You or your team built it with Lovable, Replit, Cursor, Claude or similar, and people are starting to rely on it. I check who can see your customers' data, whether you own the accounts and could move off the platform, who would notice a mistake and, when there is AI inside, what it does on your real cases. Then I tell you in plain words whether it is ready and what to fix first. Whoever built it, or a developer, makes the fixes, so there is no repair work to sell you afterwards.
Dr Colin Kelly
PhD in NLP (Cambridge)
Former Head of Applied AI Research
Step 1 of the independent AI architect
It is for an owner, MD or founder, often not technical, whose team built a business tool that people are starting to rely on, with or without AI inside.
The filter: it touches customer or client data, or it acts on the business's behalf, such as sending messages, booking, making payments or changing records. If it's a personal tool or a hobby project, the free check below is the right level.
Seven checks run on every review:
Whether the keys that connect it to other services are hidden from visitors.
Whether one customer can see, change or delete another customer's records.
How customer data is deleted when someone asks.
Whether you own the accounts and the data, and could export the data and move off the platform.
How you would switch it off, and what happens when the platform or a provider changes or goes down.
Whether you could trace what happened if a customer complained.
Who in the business answers for it.
Five more run when there is AI inside it:
Whether it gives the right answer on 20 of your real cases, plus 5 harder ones I write.
Whether someone can type, paste or upload text that makes it ignore its instructions.
What it can do on its own, and which actions need a person to confirm.
Which customer data goes to which AI provider.
Whether users know it is AI and can reach a person.
Three others run where they apply, for example when it searches stored documents or lets the public sign up. The checks are mapped to the OWASP Top 10 for LLM Applications and the UK Code of Practice for the Cyber Security of AI, to show which known risks each one looks at. That mapping is not a claim that it meets either.
A report of four to six pages, written so you can show it to a client or an IT team, and a 30-minute readout with you. Whoever built it, and a developer if you have one, are invited.
Some people call this a pre-production audit: a fixed set of checks on it as it runs today. It is not a penetration test or a certification, and it gives no compliance or legal opinion, including on UK GDPR. The review leaves code and settings as they are, and there is no load testing. Nothing in the report guarantees that it is secure or accurate. If you need a penetration test, the report says so.
$6,000 fixed, or $8,000 fixed when there is AI inside, for one tool, agent or app, one week. Larger scopes are priced before work starts. AI inside means the tool sends your data to an AI model, such as ChatGPT or Claude, to answer, decide or act. A tool built with Lovable, Cursor or similar that doesn't call a model when it runs is the $6,000 review. About three days of my time, or four with AI inside, are written into the engagement letter; if I use them up, I stop and report what I didn't reach. Half is paid on signing and half on delivery, whatever the findings. USD, plus VAT where it applies.
Eleven plain questions about a tool, agent or app with AI inside. The full result, with questions for whoever built it, appears on this page with no email needed. It reports what you can show today, and can't tell you it will work.
Where the fixes are a setting, a permission, a prompt, a log or a person checking, the review is the whole job.
If the fixes go deeper, such as redrawing the workflow or who can see what, moving off the platform or changing AI supplier, or there is no written design and you plan to keep building, the report says so. It offers the independent AI architect's design and business case (from $12,000, about two weeks) as the next step. The choice is yours.
Agathon offers an independent AI readiness review of business tools, agents and apps built with AI tools, for non-technical owners and founders. I check the setup and, when there is AI inside, what it does on your real cases, then give a verdict and the order of fixes for whoever built it or a developer.
Agathon's AI readiness review costs $6,000 fixed, or $8,000 fixed when the tool has AI inside, and takes one week for one tool, agent or app. AI inside means the tool sends your data to an AI model, such as ChatGPT or Claude, to answer, decide or act. Larger scopes are priced before work starts. Half is paid on signing and half on delivery, whatever the findings.
Agathon's AI readiness review is neither a penetration test nor a certification. It makes a few attempts to make the tool misbehave, with your written permission, through the inputs a real user could reach. If the tool needs a penetration test, the report says so.
Agathon's AI readiness review needs read-only access to the code (on GitHub or the platform it was built on) and to the settings, a 30 to 45 minute walkthrough, two test accounts and, when there is AI inside, 20 real cases with the answers you would accept. Without the code, the review runs from the outside and marks code-dependent findings, such as whether a developer could take it over, as Unverifiable. Where settings access isn't possible, you can show me them on a screen-share instead, and the report marks those findings as seen rather than checked directly.
Agathon's AI readiness review doesn't fix anything. Whoever built the tool or a developer makes the fixes, in the order the report gives, and is invited to the readout.
Agathon's AI readiness review says so in the report when the app needs redesigning, and the next step is the independent AI architect's design and business case: from $12,000, about two weeks. That applies when the fixes go deeper, such as redrawing the workflow or who can see what, moving off the platform or changing AI supplier.
Agathon's free go/no-go check tests nothing; it reports what you can show today, from your own answers. The AI readiness review tests the items your result marks Not shown yet, on your real cases.