How can we help?

No. You can complete the Free AI Risk Assessment and see your score and every finding without signing up. Create a free account to save the results and track remediation; paid plans add seats for teammates.

Owners and Admins can invite teammates from Team in the app; the Free plan includes one seat, and paid plans add more. Each person receives an email invitation that can only be accepted by that email address and expires after 7 days.

Owner, Admin, Security Admin, Analyst, Viewer, and Billing. Viewers have read-only access; Analysts can run assessments and work findings; Security Admins can also approve policies and view the audit log; Admins manage the team and settings; Billing manages plans and invoices; Owners have full control.

Yes. Consultants and multi-entity organizations can be members of several organizations and switch between them. Each organization's data is isolated from the others.

Go to Account → Security in the app and set up an authenticator app. We strongly recommend MFA for every account.

Most organizations finish in 10–15 minutes: about five minutes for the organization questions, then one to two minutes for each AI system.

No. The current FlashTower Scan is based on the information you provide in a guided questionnaire. FlashTower does not perform network scanning or access your systems. Integrations are separate and optional: FlashTower connects to a provider only if you authorize it, only reads through it, and requests the narrowest scope each provider offers. Each one is listed in the app with its current availability.

Choose "Not sure". Unconfirmed controls are scored conservatively because a control you cannot confirm cannot be relied on. On paid plans you can update answers and re-run the assessment (the Free plan includes one completed assessment); confirming answers may lower your score.

Any AI assistant, coding tool, AI agent or automation, AI feature inside another product, or custom integration with an AI model — whether officially approved or not.

Each finding contributes points based on its severity (Critical 25, High 12, Medium 5, Low 2, Informational 0) multiplied by the rule's weight. When the same rule fires for several AI systems, each additional occurrence counts half as much as the previous one. The score is 100 × (1 − e^(−points/60)), rounded, and raised to at least 60 when any Critical finding exists. Higher scores mean more risk. See methodology.

No. Scores and findings come from a deterministic, versioned ruleset. The same answers always produce the same result under the same ruleset version. AI is never used to determine a score.

Critical: a plausible path to serious data exposure, irreversible action, or regulatory breach. High: a significant weakness likely to contribute to an incident. Medium: a control gap that increases likelihood or impact. Low: a hygiene issue. Informational: context or a visibility gap.

No. FlashTower maps findings to frameworks such as NIST AI RMF, NIST CSF, the HIPAA Security Rule, SOC 2, ISO/IEC 27001, and the OWASP Top 10 for LLM Applications to help organize work. A FlashTower assessment is not an audit, certification, or legal opinion.

Each assessment records the ruleset and scoring versions it used, so past results remain explainable. On paid plans, re-run the assessment to evaluate against the current ruleset.

Every finding shows the rule's condition (why it fired), an explanation of the risk, and its severity. Open the finding in the app to see the full explanation and the specific answers that triggered it.

Full reports include step-by-step remediation for every finding, the evidence that demonstrates the fix, and a prioritized 30-day plan. Update the finding's status as you work and attach evidence.

Yes. Mark the finding as Accepted Risk with a note explaining the decision. The status change is recorded in the audit log.

If an answer was inaccurate, correct it and re-run the assessment (paid plans; the Free plan includes one completed assessment). If you believe a rule is wrong for your situation, mark the finding False Positive with a note and let us know at support@flashtower.com.

An executive summary, organization profile, AI inventory, risk score and calculation, all findings by severity with remediation and evidence requirements, permissions and sensitive-data overviews, human oversight and governance sections, a prioritized 30-day action plan, methodology, framework references, and disclaimers.

Yes, on plans that include full reports. PDFs are generated from your assessment on demand and are only available to signed-in members of your organization.

Reports are written for executives, boards, legal and compliance teams, security teams, auditors, and insurers. Share them as you would any confidential internal document.

Yes. The scan, your risk score, and every finding with its explanation are free. Paid plans add full remediation guidance, full reports, PDF downloads, more AI systems, assessments, and team seats, and — on Team plans and above — Policy Center templates. See pricing.

Owners and Billing members can manage or cancel subscriptions from Billing in the app. Cancellation takes effect at the end of the current billing period.

Payments are processed by Stripe. FlashTower is currently operated by Boostlete LLC, which appears as the merchant. FlashTower never sees or stores full card numbers.

Contact billing@flashtower.com. We review refund requests individually.

Data is encrypted in transit and at rest by our infrastructure providers, isolated per organization with database row-level security, and accessible only to members of your organization according to their roles. See Security.

Not by default. Optional AI features are off unless an organization administrator explicitly enables AI processing, and even then risk scores are never determined by AI.

Go to Settings in the app: Owners and Admins can use Export your data to request an export, and Owners can request organization deletion. You can also email privacy@flashtower.com from an Owner account. We verify each request and confirm when it is complete.

Email security@flashtower.com. See our responsible disclosure policy.