does an AI Audit Cost? What Actually Drives the Number
Fixed prices, published turnarounds, and an honest account of the four things that decide which tier a system belongs in — including when the answer is "none of them yet".
