I help Iranian businesses and organisations start AI where their data stays safe — and finish with an acceptance criterion that holds up in front of a board and an auditor.
13+ years in information security, networking, IoT and ERP · ISO/IEC 42001 · NIST AI RMF · OWASP LLM Top 10
Positioning
Most people who consult on AI start from the tool. I start from where your data goes and what happens if it leaks.
The reason is simple: before moving into this field, I spent over a decade working in information security, networking, IoT and ERP. In those years I saw enough careless technical decisions turn into serious problems months later.
In practice this means the order of work matters more than the choice of tool. If you pick a tool first and then discover your data is not allowed into it, you have lost both the money and the organisation’s trust in the whole idea.
About
I did not arrive at AI from the tool side. I arrived from the side that has to keep the data safe.
I am Sheida Bohlouly — an AI and IT consultant based in Tehran. Before this field, I spent over a decade in information security, networking, IoT and ERP, and that order is the reason this site talks about data before it talks about models.
What I do now is the secure implementation of existing models inside real workflows: choosing what may be automated, deciding what must never leave your network, and writing down the number that says whether it worked.
Frameworks I work against: ISO/IEC 42001 · NIST AI RMF · OWASP LLM Top 10
The answer to those questions
We establish what data you hold and which of it must never leave your internal network.
One specific, repeatable task is automated first — a tangible output, not a strategy deck.
The number that tells you it worked, signed before we start.
Engagement
No package starts without a signed acceptance criterion, and each one ends with a system card — not a slide deck.
Package 0
A working session on your actual work — not a generic example. We identify which of your daily tasks can be automated today, with which tool, and which of your data must never enter an external tool.
Acceptance criterion
At least one of the three identified tasks is running by the end of that same week.
Package 1
Process mapping, data sensitivity classification, gap analysis against ISO/IEC 42001 and NIST AI RMF, and prioritisation of the first three processes.
Acceptance criterion
A prioritised list of at least three processes, each with a time and risk estimate, signed off by the client.
Package 2
Tool selection and configuration matched to your data sensitivity level, deployment architecture, OWASP LLM Top 10 controls, an evaluation set, guardrails, logging and monitoring.
Acceptance criterion
A specific number on the evaluation set — minimum agreed accuracy on samples held out from development data — plus an access test report showing no cross-unit leakage.
Package 3
Team training, human-in-the-loop procedures, quarterly review of the evaluation set and regulatory status, and knowledge transfer.
Acceptance criterion
At least two people in the organisation can run and interpret the evaluation set without me.
Pricing is not published. Without knowing your work, any number I write would be meaningless — and the brand’s claim discipline does not allow a number without its conditions.
Boundaries
Stating the boundaries up front means neither of us wastes the other’s time.
You will also not find client testimonials, client logos, or unsourced numbers on this site. Until I have a published measured result, that space is filled with real, working tools instead — six of them in the Lab, all running entirely in your own browser.
Next step
A 30-minute call, free and with no commitment. If your problem isn’t something I can help with, I’ll say so in that call.
ShidHoosh — Founder: Sheida Bohlouly
AI & IT Consultant · Security · Governance · Automation · NLP
Tehran, Iran