Iden is Trocola's client platform, installed on day one of every engagement. It is the separation made visible: every AI tool in the company named, sorted, owned, and read daily, with the engagement's deliverables, evidence, and attestations kept in the same vault.
Employees open Iden to see what AI they are allowed to use, and what they are not. Consultants run their workspaces inside it and upload their documentation there. Counsel uploads legal work to the same record. HR collects training attestations in the portal, and employees sign in the portal, so the training file is evidence, not memory. Visibility rolls up the chain: employee, department, managers, department heads, each level reading its own scope.
The repository is the heart of Iden. A tool is Approved, Interim, or Denied, never unlisted. Denied tools carry a named approved alternative, so a denial is a direction, not a dead end. New tools enter through a submission that routes to review before use, and a tool found already running enters with an incident review of its prior use.
| Tool class | Status | Owner | Use case on record | Review |
|---|---|---|---|---|
| Meeting transcription | Approved | Named owner on file | Internal meetings, summaries retained as records | Current |
| Code assistant | Approved | Named owner on file | Development work inside approved repositories | Current |
| Customer support drafting | Interim | Named owner on file | Draft replies only, human sends, conditions on the record | Date set |
| Document summarizer, unvetted | Denied | Named owner on file | Does not run. Approved alternative named on the entry | Closed |
Illustrative entries. A client's live repository holds the client's real tools, vendors, and owners, and the same five fields on every line: tool, status, owner, use case, review date.
The Trust Score is the cumulative measure of control maintenance, computed from the Iden record itself: controls in place, attestations on file, reviews current, submissions answered. It is not a one-time grade. A company's quarter can be read at a glance, and the discipline is simple enough to say in one breath.
The framework the record is kept against: 4 pillars, 9 deliverables, 21 controls. Two controls carry published names, the Governance Charter at C1 and Regulatory Drift Monitoring at C20; the rest are stated here by the function each one holds. Depth follows risk tier: a Minimal-tier company runs 8 controls, Limited runs 19, and High and Unacceptable run all 21.
| Control | Pillar | What it holds |
|---|---|---|
| Pillar One · Know Your Stack · C1 to C5 | ||
| C1 | Know Your Stack | Governance Charter. The founding document: what AI is for at the company, what it may never do, and who answers for it. |
| C2 | Know Your Stack | The complete inventory: every AI tool in use, found and counted, including the ones nobody approved. |
| C3 | Know Your Stack | The vendor and model register: what each tool is, who supplies it, and what company data it touches. |
| C4 | Know Your Stack | Data flow mapping: what enters each system, where it goes, and where it rests. |
| C5 | Know Your Stack | Risk tiering: every tool scored and tiered by exposure, so depth of control follows depth of risk. |
| Pillar Two · Legal & Compliance · C6 to C11 | ||
| C6 | Legal & Compliance | Regulatory mapping: the duties that apply to the company, by jurisdiction, kept current. |
| C7 | Legal & Compliance | Vendor contract terms: liability, data use, and retention set in writing before a tool runs. |
| C8 | Legal & Compliance | Privacy and consent handling for data that AI processes, on the record. |
| C9 | Legal & Compliance | Records and privilege discipline: AI interactions treated as records, because courts treat them as records. |
| C10 | Legal & Compliance | Disclosure duties when AI touches customers, patients, or applicants. |
| C11 | Legal & Compliance | Sector rule alignment: the healthcare, finance, and legal duties that govern the company's own industry. |
| Pillar Three · Operational Controls · C12 to C16 | ||
| C12 | Operational Controls | The approval workflow: no tool runs before it is submitted, reviewed, and answered. |
| C13 | Operational Controls | Human in the loop: a named person on consequential decisions, never the tool alone. |
| C14 | Operational Controls | Access control: who may use which tool, at what level, enforced by role. |
| C15 | Operational Controls | Incident response: the path when an AI tool fails, leaks, or is misused, rehearsed before it is needed. |
| C16 | Operational Controls | The employee use policy: written, signed, and enforced, so the standard exists before anyone is held to it. |
| Pillar Four · Continuous Governance · C17 to C21 | ||
| C17 | Continuous Governance | The review cycle: every registered tool re-read on schedule, its status earned again. |
| C18 | Continuous Governance | Training and attestation maintenance: people certified against the current standard, on file. |
| C19 | Continuous Governance | Audit trail review: the record itself read on a schedule, by a named reader. |
| C20 | Continuous Governance | Regulatory Drift Monitoring. Laws and duties move; the framework's mapping moves with them, or the score shows the gap. |
| C21 | Continuous Governance | Score maintenance: the Trust Score recomputed from the record each quarter, with the discipline on this page applied. |
When an auditor, a regulator, or a board asks what a company's AI structure is, the answer is not a binder assembled under pressure. The client sends one secure, encrypted link, and the reader on the other end sees the repository, the deliverables against the controls, the evidence, the attestations, and the score history, read directly from the vault. Entries are anchored as they are written, so the record cannot be quietly rewritten after the fact.
Iden is Trocola's client platform and the vault over a company's AI use. Every AI tool is registered as Approved, Interim, or Denied, each with a named owner, a use case, and a review date. Employees open Iden daily to see what AI they are allowed to use; leadership reads the record, the training file, and the Trust Score in the same place.
A maintained measure of how a company's AI structure is holding, built from the Iden record itself: controls in place, attestations on file, reviews current. It works the way a credit score works for money. One missed quarter of maintenance places a company Under Review; two missed quarters suspend the score.
Through one secure, encrypted link. The client sends the link; the auditor reads the repository, the deliverables, the evidence, and the score history directly, without the client assembling a binder or exporting spreadsheets.
Iden, the records, and the score. Engagements are exit by design: Trocola trains the client's permanent team to run the structure, and the platform and its record stay with the client.
Iden is installed on day one of an engagement. The engagement starts with a conversation.
Begin