Capability
Research, strategy, education, workflow design, evaluation, and bounded implementation.
Procurement
What an institutional buyer needs to evaluate fit.
Capability, scope, accessibility, security and privacy boundaries, AI use, purchasing routes, and only supported assurance claims.
Commercial scope
One offer is active and priced: the AI Opportunity Clinic at $275 per participant. Every other named package is a candidate format — unavailable and unpriced. Custom work is scoped and priced only under a signed agreement.
Accessibility
Public pages are built against WCAG 2.2 AA as a design reference and the Support page documents the keyboard, zoom, motion, and status-labelling behaviour actually implemented. No conformance audit, VPAT, or accessibility conformance report has been produced. Accommodation requests for a future paid service require a separately verified route before activation.
AI use
AI may assist research, analysis, documentation, or implementation under human review; sensitive or restricted material is not accepted through public routes.
Security and privacy
Public intake is limited to nonconfidential information. No confidential, incident-response, or regulated-data channel is currently offered.
Claims
No certification, insurance, compliance, client, or credential claim appears unless current evidence supports it.
Buying state
What is open, and what is switched off.
A vendor page that lists only what works is a brochure. This is the whole state of the commercial system, including the parts that would disqualify this practice from a procurement process — because finding that out on this page costs you five minutes and finding it out later costs a great deal more.
A single priced, deliverable service. The AI Opportunity Clinic: 90 minutes, up to 6 participants, $275 per participant, with published reservation, cancellation and refund terms.
AvailablePublished cancellation and refund terms. An offered slot is held 48 hours and becomes reserved only when the full total is paid. Cancel 7 or more calendar days before the start for a full refund, 50% between 72 hours and 7 days, nothing inside 72 hours. Participants may be substituted at no charge, one reschedule is free at 72 hours' notice, and refunds are initiated within 5 business days.
AvailableOnline checkout or payment. No payment path is enabled anywhere on this site. Payment credentials are documented as unset and payment activation is gated behind an accepted written scope and a reservable session.
Not availableAccounts, logins, or stored user records. There is no account system. The public tools and courses write to your browser only; nothing is held server-side to be requested, exported, or breached.
Not availableA structured organizational inquiry form. Closed during implementation. The only open form is the Clinic inquiry, and only when its mail and abuse-prevention credentials are configured.
Not availableInsurance, tax, entity, and vendor-onboarding facts. Not published, because publishing them before they are current and verified would make this page the same kind of artifact it is arguing against. They are supplied on request during contracting.
Not availableAn accessibility conformance report or VPAT. None has been produced. The Support page documents the behaviour actually implemented, which is a different and smaller claim.
Not availableCertification, audit, or compliance attestation. Aloha AI is not a certification body, auditor, or assessor, and issues no attestation about any system, vendor, or organization.
Not available
Independent verification
Four things you can check without asking anyone.
Assurance that depends on the vendor answering a questionnaire honestly is not assurance. These four can be confirmed from outside, by a person who has decided in advance not to believe this page.
Response headers
What is there
Every route is served with a Content-Security-Policy whose only non-self origin is the Cloudflare Turnstile challenge endpoint, plus HSTS with a two-year max-age, X-Content-Type-Options nosniff, X-Frame-Options DENY, frame-ancestors none, Cross-Origin-Opener-Policy same-origin, and a Permissions-Policy that disables camera, microphone, geolocation, payment and USB.
How to check it
Run a header check against any page on this domain. No form of trust in this page is required.
A machine-readable catalog
What is there
The public catalog is served as JSON at /api/catalog with an open CORS header and 25 records, each carrying its own status string. Its JSON Schema is published separately at /api/catalog/schema/1, and a dated RSS feed at /feed.xml.
How to check it
Fetch it and diff it against the pages. A status of “Candidate · unavailable” in the catalog is the same status the page shows.
Every route in one file
What is there
The complete public route inventory is declared in the sitemap, and the build test suite fails if a declared route has no source page behind it.
How to check it
Open /sitemap.xml. Nothing is published outside it, and there is no unlisted sales page.
Source-level evidence
What is there
The Source Desk names every official record any public method claim rests on, what each is used for, and the limit it cannot carry.
How to check it
Open the record. If a source does not say what a claim needs it to say, the claim is the thing that is wrong.
Data handling
The only route that transmits anything, and what it carries.
Public tools and courses transmit nothing
The Opportunity Studio, the three decision builders and both course workspaces write to browser storage on your device and read it back. There is no server-side record to subject to a retention schedule, a subject-access request, or a breach notification, because there is no server-side record. The corresponding cost is that clearing site data destroys the work, and Aloha AI cannot restore it.
The Clinic inquiry is the single exception
When its credentials are configured and the form is visibly open, it transmits a name, email address, organization or cohort name, participant count, a nonconfidential workflow description, an access follow-up choice, a consent record and an inquiry reference. It does not request medical details, payment information, or confidential material, and submitting it creates no booking or contract.
Two named subprocessors, and nothing else
Delivery runs through Resend; abuse prevention runs through Cloudflare Turnstile. Both process what their function requires, under their own terms. No analytics, advertising, session-recording, or third-party tracking script is loaded on any page — a claim the Content-Security-Policy above makes structurally difficult to break without the header changing.
Retention is a target, and is described as one
Aloha AI targets deletion within 30 days for inquiries that are not accepted, subject to documented legal or security holds. That is a stated intention operated by a person, not an automated deletion guarantee, and the policies page says so in the same words.
Current buying state
Evaluation is possible; submission is not active.
The organization inquiry will collect the authorized contact, bounded problem, desired result, timing, budget or procurement stage, accessibility needs, and material security constraints. It will not become a generic contact form.
Structured inquiry closed during implementation.
Insurance, tax, vendor, payment, data-handling, and support facts will be supplied only after they are current and verified.
Insurance, tax, vendor, payment, data-handling, and support facts will be supplied only after they are current and verified.