How IRON Works

From public signals to data room. 48 hours.

No questionnaires. No target cooperation. No discovery calls. IRON reads what the target has already published to the world and maps every AI system to every regulation that applies.

Signal Sources

Four steps. One pipeline.

Each phase runs in parallel where it can, sequentially where it must. Most reports complete in 30 to 38 hours. We commit to 48.

01

Name the target.

Submit the company name and deal size. No questionnaire to send. No waiting on the target to respond. IRON starts immediately.

→ Scope confirmed within 2 hours of order.

IRON SIGNAL PIPELINE · LIVE SIMULATION

Every signal feeds the regulatory mapping engine. Article-level citations. Not framework summaries.

02 IRON reads the signals. Signal Sources
github
langchain>=0.1.0
openai>=1.0.0
boto3>=1.34  # AWS Bedrock
anthropic>=0.20.0
pinecone-client>=3.0
Dependency file confirms the production AI stack.
jobs
Senior ML Engineer, PHI Routing
"Experience with AWS Bedrock and HIPAA-compliant AI inference pipelines required."
Posted 12 days ago
Job listing confirms live AI deployment.
privacy
"We use the following AI sub-processors to process your data: [Vendor A], [Vendor B], [Vendor C]"
Privacy Policy v4.1
Sub-processor list reveals the vendor chain.
→ Every signal feeds the regulatory mapping engine
03 Every finding mapped to every regulation. Regulatory Mapping
PHI routing detected → HIPAA §164.502 · EU AI Act Annex III §5(a)
No bias audit found → NYC Local Law 144 · Colorado SB 24-205
Automated decisions, no override → GDPR Article 22 · CFPB Circular 2025-01
Article-level citations. Not framework summaries.
04 Report delivered. 48 Hours

A 20 to 40 page written report. Counsel-ready PDF. Drops into your VDR. Deal timeline unaffected.

LIVE  ·  48H PIPELINE
0h
Order placed
IRON initialized. Scope confirmed within 2h.
6h
Signal collection
GitHub, job boards, privacy policy, sub-processors.
18h
Regulatory mapping
EU AI Act, HIPAA, GDPR, state AI laws cross-referenced.
36h
Counsel-ready draft
SPA language drafted. PDF formatted for VDR.
48h
Delivered
Report in your data room. PDF + optional VDR push.
Boundaries

What we are not.

IRON's confidence comes from a narrow definition of what it does. These are the things we deliberately do not do.

✕ We do not access the target's internal systems, repositories, or data rooms. Everything we read is published to the public web.
✕ We do not require target cooperation, questionnaire responses, or discovery calls. The target does not need to know IRON ran.
✕ We do not produce legal advice. The report is signal intelligence. Always engage qualified counsel for legal and compliance matters.
✕ We do not hallucinate findings. Every finding cites its public evidence source: the exact repo, job posting, or privacy policy clause.
✕ We are not a document review tool. We do not read the documents the target hands you. Harvey and Kira do that. We map what the target runs.
Coverage

Every regulation IRON tracks.

Findings map to the specific article, section, and clause. Not a framework summary.

EU AI Act Annex III
High-risk AI categories, conformity assessment
HIPAA §164.502
PHI routing, BAA requirements, AI vendors
GDPR Article 22
Automated decisions, opt-out, human review
ECOA / Reg B
Credit AI adverse action, fair lending
NYC Local Law 144
Hiring AI annual bias audit requirement
EU AI Act Article 14
Human oversight, override mechanisms
GDPR Article 28
Data processor agreements, DPA chain
CMS-0057-F
Prior auth interoperability, FHIR API
CFPB Circular 2025-01
AI explainability, adverse action notices
Colorado SB 205
Algorithmic hiring, consumer notification
Illinois AIVIA
Video interview AI, facial analysis consent
CCPA / CPRA
AI profiling, opt-out rights, California
HIPAA §164.514
De-identification, model weight risk
EU AI Act Article 25
Deployer obligations, Annex IV docs
FTC Act Section 5
Deceptive AI claims, algorithmic harm
NIST AI RMF
Risk management framework mapping

Ready to run a report?

Fixed price. 48 hours. Counsel-ready.

Order a Report →
© 2026 Velxa LLC  ·  Signal intelligence only · Not legal advicevelxa.ai  ·  Signal intelligence only · Not legal advice Book a consultation →
/* Universal nav: active link + mobile burger */ (function initVelxaNavExtras(){ var active = document.body.getAttribute('data-active-nav'); if (active) { var link = document.querySelector('.velxa-nav .nav-links [data-nav="'+active+'"]'); if (link) link.classList.add('active'); } var burger = document.getElementById('navBurger'), panel = document.getElementById('velxaMnp'), close = document.getElementById('velxaMnpClose'); if (!burger || !panel) return; var openIt = function(){ panel.classList.add('is-open'); panel.setAttribute('aria-hidden','false'); burger.setAttribute('aria-expanded','true'); }; var closeIt = function(){ panel.classList.remove('is-open'); panel.setAttribute('aria-hidden','true'); burger.setAttribute('aria-expanded','false'); }; burger.addEventListener('click', openIt); if (close) close.addEventListener('click', closeIt); panel.addEventListener('click', function(e){ if (e.target===panel) closeIt(); }); document.addEventListener('keydown', function(e){ if (e.key==='Escape') closeIt(); }); panel.querySelectorAll('a').forEach(function(a){ a.addEventListener('click', closeIt); }); })(); /* ═════════════ VX Animation init — Batch 2 ═════════════ */ (function vxAnimInit(){ // Tag link-trace target on body so the underline-trace CSS applies on subpages document.body.classList.add('vx-link-trace'); // Auto-attach .vx-reveal to sections that benefit from scroll reveal. // Skip elements that already have .reveal (pre-existing GSAP-driven reveals on homepage). var revealSelectors = [ '.hero-a', '.hero-ss', '.hero-h', '.hero-s', '.problem-grid', '.market-stats', '.pull', '.iron-card', '.cta-section', '.iw-head', '.iw-selector', '.iw-terminal', '.frame-cards', '.ssi-grid', '.pricing-grid', '.steps-grid', '.reg-wall', '.not-list', '.opts', '.ab-block', '.report-frame', '.includes-list', '.placeholder', '.faq-list', '.sample-cta-band', '.pricing-bookcall', '.sell-teaser-section', '.amf-line' ]; revealSelectors.forEach(function(sel){ document.querySelectorAll(sel).forEach(function(el){ if (el.classList.contains('reveal')) return; el.classList.add('vx-reveal'); }); }); // Stagger children of grouped containers var staggerGroups = [ { wrap: '.steps-grid', child: '.step-card' }, { wrap: '.ssi-grid', child: '.ssi-card' }, { wrap: '.pricing-grid', child: '.pr-card' }, { wrap: '.frame-cards', child: '.frame-card' }, { wrap: '.reg-wall', child: '.rb' }, { wrap: '.includes-list', child: '.inc-row' }, { wrap: '.market-stats', child: '.ms' }, { wrap: '.not-list', child: '.not-item' }, { wrap: '.opts', child: '.opt-card' }, { wrap: '.iw-head + .iw-selector + .iw-terminal', child: '*' } // not used; placeholder ]; staggerGroups.forEach(function(g){ document.querySelectorAll(g.wrap).forEach(function(wrap){ wrap.querySelectorAll(g.child).forEach(function(c, i){ if (c.classList.contains('reveal')) return; c.classList.add('vx-reveal'); c.setAttribute('data-vx-stagger', String(Math.min(i, 6))); }); }); }); // Problem grid: left/right slide document.querySelectorAll('.problem-grid').forEach(function(grid){ var children = grid.children; if (children[0]) { children[0].classList.add('vx-reveal','vx-left'); } if (children[1]) { children[1].classList.add('vx-reveal','vx-right'); children[1].setAttribute('data-vx-stagger','2'); } }); // IntersectionObserver if (!('IntersectionObserver' in window)) { document.querySelectorAll('.vx-reveal').forEach(function(el){ el.classList.add('is-in'); }); return; } var io = new IntersectionObserver(function(entries){ entries.forEach(function(en){ if (en.isIntersecting) { en.target.classList.add('is-in'); io.unobserve(en.target); } }); }, { threshold: 0.15, rootMargin: '0px 0px -8% 0px' }); document.querySelectorAll('.vx-reveal').forEach(function(el){ io.observe(el); }); // Market stats count-up (about page) — drives .ms-num elements with data-vx-count // Auto-populate counts from the existing text: parse leading number when present. document.querySelectorAll('.market-stats .ms .ms-num').forEach(function(el){ if (el.hasAttribute('data-vx-count')) return; var raw = el.textContent.trim(); // Find the first integer at the start (e.g., "15", "78", "1") var match = raw.match(/^(\d+)/); if (!match) return; var target = parseInt(match[1], 10); el.setAttribute('data-vx-count', String(target)); el.setAttribute('data-vx-raw', el.innerHTML); el.innerHTML = el.innerHTML.replace(/^(\d+)/, '0'); }); var countObserver = new IntersectionObserver(function(entries){ entries.forEach(function(en){ if (!en.isIntersecting) return; var el = en.target; var target = parseInt(el.getAttribute('data-vx-count') || '0', 10); var raw = el.getAttribute('data-vx-raw') || el.innerHTML; if (!target) { countObserver.unobserve(el); return; } var start = 0, duration = 1100, t0 = performance.now(); function frame(now){ var p = Math.min(1, (now - t0) / duration); var v = Math.floor(start + (target - start) * (1 - Math.pow(1 - p, 3))); el.innerHTML = raw.replace(/^(\d+)/, String(v)); if (p < 1) requestAnimationFrame(frame); } requestAnimationFrame(frame); countObserver.unobserve(el); }); }, { threshold: 0.5 }); document.querySelectorAll('.market-stats .ms .ms-num[data-vx-count]').forEach(function(el){ countObserver.observe(el); }); // Sell-side framing cards (.fc-num) count-up document.querySelectorAll('.frame-card .fc-num').forEach(function(el){ if (el.hasAttribute('data-vx-count')) return; var match = el.textContent.match(/^(\d+)/); if (!match) return; var target = parseInt(match[1], 10); el.setAttribute('data-vx-count', String(target)); el.setAttribute('data-vx-raw', el.innerHTML); el.innerHTML = el.innerHTML.replace(/^(\d+)/, '0'); countObserver.observe(el); }); })();