Most engagements deliver within our 14 business-day target window.
You’ve spent years building breakthrough technology. You’ve won your Phase II SBIR. Production is within reach. Then silence. Just a contract that never materializes.
This happens when hidden Foreign Ownership, Control, or Influence (FOCI) surfaces during the DoD’s vetting. A key researcher's past undisclosed affiliation with the Thousand Talents Plan or Changjiang Scholars Program. An investor three layers deep with ties to a sanctioned entity.
Under the INNOVATE Act, true "transition readiness" is no longer just about Technology Readiness Levels (TRL). The statutory definition now demands an entity be demonstrably free of malign foreign talent recruitment programs and complex FOCI vulnerabilities before production funds can be legally obligated.
By the time you find out, it’s too late. The DoD doesn’t tell you what they found. They just move on.
Our protocol systematically interrogates every layer of your personnel and ownership structure using the same databases the government uses.
*Timeline targets shown. SLA clock pauses during documented third-party service outages.
Three specialized AI agents work simultaneously to build an independent picture of your risk exposure.
Scans personnel against research databases and co-authorship networks. Checks SciENcv disclosures against reality.
Traces ownership layer by layer, identifying shell entities and beneficial owners. Doesn't stop at layer one.
Builds an independent evidentiary baseline from WIPO patent filings and a secondary parse of your SciENcv — before it receives findings from other agents.
The Auditor becomes the triangulation engine, cross-referencing personnel and ownership risks to surface six categories of COI. The Sentinel validates findings against global sanctions.
Human analysts review all moderate-confidence findings.
The Architect compiles validated findings to produce the Transition Readiness Score (TRS) (0–100 scored dashboard), trigger Adverse Finding Briefings if critical risks surface, and build the Merkle-chained audit log. Senior analyst sign-off before delivery.
Phase timelines are targets based on typical engagement complexity. The protocol depends on third-party federal databases.
Your final deliverable proves defensible diligence for DoD transitions.
If disqualifying findings are detected during discovery or cross-validation, the protocol automatically halts and triggers an immediate Adverse Finding Briefing. We don’t wait until Day 14 to deliver critical news—you receive actionable intelligence the moment it is verified by an analyst.
Each agent operates independently within its own data silo. No single agent sees the full picture. That’s by design — the same compartmentalization principle the government uses, built into the architecture of the protocol itself.
Personnel Vetting
Finds what your researchers didn’t disclose. Resolves key personnel to their canonical research identity.
FOCI & Corporate Governance
Traces who really owns your company — past the cap table your lawyer gave you.
Discrepancy Analysis
The only agent that works both shifts. Catches what falls between the cracks of personnel and ownership.
Sanctions Validation
The last checkpoint. Multi-list amplification surfaces risks that single-database checks miss.
Orchestration & Compilation
The agent that never investigates — but controls everything. It routes data between agents, manages the phase gate state machine, and compiles the final Vetting Pack. It creates the Merkle-chained audit log that proves your diligence.
| Agent | Can See (Tier 1) | Cannot See |
|---|---|---|
| The Inquisitor | Raw publication data, co-authorship networks, SciENcv | Cap-tables, ownership, sanctions results |
| The Genealogist | Cap-table data, beneficial ownership, financials | Publication data, researcher PII, patents |
| The Auditor | SciENcv (secondary parse), WIPO patent records | Raw cap-tables, raw publication data |
| The Architect | Tier 2 Metadata & Signals only | All Tier 1 Raw Data (Blind by design) |
Not a slide deck. Your Vetting Pack is the deliverable the DoD wishes every contractor brought to the table.
Produced by The Architect
Dashboard presenting overall security posture across Personnel Risk, FOCI Exposure, Sanctions, and Disclosure Integrity.
Produced by The Auditor
Organized into Missing Content (COI 1-3), Strategic Blindspots (COI 4 & 6), and Data Deficiencies. It surfaces conflicts at the intersection of people, entities, and disclosures.
Produced by The Architect
Ready-to-file Proxy Agreements and Firewall Protocols, pre-populated with your specific findings from all agents. Not templates.
Produced by The Architect
Timestamped, hash-chained record of every data query and analytical decision across all phases. Your defensible answer to investigators.
No hourly billing. No scope creep. Know exactly what you’re investing.
For organizations targeting a specific production contract or DD-254 submission.
For multinational holding structures or organizations with complex personnel footprints.
Every engagement includes three mandatory human review checkpoints — no exceptions, no automated overrides.
Additionally, any time two agents produce conflicting results — for example, The Auditor and The Inquisitor parsing the same SciENcv field differently — the discrepancy is routed to a human analyst for resolution, not silently resolved by the system.
TensorLock. The AI agents are tools that execute the protocol. They do not bear responsibility. TensorLock designs the protocol, selects the data sources, defines the analytical logic, employs the human analysts who review findings, and delivers the Vetting Pack under our name.
That said, the Vetting Pack is a risk assessment based on the data available through authorized third-party sources at the time of the engagement — it is not a guarantee of clearance and not a legal opinion. If a data source was unavailable during your engagement, that gap is explicitly documented in the Gap Analysis Report so you know where your coverage ends.
If a finding was below the confidence threshold and didn't propagate to the Vetting Pack, that decision is recorded in the audit trail with the specific score and the threshold that excluded it. TensorLock takes responsibility for executing the protocol with commercially reasonable diligence, maintaining the integrity of the human review checkpoints, and delivering findings transparently — including findings we couldn't make because a data source was inaccessible.
What we do not take responsibility for is the accuracy or completeness of data maintained by third-party federal databases and commercial API providers that TensorLock does not own or control, or decisions made by the DoD or DCSA independently of the Vetting Pack.
We watched deep-tech companies with genuinely transformative technology get stopped cold at the Production transition—not because their tech wasn’t ready, but because their security posture wasn’t.
The tools available to founders were manual, fragmented, and reactive. Cap-table reviews that missed the third layer. Compliance consultants who checked boxes but didn’t interrogate the data.
We built FIDDA Shield to close that gap. We created an adversarial vetting system that runs the investigation the DoD will run—before they run it—so founders have time to understand, mitigate, and document their posture.
Raw data is purged within 7 business days of engagement acceptance. We don’t accumulate your sensitive information.
No single agent or person sees everything. Our protocol uses a tiered data compartmentalization model.
The Auditor works blindly in Phase 1, then cross-references in Phase 2. Conflicts at the intersection of personnel and ownership are surfaced by architecture, not luck.
Schedule a scoping conversation within 48 hours.
Hello. I am the TensorLock Protocol Assistant.
I can answer questions about adversarial vetting, FOCI risks, or the 14-day SLA. Would you like to check your entity's preliminary risk status?