Implementation, Security & Governance FAQ
What the four weeks contain, where the work runs, who owns what we build, and how a security review is supposed to go.
A ReinforcedX implementation is a fixed-scope four-week engagement that designs, builds, evaluates, and hands over a production AI system inside your cloud. You own the weights, datasets, eval suite, and runbook. Client data is not used to train shared models. Thirty days of on-call cover is included after handover.
What an implementation is
If you only need the shape: four weeks, your cloud, your team owning it, a number for quality.
What does a ReinforcedX implementation actually include?
The workflow design, the agent or system, the evaluation suite, a shadow-mode run on real data, and a handover with a runbook your engineers can operate. You end up owning a running system plus the evidence it works, not a proof of concept that needs rebuilding.
How long is four weeks, really?
Discovery in week one, environments in week two, a shadow-mode pilot in week three, handover in week four. That is the standard implementation for a single well-bounded workflow. Regulated programmes (banks, health systems) add documentation time and often run 8–14 weeks to a governed pilot — we will say so on the first call rather than pretending the default always fits.
Do we need an in-house ML team?
No. Most clients start with strong software engineers and no ML specialists. The engagement is built so your existing team owns the system afterwards — we train them while we build rather than handing over documentation at the end.
What do you need from us?
One process owner who knows the workflow end to end, one engineer with access to the systems being integrated, and a weekly 45-minute review. That is genuinely it. No standing project committee.
How are you different from a consultancy?
Consultancies bill for the roadmap and leave you the build. We ship the build. Every engagement ends with running software, an eval suite, and a runbook your team owns — and we are measured on whether it stays in production, not on hours logged.
Where does the work run?
Inside your tooling and cloud perimeter. We integrate with the stack you already run rather than asking you to move anything into ours. VPC, on-prem, or your existing Kubernetes cluster are all in play; for regulated deployments this is the default.
What happens after week four?
You are running it. Thirty days of on-call cover is included at no extra cost. After that, most teams take an optional retainer with a named engineer, quarterly eval reviews, and priority response. Plenty of teams run solo from day 31 with what they already own.
How the engagement runs
Pricing, models, security review, and what we do when a previous attempt already failed.
How is pricing structured?
A platform subscription plus a fixed-scope implementation fee, quoted in writing before work starts. Implementation is priced by engagement rather than by the hour. For standing programmes, pricing is per delivered unit against an agreed quality bar, or a fixed monthly fee. You are not billed for batches that fail QA.
Who pays for model inference?
You do, directly to your provider, at your own negotiated rates. We never resell tokens with a markup, and we tune routing and caching to bring that bill down — smaller models where they win, larger ones only where they earn it.
Can you work with our existing models and stack?
Yes. Reinforce is model-agnostic — Anthropic, OpenAI, Google, Mistral, and your own fine-tunes run through one interface. We integrate with your existing cloud, data warehouse, and observability stack rather than replacing them.
We tried something like this before and it failed. Why would this be different?
Most failures are not model failures — they are missing evaluation, no human fallback, and no way to tell whether a change made things better. Those are the parts we build first. If we cannot define how success is measured, we say so before taking the work.
How do you handle security reviews?
SOC 2-aligned controls, deployment inside your perimeter where required, credentials in your secret manager, per-user permission enforcement at retrieval time, and immutable audit logs. We work through your existing review rather than inventing a parallel one. InfoSec is usually the longest pole on regulated work, which is why we start it in week one.
Can we start with one workflow?
You should. One high-volume, well-bounded workflow with a clear success metric — invoice matching, tier-one support triage, contract review — is the smallest sensible start. One agent live and measured beats five half-built ones, and it is the internal proof that funds the next five.
What does shadow mode mean?
The agent runs on live traffic in parallel with your current process and does not change the system of record. You score it against the rubric. Write actions stay off until that sample holds. Week three of the standard implementation is this, on purpose, so going live is a permission change rather than a leap of faith.
Ownership, data, and support
The questions legal, security, and finance will ask. The answers are the same ones we put in the engagement letter.
Who owns the models, data, and code?
You do. Everything we build inside your engagement — fine-tuned weights, datasets, eval suites, runbooks — is yours. We hand over the keys at the end of the engagement, and your team runs it. There is no lock-in that requires us to keep the system running.
Is our data ever used to train shared models?
Never. Your data trains your models only. We run with zero-retention provider settings by default, and anything fine-tuned on your data stays inside your tenancy.
Can we run everything inside our own cloud?
Yes — VPC, on-prem, or your existing Kubernetes cluster. For regulated deployments this is the default: nothing leaves your perimeter, and we work within the network and identity controls you already run.
Can you show an auditor how a decision was made?
Every agent run is logged with its inputs, retrieved context, tool calls, model version, and final output. Auditors get a reconstructable trail per decision, plus model-risk documentation mapped to your governance framework.
What support do we get after the engagement ends?
Thirty days of on-call cover is included. After that, most teams take a retainer with a named engineer, quarterly eval reviews, and priority response — but it is optional, and plenty of teams run solo from day 31.
What does the total first year usually look like?
For a single-suite deployment, most teams land between a mid-five-figure implementation and an annual platform subscription sized to usage. We give you the full number in writing before week one — no change orders mid-build. Book a demo for a quote scoped to your use case.
Domain and use cases
The four-week shape holds. The review layer and the first workflow change with the sector.
How does implementation change for a bank?
The build is the same; the review layer is heavier. Model-risk documentation, reconstructable traces, and human checkpoints on anything that moves money are standard, not add-ons. Agent consulting for financial services typically runs 8–12 weeks to a governed pilot. We start the security and model-risk conversation in week one so it is not a surprise in week four.
What extra happens for a hospital or payer?
HIPAA-aware architecture, EHR integration, a ban on improvised medical advice, and a missed-escalation target. Conversational AI consulting for health systems typically runs 10–14 weeks to a production pilot. Clinical content stays on humans; admin intents are where the agent starts.
How do you work with a BPO?
The agent sits in the same queue as the operation, with the BPO’s macros as the source of truth and the client’s policies as the constraint. Quality is reported per batch so both sides can see it. The usual first workflow is a high-volume, well-bounded intent the operation already measures.
What does an e-commerce implementation look like?
Support, catalog, and ops agents that act on orders — look up shipment, start a return, apply a documented policy. Typical path is 6–10 weeks to production, with 50–80% automation on the targeted intents once write actions are open. Shopify and the helpdesk are the usual first connectors.
How do insurance implementations handle claims and policy?
RAG over the policy wording, a refuse-when-silent rule, and human checkpoints on coverage decisions. FNOL intake and servicing queries are the usual first slice; settlement is not. Traces are the artefact you show an auditor. Deflection on servicing is typical in the 40–70% range once the golden set holds.
ReinforcedX is an implementation and delivery partner, not a SaaS product and not a staffing marketplace. The standard path is four weeks: discovery, environments, shadow-mode pilot, handover. Work runs in your tooling and perimeter. Pricing is a platform subscription plus a fixed-scope implementation fee, quoted before week one. Inference is paid by you to your provider. SOC 2-aligned controls, per-user permissions at retrieval time, and reconstructable audit logs are the default on regulated work.
Keep reading
Ready to refine
your workflow?
Share your current process. We’ll help you identify what can be automated — and where efficiency can be reclaimed.