Find where your company data is leaking into AI tools
A remote review of the AI tools your staff really use, what data can reach them, and how ChatGPT, Copilot and Gemini are configured. You get a prioritized fix list and a 1 hour readout.
- 1 to 2 weeks
- 60 min Google Meet readout
- 100% remote, Canada-wide
Policies describe what people should do. An audit shows what is actually happening. In many small businesses, staff use personal ChatGPT accounts, browser extensions with AI features, and AI assistants switched on inside email and office suites, all without anyone reviewing the settings or permissions behind them.
This audit is a focused, read-only look at that reality. We build an inventory of AI tools in use, review how your main platforms are configured, check what internal data an AI assistant could surface, and give you a short, ranked list of fixes you can act on right away.
What you get
Shadow-AI inventory
A register of AI tools and AI-enabled extensions found through admin consoles, browser and app lists, and a short staff questionnaire, with who uses what and on which account type.
ChatGPT exposure review
Review of how ChatGPT is used in your business: personal versus business accounts, data controls and training settings, and what kinds of information staff report pasting in.
Microsoft Copilot exposure review
Review of Microsoft 365 permissions, sharing and labelling that determine what Copilot can find and summarize, including overshared files and broad SharePoint or OneDrive access.
Google Gemini exposure review
Equivalent review for Google Workspace: sharing settings, Drive visibility and Gemini configuration, where you use it.
Prioritized fix list
A ranked list of fixes with effort and impact for each, written so your IT contact or provider can act on it, or so we can quote the work.
60 minute readout
A Google Meet session with you and your lead to walk through findings, answer questions and agree on first actions.
Who it is for
Businesses with about 5 to 50 staff that use Microsoft 365 or Google Workspace and suspect AI use is ahead of their rules.
- Accounting, legal and consulting firms where client files must stay confidential
- Clinics and practices that handle personal and health-related information
- Engineering, architecture and construction offices sharing drawings and contracts
- Owners who bought Copilot or Gemini licences and want to be sure of what it can see
- Companies preparing for a client questionnaire, an insurer review or an internal board question about AI
How it works
1. Pay online
Add the audit to your cart and pay. You receive a secure intake form and a scheduling link.
2. Secure intake
You grant read-only access to the admin views we need, or export the reports for us. NDA on request. We never ask for passwords by email and we do not store your clients' personal data.
3. We audit
We run the inventory, review the configurations and test what an assistant can reach, usually within 1 to 2 weeks.
4. Readout
We deliver the written findings and fix list, and walk through them in a 60 minute Meet session.
Scope and limits
- This is a risk review, not a penetration test, forensic investigation or compliance certification. We do not claim your business is compliant with any law or standard.
- We can only assess what is visible through the access you grant and the information your team shares. Tools used on personal devices outside your control may not be fully visible.
- We do not read the content of your staff's conversations or documents. Access is read-only and focused on settings, permissions and metadata.
- The fix list recommends actions. Implementation is not included, but we can quote it separately.
- Findings reflect the situation on the audit dates. AI products change quickly, so settings should be reviewed again over time.
Why audit before you enable more AI
Assistants such as Copilot and Gemini work with the permissions your files already have. If a folder was shared too widely years ago, an assistant can surface its contents in a helpful summary for someone who was never meant to see it. The problem is not the assistant itself, it is the old sharing that nobody reviewed.
Reviewing exposure first lets you fix the sharing and settings, then roll out AI with confidence. It also gives you a record of what you checked and when, which is useful when a client, insurer or partner asks how you manage AI risk. We keep the audit narrow and practical so you finish with a list of actions, not a binder.
Pricing
AI Data-Leak Risk Audit
- Shadow-AI inventory
- ChatGPT, Copilot and Gemini exposure review
- Prioritized fix list
- 60 min Meet readout
- 1 to 2 weeks from intake
Fixed price, no subscription. Taxes are added at checkout. Remediation work, if you want us to do it, is quoted separately after the readout.
Questions and answers
What is shadow AI?
What access do you need?
Will you read our employees' chats and files?
Do we need Copilot or Gemini licences for the audit to be useful?
Does the audit make us compliant?
Can you fix the issues you find?
Related services and reading
Related reading : Shadow AI: the hidden risk of unapproved tools · Microsoft Copilot for business: a practical guide · AI browser extensions: security risks
See what your AI tools can reach before someone else asks
Add the audit to your cart, or call us if you want to talk it through first.