CENSUSSEN-sus
Shadow AI Review
The Roman census counted every household and what it held. Our review does the same for AI: every tool in use, what data reaches it, and what the vendor may do with it.
Find out which AI tools your staff use, and what company data goes with them.
$2,500, fixed, for organizations up to 500 staff. Larger organizations are quoted. No access to your production systems is required.
Findings cover what was reviewed within the agreed scope. A review cannot show that no data has left the company.
Preparing your data for your own AI, or for licensing? Sophrono’s Data Protection & Readiness covers rights and readiness.
Is this for you?
- Leaders who suspect staff paste company data into AI tools, and want to know how much and where
- Companies writing an AI use policy that should rest on facts, not guesses
- Teams answering customer or auditor questions about AI and data handling
The problem
Your staff adopted AI faster than your policies did.
Most staff now use AI tools at work: chat assistants, meeting recorders, writing and coding tools, and AI features switched on inside software you already pay for. Many signed up with a work email and a personal plan.
Each tool receives some company data. Some vendors keep it, and some may use it to train their models. Without an inventory, nobody can say which data went where.
How we work
An inventory first, then the data, then the terms.
We combine what your systems show (identity provider, office suite, expense and app records, and any network data you choose to share) with a short, no-blame staff survey. Together they find tools that neither would find alone.
For each tool, we map the kinds of data reaching it and read the vendor’s terms on retention, training, and processing location. Findings are rated by likelihood and impact, each with a specific fix.
When clients book it
Typical reasons for a review.
Common situations, not past client work.
- Policy
Before writing an AI policy
Base the policy on the tools people actually use.
- Customers
A customer questionnaire
Answer “how do you govern AI?” with evidence.
- Insurance
A cyber insurance renewal
Show insurers how AI tool use is managed.
- Incident
After a near miss
Find out how far a single paste could have gone.
- Regulated data
Health, financial, or legal data
Check that regulated data stays out of unapproved tools.
- Rollout
Before an AI rollout
Know the starting point before approving new tools.
What you receive
An AI tool inventory
Every AI tool and AI feature in use, from browser chatbots to AI inside the software you already pay for.
A data exposure map
Which kinds of company data reach each tool: customer, financial, personal, source code, or confidential plans.
A vendor terms summary
For each tool, what the vendor’s terms say about retention, training on your data, and where data is processed.
A prioritized findings report
Each finding rated by likelihood and impact, with a specific fix, and a one-hour readout with your team.
How it works
Kickoff
A 30-minute call agrees the scope, the contacts, and the evidence we may review.
Discover
Admin consoles, expense and app records, and network or browser data you choose to share.
Survey
A short, no-blame staff survey on which tools people use and for what.
Report
Findings rated and prioritized, with a fix for each, then a one-hour readout.
What the report contains
Findings your team can work from.
Every item is backed by the evidence that produced it.
- Tools found
- Every AI tool and feature in use, with how widely it is used.
- Data reaching each tool
- The categories of company data involved.
- Vendor terms
- Retention, training, and processing location for each tool.
- Prioritized fixes
- Each finding rated, with a specific fix and an owner.
Common concerns
What leaders ask before they sign.
- Staff trust
- The survey is no-blame and reported in aggregate.
- Access
- Read-only access you choose to share. No installed software.
- Limits
- The review reports what it finds within scope. It cannot show that no data has left the company.
Who does what
Who authorizes, who tests, and who fixes.
Your team
- Agree the scope and sources
- Share read-only access
- Send the staff survey
- Decide which fixes to make
Custos
- Run discovery and the survey
- Map data and read vendor terms
- Rate findings and write fixes
- Lead the readout
Afterward
Where clients go next.
Most take one of these routes. You choose, and nothing starts without your approval.
Write the policy
AI Policy & Controls turns the findings into a policy and enforced settings.
Keep watch
Monitoring catches new tools and changed settings each month.
Fix it yourselves
Every finding has a fix your team can make without us.
Before you start
What to have ready.
- Your identity provider and office suite admin contacts
- Expense or app records you can share
- Who will send the staff survey
- Any customer or audit questions to answer
Related services
Shadow AI Review · $2,500
Start the review. About two weeks to a findings report.
Tell us about your organization. We reply with an engagement letter and a kickoff date, then agree the scope and the evidence we may review.
What it includes
- A 30-minute kickoff to agree scope, contacts, and sources
- An inventory of AI tools and AI features in use
- A map of the company data reaching each tool, and the vendor terms that apply
- A prioritized findings report and a one-hour readout
No production system access and no installed software.
Each engagement is confirmed by a written engagement letter. Testing of any system happens only under a signed authorization and rules of engagement.
What is included
Fixed scope, agreed at kickoff.
- The scope, sources, and contacts are agreed in writing at kickoff.
- The report lists every AI tool found, the data reaching it, and the vendor terms that apply.
- Each finding has a rating, the evidence behind it, and a specific fix.
- A one-hour readout walks your team through the findings and the order to fix them.
Where this fits
- Check Shadow AI check
- Review Shadow AI Review
- Control AI Policy & Controls
- Monitor AI Security Monitoring
Not ready yet? Shadow AI check. After this: AI Policy & Controls or AI Security Monitoring.
Questions
Do you need access to our systems?
Read-only access to admin consoles you choose to share, such as your identity provider or office suite. No production system access, and no installed software.
Will staff get in trouble?
The survey is no-blame and reported in aggregate. The goal is to find exposure, not people.
Is this a compliance audit?
No. It is a technical review of AI tool use and data exposure. It can inform a compliance program, but it does not certify one.
How is it paid for?
You request it here, and we reply with an engagement letter. Payment is by invoice after you sign it. No payment is taken on the website.