For IT staff and MSPs

AI diagnosis for Windows tickets, with a person approving every fix.

ITAI is built for IT staff and MSPs, and easy to use with a bit of computer knowledge. Describe a Windows problem in plain words and ITAI investigates with read-only commands: it reads logs, services and configuration, names the likely cause, and writes up a fix with a rollback for each step. You review it, approve what you agree with, and nothing else runs.

Request early access See it work

Free for 30 days on your PCs. AI diagnoses use prepaid credit from $5. Add a card to keep going after 30 days. Windows PCs only.

Likely cause in plain English Every client's PCs in one place Fixes ready to approve From $1 per device, plus AI usage

ACCT-PC07 · ticket "Keeps asking me to sign in again" · Local admin Awaiting review

PS> Get-WinEvent -ProviderName Microsoft-Windows-Security-Kerberos -MaxEvents 1

Error Code: 0x25 KRB_AP_ERR_SKEW

this PC's clock is 5 min 21 s ahead of the domain, so sign-in is refused

PS> Get-WinEvent -ProviderName Microsoft-Windows-Time-Service -MaxEvents 1

47 No valid response has been received from domain controller DC01

↪ DC01 is this PC's time source and runs ITAI too, checking it

PS DC01> Get-Service w32time

Status Name DisplayName

Stopped w32time Windows Time

Finding. Nothing is wrong with the passwords. Windows Time is stopped on DC01, the domain's time source, so PC clocks have drifted past what sign-in allows, for everyone, not just this desk. ITAI checked DC01 because the technician added it to the ticket.

Start-Service w32time on DC01 risk: low rollback: Stop-Service w32time needs its DC01 acknowledgement

Restart-Service w32time on ACCT-PC07, to resync now risk: low rollback: none needed, a restart changes no setting

A real-shaped ticket: the symptom is on one desk, the cause is on the domain controller. Press Approve 2 steps to run the fix. Until then, both machines have only been read. Afterwards a technician confirms with the user and closes the ticket: ITAI never closes one by itself.

How a ticket runs

How ITAI works, with a person holding the only key.

Every ticket follows the same six steps. The line between investigating and changing is enforced on the machine itself, not left to the AI.

Install once

Paste one line into an elevated PowerShell window, or run the installer package. ITAI runs as a Windows service and checks in with your dashboard.

Open a ticket

Pick the device, describe the problem in plain words, and choose the privilege level ITAI may investigate with.

ITAI investigates

It works through read-only commands: services, event logs, disk, network, configuration. If the answer lives on another machine that runs ITAI, like a domain controller, it can check there too, read-only, once a technician adds it to the ticket.

You get a finding

A plain-language cause, plus a proposed fix where every step carries a risk rating and a rollback command.

You approve

Open each step to review it, then approve all of the plan, some of it, or none. The approval is signed with your organization's key, and the device refuses any command it doesn't cover.

It's done, and on record

Approved steps run, and every command and its output lands in the ticket's transcript, which nothing in ITAI can edit.

See it work

One ticket, start to finish, in the ITAI dashboard.

A user keeps being asked to sign in again. ITAI runs read-only checks on the PC, follows the evidence to the domain controller DC01, and finds Windows Time stopped there, so the PC's clock has drifted past what sign-in allows. It proposes a fix on each machine, the technician approves both, and the ticket's history keeps the record.

The real ITAI dashboard with sample data: a sign-in problem traced from one PC to the domain controller and fixed on both. The MSP, its clients, the devices and the command output are fictional. Some waits are shortened. No sound.

Guardrails

Built so the AI can't act on its own.

Any AI can be wrong, and any AI can be tricked. So ITAI's limits don't depend on the AI behaving: they are enforced by the device, by signed approvals, and by a person approving every fix.

Diagnosis is read-only.

HowEvery command the AI asks to run is parsed on the device with PowerShell's own parser and checked against a read-only allow-list before it can start. Ping, DNS and connection tests can only reach private addresses, your domain, hosts named on the ticket and a short list of known services. Some read commands can still name another machine; closing that gap is part of our planned independent security test.

No fix without a named person.

HowIn the dashboard, a technician has to open each step and see its exact command and rollback before they can select it. Their name goes on the ticket.

Only what was approved can run.

HowApprovals are signed with a key unique to your organization, cover the approved commands byte for byte and only the device they were approved for, are issued once, and expire five minutes after approval. A fix that restarts the PC finishes after it comes back.

Fixes can be switched off.

HowFixes are on for a new client, and each one still waits for a named person's approval. An admin can switch any client to diagnostics only, and every change shows in Company settings with who made it and when.

A second AI checks the first.

HowA separate check, with none of the diagnosis in front of it, compares each step's command with its description. It runs on a top-tier model ITAI chooses, whichever model your diagnoses use. A step it couldn't check needs an explicit acknowledgement.

A lost or hacked PC can be cut off on its own.

HowEach device has its own credential, so one machine can be locked out without touching the rest. Your PCs talk only to your dashboard, never to the AI directly.

Every command on the record.

HowEach command the AI ran, its output, and who approved what are written to the ticket's transcript. Nothing in ITAI can edit it; it is removed only when your retention period ends or your account owner asks for your data to be deleted.

What ITAI will never do

Change anything on a machine while it is diagnosing.
Run a fix no one approved, or a command other than the one approved.
Use your tickets or device data to train AI models.
Start a diagnosis, or approve or send out a new fix, once a client has reached its monthly AI spend limit.
Keep your tickets and transcripts more than 90 days after their last activity, unless a legal hold requires it. A slim audit record of who did what is kept for 7 years.

Also yours to control: a monthly AI spend limit per client, and a Data & privacy page where your admins export your data and your account owner can ask for it to be deleted. More detail, including what isn't done yet, on our Security page.

Who it's for

For IT staff and MSPs.

ITAI does the first round of investigation on a ticket, so your team starts from a finding instead of a blank remote session. Every fix still needs a person to approve it.

Managed service providers

If you provide managed IT services, every client is its own organization in ITAI, with its own installer, key, devices and tickets, kept separate from the others on every request. Your technicians start each ticket from a finding, and client organizations can share one billing account so the device tiers count your whole fleet.

In-house IT teams

Run a remote IT help desk without the first round of detective work. When your servers run ITAI too, it can follow the evidence from the desk that reported the problem to the file server or domain controller where the cause is, and every command it ran is on the ticket for a senior tech to check. You can split your PCs into teams, such as Finance or HR, each with its own installer, devices and tickets.

The person who looks after the computers

You don't need to be an IT professional. If you're comfortable with a bit of Windows administration, ITAI tells you in plain language what it found and what each fix would do, with a risk rating and a rollback for every step. You still read and approve each fix, and installing needs admin rights on each PC. If you'd rather not, an MSP can run ITAI for you.

Common problems

Windows IT support for the tickets that fill the queue.

Describe the symptom the way a user would. ITAI gathers the evidence with read-only commands, names the cause, and proposes a fix for you to approve. These are examples, not a fixed menu.

Printers offline or stuck

Reads the Print Spooler service, the queue, the printer's port and driver, and the print service event log. A typical plan restarts the spooler or clears a stuck job.

Network drives and file shares

Checks the mapped drive, the PC's Workstation service, DNS and the route to the server. When the file server also runs ITAI and you add it to the ticket, it checks the server side too.

Slow PCs

Looks at CPU, memory and disk use by process, free disk space, startup programs and recent errors in the event log, then says which one looks like the bottleneck.

Windows Update failures

Reads installed updates, the update services and the event log entries for failed installs, and reports the error code alongside what it points to.

Outlook and Office issues

Checks Office crashes and application errors in the event log, whether the mail server resolves and answers, and machine-level causes like a full disk. Settings inside a mailbox or a Microsoft 365 tenant are beyond what a PC can see.

VPN connections

Reads the VPN profile, network adapters, routes and DNS, and tests whether the gateway answers, to separate a local configuration problem from a network one.

Account lockouts

Reads sign-in and lockout events on the PC and, when your domain controller runs ITAI, the lockout records there, to find the machine a stale password keeps coming from.

Features

Everything included, on every device.

Cross-device diagnosis

A login failure on a laptop is often a problem on the domain controller. When that machine also runs ITAI, ITAI can follow the evidence there, read-only. When you open a ticket, choose the other devices ITAI may also check, from the same organization (and the same site, if the PC has one). A fix on one of them needs its own approval, and only if your admins allow fixes on other devices.

Learns your environment

ITAI builds a network map as devices enroll and report in: which machine is the domain controller, the DNS and DHCP servers, the file and print servers (with what they share), and the gateway. Every new diagnosis starts from that map, so it heads straight for the right machine instead of rediscovering the layout each time. Everyone in your organization can see the map. An admin can add entries by hand or delete them; an entry ITAI found on its own comes back while a device still reports it. ITAI also lists other devices the PCs have seen on your network, from their own address and name caches and DHCP leases, without sending any probes.

Privilege you choose

Approved fixes run as the current user, a local admin, or SYSTEM. The highest level needs an explicit confirmation every time.

A full audit trail

Every command, its output, its exit code and its timing, recorded to the ticket. Each ticket also keeps a hash-chained audit record your admins can download.

Device inventory for free

Make, model, serial number, OS build, hardware and network identity are collected at install and refreshed every hour.

Made for MSPs

Separate organizations, each with its own installer and key. Rotate a key without breaking devices, and move a device between organizations with a full audit record.

Works with your RMM

Deploy ITAI with one script from your RMM tool. Its alerts can open tickets in ITAI on the PC they name, and ITAI posts findings and fix results back by signed webhook. Only your own admins set this up.

Tickets your team can share

Assign a ticket, set its priority, and see when it is due against your own targets. A bell in the dashboard tells each person when a ticket needs their review, a fix finished or a ticket was assigned to them.

A fleet that tidies itself

Devices that stop checking in are retired automatically after 30 days. An admin can restore a retired device in one click for at least 90 days, and a device that checks in again comes back by itself.

Security & privacy

An AI agent on your endpoints should be boring to audit.

ITAI's safety doesn't rest on the AI behaving well. The limits are enforced on the device, by code that sits between the AI and PowerShell. Our Security page has the detail, including what isn't done yet.

Your PCs never talk to the AI

The dashboard makes every AI call. The service on each PC only runs the commands its policy allows and reports back, so no PC holds anything that can call the AI or run up your AI bill on its own.

We don't train AI models on your data

ITAI does not use your tickets or device data to train AI models. Diagnoses run on our AI model provider's commercial service.

Kept separate from other customers

Every record belongs to one organization, and every request is checked against it. An automated test tries to cross from one customer to another on every route that can reach customer data.

Bring your own key Coming soon

Connect your own AI provider account, so diagnoses run under your own agreement with your provider and you pay device pricing only.

Allow-listed commandsInvestigation may only run commands on a read-only allow-list. Anything else is refused before it starts.

Constrained PowerShellInvestigation commands run in PowerShell's Constrained Language mode, which blocks the techniques scripts use to break out.

Contained processesEvery process a diagnosis starts runs inside a Windows job object and ends with it, and each command has a time limit.

Signed approvalsChanges need an approval signed with your organization's own key, covering those exact commands on that device, issued once and expiring five minutes after approval. The device holds only the public key, so it can check a signature but never forge one.

Locked transcriptEverything that ran is written to the ticket, where nothing in ITAI can edit it. It is removed only when its retention period ends or your account owner asks for your data to be deleted.

Compared

ITAI vs a traditional help desk or RMM.

A help desk is people working tickets by hand. An RMM tool monitors, patches and runs the scripts you give it. ITAI does the part in between: working out what's wrong, and proposing a fix you can check.

How ITAI compares with a traditional help desk and an RMM tool
Question	Traditional help desk	RMM tool	ITAI
Who investigates	A technician, by hand, often over a remote session.	Alerts point at a symptom; finding the cause is still manual, or a script someone wrote in advance.	The AI, one read-only command at a time, and a technician reviews the finding.
What can run while investigating	Whatever the technician types.	Whatever the script does, with the rights it was given.	Only commands on a read-only allow-list, enforced on the device.
How changes are made	The technician makes them directly.	Scripts and policies you deploy.	A plan with a risk rating and rollback per step, run only after a named technician's signed approval, and only once fixes are turned on for that client.
The record	The notes the technician writes up.	The logs your tool keeps.	Every command, its output and exit code, in a ticket transcript nothing in ITAI can edit.

ITAI works alongside the tools you already have. You can install ITAI with Group Policy, Intune or your RMM tool, let your RMM's alerts open tickets in ITAI, and get results back by webhook. A first HaloPSA connection is available, not yet tested against a live HaloPSA.

Pricing

A flat fee per machine, plus the AI you actually use.

Early-access pricing, in US dollars, for companies in the United States.

Managed

$1per device / month

Drops to $0.90/device over 50 devices, $0.75 over 100
Plus AI usage, at three times our cost for the AI model your organization uses
A monthly AI spend limit, $100 to start, that you can change
$5 / month minimum
Retired devices stop counting

Coming soon

Bring your own key

$1per device / month

Same device tiers, no usage charge from us
Connect your own AI provider account
Runs under your own provider agreement

Free for 30 days on your PCs. AI diagnoses use prepaid credit from $5. Add a card to keep going after 30 days. No device fees and no monthly minimum during the 30 days. AI is never free: it is taken from your prepaid credit at the normal price. Request early access

On the Managed plan you pay a per-device fee plus AI usage, billed at the rate of the model your organization uses. Every organization has a monthly AI spend limit, $100 to start, which your account's superadmin can change or remove. Bring your own key, when it is available, will charge the device fee only. ITAI is available to companies in the United States only, for now. How billing, cancelling and refunds work: Refunds and cancellation. A larger fleet: talk to us.

FAQ

Questions about ITAI.

What is ITAI?

ITAI is AI IT support for Windows PCs. It uses an AI model to do the investigative part of a technician's job: reading logs, services and settings to work out why something is broken. With ITAI, a technician opens a ticket for a Windows PC in the web dashboard, the AI diagnoses the problem by running read-only commands on that device, and it proposes a fix that a person approves before anything changes.

Is ITAI safe to use on business computers?

It depends on what the AI is allowed to do, and ITAI doesn't leave that to the AI. Investigation can only run commands on a read-only allow-list, checked on the device with PowerShell's own parser, in Constrained Language mode, inside a Windows job object. A change runs only after a named technician approves the exact command, and the device checks the approval's signature first. An admin can switch any client to diagnostics only, and every command and its output is recorded to the ticket.

Does ITAI fix problems automatically?

It diagnoses automatically, but it doesn't change anything on its own. ITAI proposes a fix in which every step shows the exact command, a risk rating and a rollback command. Nothing runs until a technician opens the step, reviews it and approves it, and you can approve all of the plan, some of it, or none.

Can the AI change my machines without me?

No. While it diagnoses, the device only runs commands that pass a read-only allow-list, checked on the device itself. A fix runs only after a named person opens each step, reviews the exact command and approves it. That approval is signed with a key unique to your organization, covers only those commands on that device, is issued once and expires five minutes after approval, and the device refuses anything it doesn't cover. An admin, or ITAI staff with a recorded reason, can also turn fixes off entirely for any client.

What if someone tries to trick the AI?

ITAI is built so that even a tricked AI can't change anything without a person's approval. The device enforces read-only diagnosis whatever the AI asks for, a separate AI check that sees none of the diagnosis compares each proposed step with its description and flags a mismatch, and nothing changes until a person approves the exact command. Text planted in a log, a file name or an event message may try to steer an AI, which is why these protections are built into the device and the approval, not left to the AI.

How much does IT support cost per device?

ITAI's Managed plan is $1 per device per month. Once a fleet passes 50 devices, every device drops to $0.90, and over 100 devices to $0.75. AI usage is billed on top of the device fee, at three times our cost for the AI model your organization uses, and every organization has a monthly AI spend limit, $100 to start. There is a $5 monthly minimum per account. Retired devices stop counting. These are early-access prices in US dollars.

Can an MSP use ITAI for multiple clients?

Yes. Each client is a separate organization with its own installer, key, devices and tickets, and every request is checked against the organization it belongs to. An MSP's client organizations can be grouped under one billing account, so the device tiers count the combined fleet rather than each client on its own.

Is ITAI available outside the United States?

Not yet. ITAI is available to companies in the United States only, for now, with prices in US dollars. If your company is elsewhere, write to support@itaibot.io, or leave your email on the sign-up page: we will write once when ITAI opens there, and send nothing else.

Does ITAI work on Mac or Linux?

Not yet. ITAI supports Windows 10, Windows 11 and Windows Server today. macOS and Linux agents are on the roadmap.

Is our data used to train AI models?

No. ITAI does not use your tickets or device data to train AI models. Diagnoses run on our AI model provider's commercial service. Every record belongs to one organization, and every request is checked against it.

What gets installed on each PC?

A small Windows service: ITAI on the PC. Once installed, it connects only to your dashboard, outbound over HTTPS, so no inbound firewall ports are needed. It never contacts the AI itself: the dashboard does that, and the service only runs the commands its policy allows and reports back. It needs Python 3.10 or newer, which the installer can set up from Microsoft's winget or python.org, and it downloads its Python packages from pypi.org.

Does ITAI replace our RMM or help desk software?

No. ITAI does the diagnosis and runs the fixes you approve, alongside your tools. You can deploy it with Group Policy, Intune or your RMM tool. Your RMM tool's alerts can open tickets in ITAI by webhook, and ITAI sends its findings back by webhook, to Slack or to Teams. Email alerts are on the roadmap. A first version of two-way sync with HaloPSA is available, not yet tested against a live HaloPSA.

On the roadmap

Where ITAI is going next.

What we plan to build, in no fixed order and without dates.

Alerting

Hear from ITAI when something on your fleet needs attention, not only when someone opens a ticket.

Integrations

Available now: webhooks so your RMM tool can open tickets in ITAI, results back by webhook, and a first version of two-way sync with HaloPSA, not yet tested against a live HaloPSA. Next: HaloPSA proven on live instances, and more PSA tools. Email alerts are on the roadmap.

Remote shell

A command line to a PC from the dashboard, for the steps you'd rather run yourself.

Cross-platform support

macOS and Linux agents alongside Windows.

Put ITAI on a machine that's giving you trouble.

Free for 30 days on your PCs. AI diagnoses use prepaid credit from $5. Add a card to keep going after 30 days. Questions first, or a larger fleet? Email support@itaibot.io.

Email support@itaibot.io

Documentation

Using ITAI

Everything you need to install ITAI, run your first diagnosis, and understand exactly what it can and can't do on your machines.

How ITAI fits together

ITAI has two parts. The dashboard is where your team opens tickets, reviews findings and approves fixes. ITAI on the PC is a small Windows service on each device: it checks in with the dashboard, runs the commands it's allowed to, and reports back.

A diagnosis is a conversation between the two. ITAI decides what to look at next, ITAI on the PC runs that one read-only command and returns the output, and this repeats until ITAI has a finding. Changes only happen after a person approves them.

Creating your account

Once sign-up is open, choose Create account on this site, or open app.itaibot.io/signup.html. Until then, choose Request early access. You give your name, your company, whether you manage IT for other companies (an MSP) or for your own company, and a work email address. Then:

Two-step sign-in. You set it up straight away, with an authenticator app on your phone.
Verify your email. We email you a link. Until you open it you can add PCs and open tickets, but AI diagnoses, adding funds and adding a card wait. The link lasts 24 hours; Resend the email is on the Devices page and under Billing.
Install ITAI on a Windows PC from the Install page (see below).
Turn on AI. Free for 30 days on your PCs. AI diagnoses use prepaid credit from $5. Add a card to keep going after 30 days. Add credit under Company settings, Billing.

MSPs: add each client as its own organization. Its PCs, tickets and people stay separate, and every organization is on your one bill.

To cancel, the account owner emails billing@itaibot.io. See Refunds and cancellation.

Requirements

A company in the United States. ITAI is available in the United States only, for now.
Windows 10 or 11, or Windows Server. macOS and Linux are on the roadmap.
Administrator rights on the device, to install the service.
Python 3.10 or newer, installed for all users. You don't need to install it first: if it's missing, the installer installs it (see below). It uses winget, or python.org's official installer where winget isn't available, such as on Windows Server 2019.
Outbound HTTPS from the device to your ITAI dashboard. ITAI on the PC only makes outbound connections, so no inbound firewall ports are needed. Installation also downloads Python from Microsoft's winget or python.org, and Python packages from pypi.org.

Installing ITAI

Open Install in the dashboard. Every organization has its own installer, and a device joins the organization whose installer it ran. Each download carries its own enrollment key, which adds PCs for 7 days; download again for later installs.

Option 1: one line of PowerShell

Copy the command from the Install page and paste it into PowerShell opened with Run as administrator. It looks like this, with your organization's own values filled in:

powershell -ExecutionPolicy Bypass -Command "& { ... install.ps1 ... -ApiKey '<your org key>' -BackendUrl 'https://<your dashboard>' }"

Option 2: the installer package

Download the installer from the Install page and run it on the device as an administrator. Use this where copying and pasting a command isn't practical.

Either way, the installer checks for Python, writes the device's configuration and starts the ITAIReceiver service. The device appears in your dashboard within a minute of the installer saying it is done.

If Python is missing, the installer lists what it needs and asks before installing it (press Enter for Yes; no answer within a minute also means Yes). Pushed from an RMM tool or run as SYSTEM, where nobody can answer, it installs Python for all users without asking and says so in its output. Python comes from winget, or from python.org's official installer, checked before it runs. If you manage Python yourself, add -NoPrereqs to the command: the installer then never installs Python, and stops with instructions if it's missing. A progress bar, and a percentage on the output line for each step, show how far along it is.

Mass deployment: both options run unattended, so you can push them with Group Policy, Intune or your RMM tool.

Windows warnings, antivirus, firewalls, or a PC that never appears: see Installer troubleshooting, the same page as Help in the dashboard.

Your first ticket

Open the device from Devices.
Under Open a ticket, describe the problem the way a user would report it, for example "Printer shows offline for everyone on the second floor".
Pick a privilege level. Local admin is the default and right for most problems.
Choose Open ticket. You can watch each command and its output arrive live.
When ITAI finishes, read the findings and the proposed fix, then approve what you're comfortable with.

Privilege levels

This is the one decision ITAI asks you to make on every ticket. It sets the account ITAI investigates and fixes things with on that device.

Level	Use it for	Notes
Current user	Problems in one person's profile: an app setting, a mapped drive, a browser.	Can't see system-wide settings or other users.
Local admin	Most problems: services, drivers, updates, disk, network.	The default.
Domain service account	Problems that need domain permissions.	Not available yet.
SYSTEM	Deep system problems that local admin can't reach.	The highest privilege on the device. Needs an explicit confirmation each time.

The privilege level is the account a fix you approve runs with. Investigation stays read-only at every level. From the next release of ITAI for your PCs (the one after version 1.0.0) every investigation step ITAI chooses runs with limited rights: no administrator rights and none of SYSTEM's access to files, and a check that would need full rights is not run; ITAI shows it for you to run instead. The exception is a short list of network, printer and disk status checks (network adapters, IP settings, routes, DNS client settings, connection tests, printers and print queues, disks, volumes and partitions), which runs with full rights. The checks ITAI runs after a fix use the same limited rights and the same list, so before and after compare like with like; only the check that a DNS record does not exist yet, before an approved fix adds it, runs with the fix's own rights. ITAI's own fixed inventory of the PC (hardware, network, disks and printers) still runs with the receiver's own rights. A PC still on version 1.0.0 investigates as the level you pick. On every version, local admin, which an approved fix can run as, has the same rights as SYSTEM.

Reviewing a proposed fix

A proposed fix is a list of steps. Each one shows the exact command, a risk rating, and a rollback command that undoes it.

Open a step to review it. Only a step you have opened can be ticked.
Approve selected steps runs only the steps you tick, in order.
Anything you don't approve never runs. You can close the ticket and fix it by hand instead.
Your approval is signed with your organization's key, covers only the commands you ticked on that device, is issued once and expires five minutes after approval. The device checks the signature against its copy of your organization's public key, and refuses any step that doesn't match.
A step marked Not independently checked is one the second AI check couldn't assess. Read its command yourself: approving it records that you saw the warning.
Fixes are on for a new client. If fixes are off for a client, the proposed fix can be read but not approved; an admin, or ITAI staff with a recorded reason, turns fixes on in Company settings.

Read the proposed fix before you approve it. ITAI explains its reasoning, but the approval is your decision and your record.

Ticket statuses

Status	Meaning
Queued	Waiting for the device to pick it up.
Running	ITAI is investigating.
Awaiting review	A finding and plan are ready for you.
Approved	Your approved steps are running.
Fixed, confirm with user	The approved fix ran and its checks passed. The ticket stays open until a technician checks with the user.
Resolved by ITAI	ITAI's fix worked, and a technician confirmed it with the user and closed the ticket.
Resolved manually	A technician fixed it and closed the ticket.
Self-resolved	The problem went away on its own.
No issues found	ITAI looked and found nothing wrong.
Unreachable	The device didn't respond.
Escalated	Needs a technician: ITAI couldn't reach a safe conclusion.
Restarting	An approved restart is under way; the fix carries on when the device is back.
Merged	Combined into another ticket. It stays readable on its own page.

Managing devices

Retiring and restoring

Retire a device you've replaced or decommissioned. It leaves the main list, stops counting toward per-device billing, and can't be targeted by tickets. Restore it at any time. Devices that stop checking in are retired automatically after 30 days, and one that checks in again comes back by itself.

Device profile

Each device reports its make, model, serial number, OS and build, hardware and network identity. It's refreshed every hour, and at the start of a diagnosis when it is more than ten minutes old.

Organizations & keys

Each organization has its own key, and every download from the Install page carries an enrollment key that adds PCs for 7 days. Devices installed with it belong to that organization.

An MSP's dashboard calls its organizations Clients. A company's calls them Teams, such as Finance or HR. Either way they work the same.

Rotating a key issues a new one. Devices already installed keep working on the old key for 24 hours while they pick up the new one, and every older installer stops adding PCs.
Unassigned devices land in a holding pool when they register with a deployment key, which ITAI staff issue for large rollouts. ITAI staff place them.
Moving a device between organizations is recorded with who moved it and why. ITAI flags a device whose domain or network looks like it belongs somewhere else.

Plans, models & caps

Your account's superadmin sets these under Company settings.

Setting	What it does
Device fee	A monthly fee per active device: $1, dropping to $0.90 over 50 devices and $0.75 over 100, with a $5 monthly minimum per account.
AI usage	On the Managed plan, your diagnoses' AI usage is billed on top of the device fee, at three times our cost for the model. A saved card is charged during the month as usage builds up (from $50). A new account is free for 30 days from sign-up: no device fees and no monthly minimum, and AI diagnoses use prepaid credit (from $5) or a card. After the 30 days a card is needed for new AI diagnoses and device fees start; any prepaid balance left is used first. With still no card 30 days after the trial ends, ITAI pauses everything but Billing until one is added. Bring your own AI key is coming soon.
AI model	Each organization's diagnoses run on one of the models ITAI approves for diagnosis, and usage is billed at that model's rate. Every organization diagnoses on the one that gave the most useful diagnoses in ITAI's own testing, unless someone has chosen another approved model. A superadmin can change it in Company settings, under Billing and usage. Support can also change it, and the setting always shows the model in use.
Monthly spend limit	The monthly AI usage at which ITAI pauses for an organization. Every organization starts at $100; your account's superadmin can change or remove it in Company settings. A diagnosis already running when it is reached may finish its current work (up to 8 more AI calls each, billed as usual). Then no new diagnosis starts and no new fix is approved or sent to a PC until the limit is raised or the month turns. A fix already on a PC finishes, restart included. Device fees aren't affected.
Per-ticket cap	An optional limit, in AI tokens, on how much one ticket may use. When a ticket goes past it, the diagnosis stops cleanly and tells you why.
Currency	All prices and charges are in US dollars. ITAI is available to companies in the United States only, for now.

Security model

ITAI's safety doesn't depend on the AI making good choices. Five layers on the device stand between the AI and PowerShell:

Allow-list. Investigation commands must match a read-only allow-list, or they're refused before they start.
Constrained Language mode. Investigation commands run in PowerShell's restricted language mode.
Process containment. Every process a diagnosis starts runs in a Windows job object and ends with it, and each command has a time limit.
Signed approvals. A change needs an approval signed by your dashboard. The device holds only the public key.
Locked transcript. Every command and its output is recorded to the ticket, where nothing in ITAI can edit it. It is removed only when its retention period ends or your account owner asks for your data to be deleted.

Around those layers:

Fixes on by default, and can be switched off. Fixes are on for a new organization, and each one still needs a person's signed approval. An admin, or ITAI staff with a recorded reason, can switch any organization to diagnostics only. Every change is recorded and shown in Company settings.
A second check. A separate AI call, with none of the diagnosis in its context, compares each proposed step with its description. Mismatches are flagged, and a step it couldn't check needs an explicit acknowledgement to approve.
Devices never contact the AI. The dashboard makes every AI call. Each device authenticates with its own credential.
Retention. Tickets and transcripts are deleted 90 days after their last activity, unless a legal hold requires keeping them. A slim audit record of who did what and when, with the commands run, is kept for 7 years. Admins can export your data at any time, and the account owner can ask for it to be deleted.

ITAI does not train AI models on your data. It's kept separate from other customers, with every request checked against your organization. The Security page has the full detail, including what isn't done yet.

Uninstalling

From the device page, choose Uninstall. For safety you type the device's hostname to confirm, and only admins can do it. ITAI on the PC stops and removes its service and install folder, the device is retired, and the uninstall is recorded with who confirmed it and when.

Installing ITAI on the same PC again

After an uninstall from the dashboard, run the Install page's command on that PC at any time. The device comes back to your list by itself.

If ITAI was removed on the PC itself instead, for example its folder deleted by hand, the dashboard doesn't know it is gone and still holds that PC's credential. A new install under the same organization is then refused, so that no other machine can take the PC's place. Open the device's page, click Reset credential, then run the install command again.

FAQ

Can ITAI change something without asking?

No. Investigation is limited to read-only commands on the device itself. Changes run only from a fix a person approved, and the device checks the approval's signature first. An admin, or ITAI staff with a recorded reason, can turn fixes off entirely for any organization.

What happens if the AI suggests something harmful?

During investigation it can't run it: the command isn't on the allow-list. In a plan, you'll see the exact command, its risk rating and its rollback before deciding.

Does ITAI need inbound network access?

No. ITAI on the PC only makes outbound HTTPS connections to your dashboard.

Which AI models can we use?

Each organization's diagnoses run on one of the models ITAI approves for diagnosis, billed at that model's rate. A new organization starts on the one that gave the most useful diagnoses in ITAI's own testing. A superadmin can move an organization to another approved model in Company settings, and so can support. Support for bringing your own AI provider account is coming.