An auditor sells trust, the one product a buyer cannot inspect before buying it. Every incentive in the arrangement points the wrong way: a bigger finding sells a bigger engagement, a softer one keeps the client, and a page of warm adjectives about our own integrity costs nothing to write.
TRUST & SAFETY · HOW WE OPERATE
Trust built into every audit - not stickered on after.
Independence makes a report defensible. Confidentiality makes it safe to show us your systems. Honesty makes the findings mean anything.
Independent
Confidential
Evidence-based
Accountable
Report a concern
Our promise
“Nothing we conclude changes what we are paid.”
Scope and fee are agreed in writing up front, so a clean result and a damning one cost the same. We build, resell and operate no AI of our own. A genuine conflict we decline, not caveat.
Report a concernWhy this page exists
Trust, in three chapters
So this page states things somebody could catch us breaking. We build nothing we audit. No fee is tied to a finding. There is an address for a complaint about us that does not route back to the people it is about. Each one is checkable, which is the only quality a commitment ever needs.
And it names six things we will not do, each of which we could profitably do. Manufacturing risk. Softening it. Selling your data. Writing a report that is true and misleading. Claiming a credential. Auditing the work we were paid to fix. Naming them is the point of the list, and the hard part.
The commitments
Four things every audit stands on.
None of them optional, and each one designed in rather than layered over.
- Independent - no stake in the outcome, structurally
- Confidential - your systems, data and findings
- Evidence-based - every finding traces to something
- Accountable - a published standard, and a route to complain
- Auditing anything we built, or were paid to fix
- Reusing your data to train or build anything
- Inflating a finding to sell, or softening one to keep
- Claiming a credential or accreditation we do not hold
Speak up
Report a concern
Write to conduct@idharma.us
If something about an audit, a finding, or how we have behaved does not sit right - a question of independence, accuracy or integrity - this is the address. You do not need to be a client to use it, and you do not need to be certain before you write - a question is enough, and early is better.
Write to security@idharma.us
For a vulnerability in our site, our systems or a report. Tell us privately and give us reasonable time to fix it before any public disclosure; the responsible-disclosure commitment further down this page says what we undertake in return: we acknowledge good-faith reports promptly.
Neither goes to the engagement team
A complaint about an audit that lands on the people who ran it is not a complaint channel. Both addresses reach a different reader, both are monitored, and both can be raised in confidence. That separation is the only thing that makes either of them worth publishing, and why both are printed here.
What a complaints page usually is
“Tell us, and we’ll look into ourselves.”
What makes one real
It reaches somebody other than the people it is about.
Both addresses are monitored, and both can be raised in confidence.
- Who it is for
- Clients
- Prospective clients
- Security researchers
- Regulators & auditors
- Anyone with a concern
Independence
What we find never changes what we’re paid
02
We do not sell or resell the AI we assess, so no finding is inconvenient to a roadmap we happen to own.
03
We are paid to assess a system against a published standard - not to reach a particular conclusion about it.
04
Where a relationship could colour the work, we disclose it. Where it amounts to a conflict, we decline rather than caveat it.
Something not sitting right?
Three questions. Then you’ll know where to send it.
No email, no signup. It routes a concern - it does not judge one.
Opens in a panel. Close it any time - your answers are kept.
Trust & Safety
Your scope check
When it is tested
Four moments, and each one costs us something.
A promise that costs nothing to keep is not a promise. These are the four points where keeping ours is expensive - which is what makes them worth printing.
-
Decline
At the enquiryA genuine conflict ends the conversation rather than earning a caveat. The cost of that is the engagement.
-
Scope honestly
At the quoteNothing is charged until you approve a scope, and the scope is what the work needs rather than what it could bear.
-
Say it plainly
At the findingNot inflated to sell a larger tier, not softened to keep a logo. The cost of that is sometimes the renewal.
-
Stay quiet
After deliveryYour findings are not a case study. We do not publish them or name you without your written consent.
The hard one
The third. Telling a client that a system they have already announced is not ready is the moment every incentive points the other way - and it is the moment the other three commitments are worth nothing without. A finding we would not have written for free is not a finding.
Commitment & check
What we promise, and what would catch us
12 rows. The left column is a commitment; the right is what a stranger could use to check it - and the last four are limits rather than promises.
- We build nothing we audit No product line a finding could embarrass
- We build, resell and operate no AI systems of our own. There is no roadmap that a bad finding would inconvenience.
- No fee tied to a finding The price is set before the answer is known
- Scope and fee are agreed and approved before the work starts, so nothing we conclude changes what we are paid.
- We decline conflicts Rather than disclose and proceed
- A genuine conflict ends the engagement. A relationship short of one is disclosed to you in writing before you commit.
- A published methodology Not a house rubric nobody can see
- The standard every audit is measured against is published, so a finding can be checked against it rather than trusted.
- Findings trace to evidence Each one, individually
- Every finding carries what it rests on. Ask to see it and you will, including for the ones you disagree with.
- Nothing inflated, nothing softened Both directions cost us something
- A gap we cannot evidence is reported as a gap rather than assumed away, and a clean result is reported clean.
- Access limited to the work We ask for what the audit needs
- Handled under confidentiality, retained no longer than necessary, and never more than the engagement requires.
- Your data trains nothing Not our products, not anyone's model
- What you share for an audit is used for that audit. Every subprocessor is disclosed on Security & Compliance.
- The report is yours And it stays confidential to you
- We do not publish it, use it as a case study, or name you as a client without your written consent.
- Not a certification And we issue none
- An audit informs your decisions. It is not a certificate, and nobody is in a position to certify AI in that sense.
- Not a guarantee A system can pass and still fail later
- A point-in-time assessment of the system as scoped. A materially changed system is a different system.
- No credential we do not hold We audit against frameworks we are not certified in
- We hold no SOC 2, ISO 27001 or HIPAA certification and will not imply one. When that changes, the certificate goes up.
How it holds
Where a commitment actually bites
Three points in an engagement, and what happens at each.
-
Before we accept
We check for a conflict and decline rather than caveat one. A relationship that could colour the work is disclosed.
-
While we hold your data
Access limited to what the audit needs, retained no longer than necessary, never reused to train or build.
-
When we write it up
Every finding traces to evidence. Nothing inflated to sell more, nothing softened to keep a client.
The commitments
Four things every audit stands on
Independent
A reviewer with no stake in the outcome is what makes a report defensible to a board.
Confidential
Your systems, data and findings are handled in confidence and never reused to build anything.
Evidence-based & honest
Every finding traces to evidence. Nothing inflated to sell more, nothing softened to please.
Accountable
A published methodology, and a plain statement of what an audit is - and what it is not.
Four marks, struck on every report.
Ruled out
What a trust brand has to refuse
The bar for an auditor is integrity, not just legality. These six are off the table.
Conflicts of interest
We do not audit systems we built, and we disclose any relationship that could colour the work. Where a genuine conflict exists we decline the engagement rather than caveat it - a disclosure at the front of a report does not make the reviewer independent, it only records that they were not.
Manipulative design
No dark patterns, no hidden costs, and no hard-to-find route to a human. A trust page on a site that traps you is not worth the words.
Fabricated or inflated findings
Manufacturing risk to sell a bigger tier, or softening it to win a logo. Both are the same failure pointing in different directions.
Selling or reusing your data
Your systems and your results are never a product we resell or train on. What you share for an audit is used for that audit alone.
Technically true but misleading
A report that reads clean while burying what matters. If the headline and the detail disagree, it is the headline that is wrong.
Hollow trust signals
No fake badges, no invented credentials, and no accreditation we do not hold. The certificate goes up before the claim does.
Auditing what we are paid to fix
Grading our own homework, or anybody else's we have a stake in. That is not a conflict to disclose - it is one to decline.
Accountability
Held to it, in writing.
- Measured against
- A published methodology, not a house rubric
- Complaints
- Reach a reader outside your engagement
- This page
- Versioned and dated - v1.0 effective 17 August 2026
Nothing on this page is a product. It is the standard we ask to be held to - dated, versioned, and with an address for saying we failed it.
Email conduct@idharma.us
Trust & Safety · v1.0
4 commitments
- Independent - no stake in the outcome
- Confidential - and never reused
- Evidence-based - and honest both ways
- Accountable - published, and complainable
How it shows up
What the commitments mean in practice
Four of the six refusals, in the form a reader meets them: as a thing that does not happen to their report, their data, or their engagement.
Findings,
uninflated
We do not manufacture risk to sell a bigger tier, and we do not soften a finding to win a logo. Both directions are the same failure, and both cost us money to avoid.
Your data,
unsold
Your systems and your results are never a product we resell, publish or train on. What we learn in your audit stays in your audit and is deleted when the work is done.
Reports,
unmisleading
A report that is technically true while burying what matters is a report we will not write. If the headline reads clean and the detail does not, the headline is wrong.
Homework,
ungraded
We do not audit what we were paid to fix, or what anybody we have a stake in built. Grading your own work is not a conflict you disclose - it is one you decline outright.
Four cards, and every one of them costs us something.
FAQ
Plain answers
Independence, confidentiality, your report, and how to complain about us.
Request your scanWhat actually makes you independent?
Three structural facts rather than a claim of temperament: we build and sell no AI of our own, no part of our fee is tied to what we find, and there is a published address for a complaint about our independence.
Who sees our systems and data?
Only what the audit needs, handled under confidentiality and retained no longer than necessary. It is never reused to train or build products, and every subprocessor is disclosed.
Do we own the report?
Yes. It is yours and stays confidential to you. We do not publish your results, name you as a client, or share findings without your written consent.
What if we disagree with a finding?
Raise it. Every finding traces to evidence and we will walk through that evidence with you. A disagreement that survives it is recorded in the report as a disagreement.
How do I complain about you?
conduct@idharma.us, and it reaches a different reader than your engagement does. You do not need to be a client to use it, or to be certain before you write.
Responsible disclosure
Security researchers are welcome
Tell us privately, give us reasonable time, and we will work with you. Here is what each side undertakes.
What we need from you
If you find a vulnerability in our site, our systems or a report, email security@idharma.us and give us reasonable time to fix it before any public disclosure.
- Report it privately, before disclosing publicly
- Do not access or alter other people’s data
- Stay within the scope of testing your own account
- Tell us what you found and how to reproduce it
- You do not need to prove impact before writing
What happens next
- We acknowledge good-faith reports promptly.
- We keep you updated while we work on it.
- In return, we engage in good faith throughout.
What this page is
A standard, not a contract
What these commitments are worth, and what they are not - stated, not assumed.
Where it comes from
- Verification Methodology - the published standard
- Security & Compliance; Privacy Policy; Terms
- Effective
- 17 August 2026 · v1.0
- Last checked
- 9 September 2026
What it is worth
- This page describes the standards iDharma holds itself to and how we work as an independent auditor. It is provided for transparency and is not a contract, warranty, or guarantee.
- Our reports are independent assessments - not certifications, and not guarantees that any system is safe or compliant.
What it is not
- Nothing here is legal advice, and nothing here waives any right or guarantees legal safe harbour to a security researcher.
- A fuller vulnerability-disclosure policy is being published; until it is, the disclosure section of this page governs.
- To raise a conduct concern, email conduct@idharma.us. For a security issue, security@idharma.us.
Think we have fallen short of this?
Tell usFrom Insights
Read next
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
Read the notes
METHODOLOGY NOTES
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
STANDARDS EXPLAINED
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
STANDARDS EXPLAINED
ISO/IEC 42001, SOC 2 and NIST AI RMF: Which One Your Buyer Is Actually Asking For
One certifies an organisation, one is an opinion about controls over a window, one is a method with nothing to issue. What each covers — and what none of them answers.
