Governance, Security & Privacy
Governance that makes data and AI defensible
Effective governance needs clear accountability and transparent decision-making, supported by security and privacy controls that safeguard your systems and data.
What it is
This service helps organizations set up the policies, roles, controls and evidence that let them use data and AI with confidence. It spans data governance (a governance operating model, ownership and stewardship, metadata and a data catalog, quality, classification and retention), security (identity, access control, encryption and key management, monitoring) and privacy (consent, purpose, minimization, handling of personally identifiable information (PII) and individual rights), plus governance specific to AI systems.
We do this as part of delivery as well as on its own. Governance designed into a platform from the start is typically easier to run than governance added later, and controls enforced in tooling are more reliable than controls written only in a policy document.
Problems it addresses
- Key data sets have no single owner, so quality and access issues linger.
- Policies exist on paper but are not reflected in how systems are configured.
- There is limited visibility into where personal or sensitive data is stored and who can reach it.
- AI tools are adopted by teams without an approval path, an inventory or a record of intended use.
- Producing evidence for audits or regulator questions takes weeks of manual effort.
- Cross-border data flows are not mapped, so residency obligations are hard to confirm.
What we deliver
- A governance operating model with roles, decision rights, stewardship and escalation paths.
- Data classification, retention and access policies aligned to your obligations.
- A metadata catalog, business glossary and lineage that support audit and impact analysis.
- Security controls implemented in the platform, including identity, encryption and key management.
- Privacy-by-design reviews, PII discovery and masking, and data subject request processes.
- An AI inventory, risk tiering, review checkpoints and model risk documentation.
- Audit-ready evidence and reporting for compliance, risk and internal audit teams.
- Training for data owners, stewards and reviewers.
Our method
How we work
We follow our four-step method, and each step ends with a review where you can pause, adjust or stop. See the full method.
Discovery & Strategy
We assess current practice against your obligations and risk appetite, and map sensitive data, owners and third-party flows.
Pilot & Validation
Controls are piloted on the highest-risk domain or AI use case, and tested to see whether evidence can be produced on request.
Build & Scale
Roles, policies and automated controls extend to further domains, with access reviews, monitoring and audit trails.
Optimize & Evolve
Periodic control testing, policy reviews and metrics keep governance current as systems, rules and risks change.
Technologies
Technologies we commonly work with
These are examples of tools we commonly work with for cataloging, access control, encryption and secure delivery. We configure what you already own first and recommend additions only where a gap is clear.
Governance and security
Catalogs, lineage, access control and key management that make data and AI auditable.
- Microsoft PurviewData catalog, classification and governance across Microsoft estates.
- Unity CatalogUnified governance for data and AI assets on Databricks.
- CollibraData governance and catalog platform for policies and stewardship.
- AWS Lake FormationFine-grained access control for data lakes on AWS.
- Google DataplexData management and governance across Google Cloud data.
- Azure Key VaultManaged storage for secrets, keys and certificates on Azure.
- AWS KMSManaged encryption keys for services and applications on AWS.
- Microsoft Entra IDIdentity and access management for people and workloads.
- OpenLineageOpen standard for collecting data lineage across tools.
- Great ExpectationsOpen source framework for data quality checks.
Cloud
The three major clouds we design and build on, shaped around the estate you already run.
- AWSAmazon Web Services: broad infrastructure, data and AI services.
- Microsoft AzureMicrosoft's cloud, closely tied to Microsoft 365, Fabric and Entra ID.
- Google CloudGoogle's cloud, known for BigQuery, Dataplex and Vertex AI.
- Cloud object storageAmazon S3, Azure Data Lake Storage and Google Cloud Storage as lake foundations.
DevOps and IaC
Infrastructure as code, CI/CD and observability so platforms are repeatable, reviewed and resilient.
- TerraformInfrastructure as code that works across all three clouds.
- BicepAzure-native language for declarative infrastructure.
- AWS CloudFormationAWS-native templates for repeatable infrastructure.
- GitHub ActionsCI/CD workflows that live next to the code.
- Azure DevOpsBoards, repositories and pipelines for delivery teams.
- KubernetesContainer orchestration for portable, scalable workloads.
- DockerContainer packaging for consistent builds and deployments.
- OpenTelemetryOpen standard for traces, metrics and logs.
These tools are examples of what we commonly work with, listed as text only. We are vendor-neutral and recommend what fits your estate. Product names belong to their owners, and their appearance here does not imply a partnership, endorsement or certification.
Governance and compliance
Organizations operate under overlapping expectations that differ by jurisdiction. Privacy laws such as Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, Quebec Law 25, General Data Protection Regulation (GDPR) and the EU AI Act in Europe, and state privacy laws in the United States apply broadly. Health privacy laws (HIPAA in the United States, Personal Health Information Protection Act (PHIPA) and provincial laws in Canada) apply in healthcare and life sciences. Financial services adds securities and prudential regulators, for example Canadian Investment Regulatory Organization (CIRO) and Office of the Superintendent of Financial Institutions (OSFI) in Canada, the Securities and Exchange Commission (SEC), Financial Industry Regulatory Authority (FINRA) and the Office of the Comptroller of the Currency (OCC) in the United States, the Financial Conduct Authority (FCA) in the United Kingdom and EU supervisors, and insurance and public bodies carry their own regimes. ISO/IEC 27001, ISO/IEC 42001 and the National Institute of Standards and Technology (NIST) frameworks serve as references. We design controls to support alignment with the expectations that apply to you. Interpreting a regulation and confirming compliance remain the responsibility of your compliance and legal advisers.
Ways to start
Engagement options
Most clients begin with an assessment or a pilot. Scope, owners and success measures are agreed in writing for each option, and the options can be combined.
Assessment
A governance and privacy gap assessment, a map of sensitive data and AI use, and a prioritized control plan.
Pilot
Controls and ownership implemented for one high-risk domain or AI use case, with evidence tested end to end.
Build
Delivery of the operating model, catalog, access policies and AI governance process across your data estate.
Advisory retainer
Ongoing support for governance forums, policy updates, new AI use case reviews and audit preparation.
This page is general information about ARCHR services. It is not legal, financial or investment advice, and it does not assure compliance with any regulation.
FAQ
Frequently asked questions
Is this a compliance certification?
No. We help design and document controls and governance practices. Compliance determinations are made by your own compliance function, legal advisers and, where relevant, regulators.
Can governance be added to an existing platform?
Yes. We typically begin with the highest-risk data and processes, then extend coverage in stages.
How does AI governance differ from data governance?
AI governance adds a model inventory, intended-use documentation, testing and monitoring, and human oversight on top of data ownership, quality and access controls.
Do you work with the governance tools we already own?
Yes. We configure the catalog, access and security tooling you own on AWS, Microsoft Azure or Google Cloud before recommending anything new.
Let's talk about your data and AI priorities
Tell us what you are trying to solve. We aim to reply within one business day.