An independent 25-point inspection of your AI chatbots, agents, and workflow automations — before you launch them, or before you hand them to a client.
We review the evidence you provide; we do not run tests against your live system.
The sample report describes a fictitious composite client. It shows the real structure and depth of a delivered report.
$299 per audit. For AI agencies preparing a client handoff or a major model or integration change. Prefer to confirm the fit first? Ask for the one-page scope. Please describe the workflow without sending client data, logs or credentials.
What we check
Twenty-five checkpoints, grouped under five questions:
- Can it stop? Declining when unsure, human approval before real-world actions, volume and spend caps, loop detection, a kill switch that someone other than the developer can use.
- Can it undo? Reversible data changes, prompt and configuration history, an incident procedure, a manual fallback, an incident log.
- Can you prove it? An acceptance test set, re-testing before changes, watching for vendor-side model changes, routine output sampling, before-and-after numbers.
- Can it leak? What data reaches the AI vendor, least-privilege access, secrets kept out of prompts and files, the path from outside input to instructions, checks on what goes out.
- Will it last? Cost visibility, a plan if a model is retired or repriced, operation without one key person, written scope with your builder, shutdown criteria.
What you get
- A graded report (A/B/C) covering all 25 checkpoints, each scored with the evidence behind the score
- Up to five priority recommendations, based on the findings: what is risky, why, what to do, and roughly how much effort each takes
- A roadmap split into today, this month, and this quarter
- The 25-Point Audit Kit (kill-switch procedure, incident log, rollback checklist templates), so your team can re-check on its own
- One round of follow-up questions within 7 days of delivery
Reports are delivered as PDF, with editable templates in DOCX. If you need another format, let us know before booking so we can confirm availability.
Findings are mapped to selected NIST AI RMF 1.0 outcomes and relevant OWASP Top 10 risk categories (LLM Applications 2026, Agentic Applications 2026), and the report adds six unscored checks that those standards point to. This is not a certification or a compliance assessment, and NIST and OWASP do not endorse it.
How it works
- Book on Gumroad. You receive an intake form that takes 15 to 20 minutes. "I don't know" is a valid answer.
- We inspect the evidence you provide. If an item is thin on evidence, we ask one round of follow-up questions. An item we still cannot verify is marked "unverified", with the reason. We do not guess.
- You receive the report within 5 business days of your intake answers. If the answers leave out something the audit cannot do without, we tell you within 1 business day and agree on added material or a narrower scope first; the 5 business days then start from that agreement.
We take at most 4 audits a month. Every report gets a human final review.
How we keep the audit independent
- We inspect your automation and do not bid on its implementation or remediation.
- Scoring follows our published 25-point criteria, fixed before we see your system.
- A re-audit records what it finds under the same rules, including what did not improve.
- Each report states who requested it and who paid for it.
- A report is not a certification or a safety guarantee. Summaries and quotes must not hide the scope or the important failed and unverified items.
Price and refunds
$299 per audit. Full refund any time before you submit the intake form, and a full refund if we cannot deliver after you submit it. After delivery, if anything we promised is missing, tell us within 14 days and you choose whether we complete it or refund you. The refund depends on whether we delivered what we promised, not on what the audit found. Full terms are on the booking page.
Scope limits
This is general operational guidance, not legal, tax, or other professional advice. Where a checkpoint concerns contracts or policies, we check that the document exists; we do not assess its legal adequacy.
Who is behind this
MOBIUS LLC builds and operates AI governance systems in Tokyo. The checklist is the discipline we apply to our own production systems. Our research is public on Zenodo (listed on ORCID) and our code is on GitHub, so you can check what we work on before you book.
Questions: info@mobius.style · Company information
Ready for a second look?
Book the evidence review directly, or ask about scope before you buy. You do not need to purchase the kit or a membership first.
Prefer to check it yourself? Start with the free 25-question checklist, or get the one-time Audit Kit ($29) for the scoring workbook and editable templates.