A specialist practice, deliberately small
FINSECRA is a focused practice for organisations deploying AI. You work directly with the person who scopes, reviews and signs your deliverable. No hand-offs, no junior bench.
Who you work with
Juhi Singh
Founder & Principal Consultant
Juhi leads every FINSECRA engagement personally, from agreeing the scope and approving the read-only access requested, through triaging findings, to signing the final report and walking your team through it.
Engagements draw on FINSECRA’s 74-policy information security and AI governance suite, including AI Usage, AI Model Governance and Secure AI Development policies, tailored to each client.
If you’re evaluating us, ask for a call. You’ll speak with the person who would do the work.
Current retainer clients
- GettleadsMonthly retainer
- Qzerofounder-affiliatedMonthly retainer · end-to-end DevSecOps & FinOps on AWSQzero makes a workplace-dining platform: employee and vendor apps, with web consoles for site admins. Since July 2026 we have handled its DevSecOps on AWS end to end: infrastructure as code, CI/CD for the API, web and mobile apps, and security built into both, from secrets management to a web application firewall. FinOps runs alongside: budgets set from actual billing, and each environment sized to its job. We also deployed the qzeroapp.com website on AWS.
Disclosure: Qzero is affiliated with FINSECRA’s founder. We list it because the work is real, and we disclose the relationship because you should know it when you assess us.
What buyers ask us first
Can you certify us for ISO/IEC 42001 or ISO/IEC 27001?
No, and nobody in a consulting role should. Certificates are issued only by accredited certification bodies. We prepare you for that audit, with a gap analysis, policies, controls and evidence. We never issue or promise certification.
Do you use AI to deliver your work?
Yes, and we’re open about it. AI agents handle evidence gathering and first-pass control mapping. Every finding must cite a specific artefact, framework references are checked against stored framework text rather than model recall, and a named consultant reviews and signs the deliverable. Any model provider involved is named as a sub-processor in your contract.
Does our infrastructure data leave our environment?
Collection runs inside your environment as a short-lived, read-only collector you can review before it runs. Identifiers are stripped there, and only the minimum abstracted evidence is used for analysis. We don’t host or keep copies of your infrastructure inventory. If your policies need analysis to stay entirely in your own cloud account, raise it at scoping.
You’re a small practice. What if you’re unavailable?
That’s why we sell fixed-scope deliverables rather than operations. A report and a hardened configuration belong to you on delivery, and nothing in your production depends on us afterwards. We don’t offer 24/7 monitoring or response-time SLAs, so there’s no operational commitment we could fail to meet.
Where are you based, and how do you work with EU and US teams?
We’re based in India and work remotely with teams in the EU and US, with scheduled sessions in overlapping hours. Engagements are quoted in EUR or USD.
Not sure where to start?
Tell us your situation. We’ll tell you exactly what you need, with no sales deck.