--- title: "Quality" description: "Clearly AI runs each security review against the same template, policies, and criteria, cites its sources, and keeps a record of every change." canonical: https://clearly-ai.com/platform/quality --- _Quality_ # Security reviews you can stand behind, every time Clearly AI runs each review against the same template, policies, and criteria, and cites the sources behind every answer. It tunes with you to match how your team reviews, and keeps a record of how each answer changed and who changed it. - [Contact Enterprise Sales](https://clearly-ai.com/demo) - [Read the docs](https://docs.clearly-ai.com/docs/ai-output-controls) - Ericsson - PayPal - Modern Health - Hagerty - Rivian - Infineon - Bastion ## Would your team sign off on that threat model? Any AI tool can produce a threat model in minutes. Getting one your team will put its name on is harder. Manual reviews vary with whoever runs them, and the reasoning stays with that person. General-purpose AI tools can give a different answer each time you ask. Either way, an auditor can't trace the output and a reviewer can't defend it. **With Clearly AI, you can show how every answer was reached, from first draft to sign-off.** _Consistency_ ## Consistent and accurate, review after review ### One standard, no matter who runs the review Every review applies the same policies, methodology, and bar for what counts as a finding, whoever is assigned. Your best security engineers' judgment shows up in every review, including the ones they never touch. ### Structured output, every run Clearly AI uses AI output controls to keep each review structured and grounded in the context it gathered. Verdicts such as "Is this control present?" or "Is this requirement met?" come from a fixed set of answers rather than free text, so the same project state gets the same verdict. The written explanation may be phrased differently, but the conclusion won't change unless the context does. [Learn how AI output controls work](https://docs.clearly-ai.com/docs/ai-output-controls) ### Accuracy we test before it ships Every change to our standard threat modeling templates is evaluated against in-house baselines before it reaches customers, so improvements don't quietly break results you already rely on. ### Fewer false positives to clear When an existing control already mitigates a threat, Clearly AI marks it as not a finding and explains why. When context is missing, it flags the gap rather than guessing. That leaves your team's time for the judgment calls. _Tuning_ ## Tuned to how your company reviews Clearly AI tunes with you, starting from the policies and templates you already use. - **Policies and standards, built in:** Clearly AI's knowledge base and enterprise context graph bring your security policies, secure design patterns, and past reviews into each analysis - **Bring your own questionnaire:** Upload a custom questionnaire, template, or control spreadsheet, and Clearly AI turns it into a working review template in hours, without a long configuration project. You can also upload existing threat models as review context. - **Controls mapped to frameworks:** Map your internal controls to industry standards, and your requirements to the controls that mitigate them - **You set the compliance bar:** Decide what passes in your environment, and Clearly AI evaluates against that bar - **Feedback that tunes your templates:** Rate any answer with a thumbs up or down. The Clearly AI team reviews that feedback and uses it to tune your review templates, from findings and word choice to output format and diagramming style. Your feedback changes only your templates. If it points to an issue in the product itself, our engineers fix it for all customers. _Audit trail_ ## A complete record of every answer When an auditor or a product team asks why a review says what it says, you can show them. ### Review versions For each question in a review, see how the answer changed over time: when Clearly AI generated or regenerated it, what new context it used, when the compliance status changed, and which person made each edit. #### Answer versions - **Version 3 (Active)** — Jul 17, 2026, 3:02 PM Compliant Compliance: COMPLIANT - **Version 2 (Outdated)** — Jul 17, 2026, 3:02 PM Non-compliant #### Notes - **Changed answer to Compliant** j.rivera@acme.com · Jul 17, 2026, 3:02 PM - **Accepted partial diff changes** j.rivera@acme.com · Jul 17, 2026, 3:02 PM - **Regenerated the answer** Clearly AI · Jul 17, 2026, 2:57 PM - **Regenerated the answer** Clearly AI · Jul 17, 2026, 2:41 PM - **Generated the answer** Clearly AI · Jul 7, 2026, 7:33 AM ### Template versions As your team tunes and edits review templates, Clearly AI saves each change with who made it and when. Compare any two versions side by side and restore an earlier one in a click. Each review is tied to the template version it ran against. - **Version 4 (Current)** — Dana Ortiz · Jun 24, 2026, 8:08 PM - **Version 3** — Dana Ortiz · Jun 24, 2026, 8:08 PM - **Version 2** — Dana Ortiz · Jun 24, 2026, 8:07 PM - **Version 1** — Dana Ortiz · Nov 2, 2025, 7:59 PM #### Changes from version 2 YAML saved in version 3 Restore this version ```diff - - prompt: What is the overall architecture and technology stack of this application? + - prompt: In 2–3 sentences, describe the purpose of this system. - prompt: Include or describe an Architecture Diagram for the system. ``` _Guardrails_ ## Guardrails built into the architecture Clearly AI protects your data and your reviews with two layers of guardrails. ### Content guardrails from your model provider Each model call includes a system prompt and passes through the built-in safety and moderation controls of the model provider, whether that's Anthropic, OpenAI, or another provider you choose. Bring your own key through AWS Bedrock if you need to. [See model providers](https://docs.clearly-ai.com/docs/model-providers) ### Structural guardrails enforced by Clearly AI - **Isolated execution:** Agents run in Firecracker microVMs, isolated from the host and from other workloads. - **Controlled network access:** Agents reach only the integrations you connect. Web access is off by default: a user has to request vendor web search, and an admin has to turn on the link reader. - **Limited blast radius:** An agent can only write to the single review it's scoped to. Chat can only suggest changes, and a person has to approve each destructive edit before it runs. - **Schema-validated output:** Every model call must return structured output. Responses that don't match the expected schema are rejected before they reach your review. Learn more: [Security and privacy](https://docs.clearly-ai.com/docs/security-and-privacy) · [Privacy and data governance](https://docs.clearly-ai.com/docs/privacy-and-data-governance) · [Deployment patterns](https://docs.clearly-ai.com/docs/deployment-patterns) · [Subprocessors](https://clearly-ai.com/trust/subprocessors) _Proven outcomes_ ## Output reliable enough to scale - **~90%** Reduction in time per review - **4x** Review capacity with the same headcount - **From 10 to 100%** Product coverage > “Weeks to minutes, literally.” > > — William Brown, Sr. Director of Product Security and Privacy [Read the HID Global story](https://clearly-ai.com/customer-stories/hid-global) ![Woman tapping a badge at an office entry turnstile.](https://clearly-ai.com/case-study/hid-global-hero.png) _FAQ_ ## Answers to your top questions ### What are AI output controls? AI output controls keep each Clearly AI review structured and grounded in the context it gathered. Verdicts such as "Is this requirement met?" come from a fixed set of answers rather than free text, so the same project state gets the same verdict. The explanation may be worded differently, but the conclusion changes only when the context does. [Read the AI output controls docs](https://docs.clearly-ai.com/docs/ai-output-controls) ### How does Clearly AI keep AI security reviews consistent? Each review runs against a versioned template with the same policies, methodology, and criteria, so results don't depend on who runs them. AI output controls require each answer to follow a defined structure and stay grounded in the context Clearly AI gathered, with sources cited and gaps flagged. ### How does Clearly AI reduce false positives? Clearly AI checks each candidate finding against your existing controls and the context it gathered. If a control already mitigates a threat, it marks it as not a finding and explains why. If context is missing, it flags the gap rather than guessing. Your team's thumbs up and down feedback tunes the template over time. ### Why not just use a general-purpose AI tool for security reviews? General-purpose AI tools can give a different answer each time you ask, and they don't keep a record an auditor can trace. Clearly AI runs every review against a versioned template tuned to your policies, cites the sources behind each answer, and keeps a history of every change, so your team can defend the result at sign-off. ### Can we use our own security questionnaire or review template? Yes. Upload your questionnaire, template, or control spreadsheet and Clearly AI converts it into a review template in hours. You can map your controls to industry standards and set what counts as compliant in your environment. Existing threat models can come in as review context, too. ### Does our feedback train models or templates for other customers? No. Your thumbs up and down feedback tunes only your own review templates, and the Clearly AI team reviews it before any change. Clearly AI never trains models on customer data. If feedback points to an issue in the product itself, our engineers fix that issue for everyone. ### Can we see who changed a review answer and why? Yes. Each question in a review keeps a full history: AI-generated and regenerated versions, the context used, compliance status changes, and edits a person made, with timestamps and notes. ### Can we roll back changes to a review template? Yes. Clearly AI versions each template edit with the author and time. You can compare versions side by side and restore an earlier one. ### What guardrails does Clearly AI use? Two layers. Model providers apply their own content safety and moderation to each call. Clearly AI adds structural guardrails: agents run in isolated Firecracker microVMs, web access stays off unless a user requests it or an admin enables it, each agent can write only to the review it's scoped to, destructive edits need human approval, and every model response is schema-validated. ### Which AI models does Clearly AI use? Can we bring our own? Clearly AI works with providers including Anthropic and OpenAI. Yes, you can bring your own key through Amazon Bedrock. [See model providers for the current list](https://docs.clearly-ai.com/docs/model-providers) ## Bring your audit questions to the demo We'll walk through a Clearly AI review with you: the sources behind each answer, the version history, and how each finding was reached. - [Contact Enterprise Sales](https://clearly-ai.com/demo) - [Visit the Trust Center](https://clearly-ai.com/trust/security-privacy) ## Learn more - [Secure everything that ships](https://clearly-ai.com) - [We built the tool we wished we had](https://clearly-ai.com/about-us) - [One platform. From intake to remediation.](https://clearly-ai.com/platform) - [Know everything that needs a review. Skip the 300-question form.](https://clearly-ai.com/platform/security-intake) - [Ask only what matters. Get it right the first time.](https://clearly-ai.com/platform/conversational-intake) - [Every finding, tracked to a decision](https://clearly-ai.com/platform/resolve/risk-registry) - [Show leadership and auditors exactly what security reviewed](https://clearly-ai.com/platform/resolve/reporting) - [Security reviews you can stand behind, every time](https://clearly-ai.com/platform/quality) - [Threat models built from the tools you already use](https://clearly-ai.com/integrations) - [Threat models that know about today's attacks](https://clearly-ai.com/platform/threat-intelligence) - [Automate every step around the review](https://clearly-ai.com/platform/workflows) - [Threat models your teams can work on together](https://clearly-ai.com/platform/collaboration) - [Understand the system before the review starts](https://clearly-ai.com/platform/enterprise-context-graph) - [Trust, security, and deployment](https://clearly-ai.com/platform/trust-security-and-deployment) - [Every plan reviewed. Every risky change threat modeled.](https://clearly-ai.com/platform/ide-and-mcp) - [Verify what actually shipped](https://clearly-ai.com/platform/control-and-remediation-verification) - [A current threat model for everything that ships](https://clearly-ai.com/solutions/continuous-threat-modeling) - [Prove every product that ships meets your security bar](https://clearly-ai.com/solutions/product-security-assurance) - [Privacy reviews your team can stake decisions on](https://clearly-ai.com/solutions/privacy) - [Every vendor reviewed against your standards](https://clearly-ai.com/solutions/third-party-risk) - [Review every design before it's built](https://clearly-ai.com/solutions/design-and-architecture-reviews) - [Secure the AI you build, buy, and code with](https://clearly-ai.com/solutions/ai-agentic-security) - [Every regulation you answer to. One review process.](https://clearly-ai.com/solutions/compliance) - [Every product ready for the Cyber Resilience Act without growing your team](https://clearly-ai.com/solutions/compliance/cyber-resilience-act) - [Build vs. buy for security review automation](https://clearly-ai.com/compare/claude-chatgpt) - [The ThreatModeler alternative built from your own docs, code, and policies](https://clearly-ai.com/compare/threatmodeler) - [The Clover Security alternative with findings your team can trust](https://clearly-ai.com/compare/clover) - [The Prime Security alternative for every review your team runs](https://clearly-ai.com/compare/prime) - [Security and Privacy](https://clearly-ai.com/trust/security-privacy) - [Clearly AI Privacy Policy](https://clearly-ai.com/trust/privacy-policy) - [Clearly AI Subprocessors](https://clearly-ai.com/trust/subprocessors) - [AI Risk Reviews](https://clearly-ai.com/use-cases/ai-risk-reviews) - [Automate Triage](https://clearly-ai.com/use-cases/automate-triage) - [Privacy Impact Assessments](https://clearly-ai.com/use-cases/privacy-impact) - [Vendor Risk Assessments](https://clearly-ai.com/use-cases/vendor-risk) - [Threat Modeling](https://clearly-ai.com/use-cases/threat-modeling) - [Contact](https://clearly-ai.com/contact) - [Contact Enterprise Sales](https://clearly-ai.com/demo) - [Latest from the Clearly AI blog](https://clearly-ai.com/blog) - [In the news](https://clearly-ai.com/press) - [How Ericsson Enterprise Wireless Solutions cut review times by up to 80%](https://clearly-ai.com/customer-stories/ericsson) - [How HID Global reviews 300+ products for the Radio Equipment Directive with the team it already has](https://clearly-ai.com/customer-stories/hid-global) - [How Rivian scaled privacy and AI governance reviews 4x without adding headcount](https://clearly-ai.com/customer-stories/rivian) - [Part 2! Okay, privacy is different from security. Now what?](https://clearly-ai.com/blog/part-2-okay-privacy-is-different-from-security-now-what) - [How AI is rewiring our product engineering workflow](https://clearly-ai.com/blog/how-ai-is-rewiring-our-product-engineering-workflow) - [Good Data Scientists and Bad Outcomes, Part 1: What's the difference between security and privacy work?](https://clearly-ai.com/blog/good-data-scientists-and-bad-outcomes-what-s-the-difference-between-security-and-privacy-work) - [Why I Joined Clearly AI](https://clearly-ai.com/blog/why-vp-marketing-joined-clearly-ai) - [Skip the Marketing: Clearly AI for Technical People](https://clearly-ai.com/blog/clearly-ai-technical-explanation) - [Clearly AI Raises $8.4M Seed Round to Scale Product Security](https://clearly-ai.com/blog/seed-round) - [Why We Started Clearly AI](https://clearly-ai.com/blog/why-we-started-clearly-ai) - [Applying AI to Threat Modeling - Where AI Thrives, Survives, and Dies](https://clearly-ai.com/blog/applying-ai-to-threat-modeling) - [Why We Build in Public](https://clearly-ai.com/blog/why-we-build-in-public) - [Solving the Threat Modeling Bottleneck with AI Workflows](https://clearly-ai.com/blog/solving-the-threat-modeling-bottleneck-with-ai-workflows) - [Clearly AI Named Finalist in the 2025 Okta Startup Challenge](https://clearly-ai.com/blog/clearly-ai-named-finalist-in-the-2025-okta-startup-challenge) - [Security, SOC 2, & Startups](https://clearly-ai.com/blog/security-soc-2-startups) - [Building Reliable AI Systems for Security and Privacy Reviews](https://clearly-ai.com/blog/building-reliable-ai-systems-for-security-and-privacy-reviews) - [How to Automate Security and Privacy Reviews with Clearly AI](https://clearly-ai.com/blog/how-to-automate-security-and-privacy-reviews-with-clearly-ai) - [One Year of Clearly AI](https://clearly-ai.com/blog/one-year-of-clearly-ai) - [Navigating EU RED Compliance: Meeting the August 2025 Deadline](https://clearly-ai.com/blog/navigating-eu-red-compliance-meeting-the-august-2025-deadline) - [The AI Engineer Cheat Sheet](https://clearly-ai.com/blog/the-ai-engineer-cheat-sheet) - [Intelligent Vendor Risk Assessments](https://clearly-ai.com/blog/intelligent-vendor-risk-assessments) - [Clearly AI wins the AWS Bedrock Builder's Challenge](https://clearly-ai.com/blog/clearly-ai-wins-the-aws-bedrock-builder-s-challenge) - [Reviews, reviews, reviews!](https://clearly-ai.com/blog/reviews-reviews-reviews) - [Halfway through YC](https://clearly-ai.com/blog/halfway-through-yc) - [llms.txt — site overview for LLMs](https://clearly-ai.com/llms.txt) - [llms-full.txt — full site content for LLMs](https://clearly-ai.com/llms-full.txt) - [sitemap.xml — all public routes](https://clearly-ai.com/sitemap.xml) - [Documentation](https://docs.clearly-ai.com/docs) [Canonical page](https://clearly-ai.com/platform/quality)