Skip to content
Custosby SophronoAsk an engineer
Menu
Ask a security engineer

Free tool · five minutes

Where does your data go when your staff use AI?

Ten questions on which AI tools your staff use, what the vendors may do with your data, how access is controlled, and how the AI you build is tested. Scored in your browser.

Ask a security engineer

The check

Answer for your organization.

“Partly or unsure” is a fine answer. If you do not build AI, answer the last two Yes.

  1. 01 Do you know which AI tools your staff use for work, including free ones?
  2. 02 Do you know which AI features are switched on inside the software you already pay for?
  3. 03 Is there a written policy on which data staff may put into AI tools?
  4. 04 Do staff have an approved AI tool on a business account, so they need not use personal ones?
  5. 05 For the AI tools you pay for, is training on your data switched off?
  6. 06 Do you know how long each AI vendor keeps your data, and where it is processed?
  7. 07 Do staff sign in to approved AI tools through your company identity provider?
  8. 08 Would you know what to do if confidential data were pasted into a public AI tool?
  9. 09 If you build AI features or chatbots, have they been tested against prompt injection and data leakage?
  10. 10 If your AI can take actions or read sensitive data, are those permissions limited and logged?

Answer all ten questions. Your answers stay in your browser.

How the score works

Yes scores 2, Partly or unsure scores 1, and No scores 0. If you do not build AI, answer the last two Yes.

16–20 Well covered
The basics are in place. Monitoring catches new tools and changed settings as they appear.
10–15 Partly covered
Some controls exist, but there are gaps in inventory, policy, or vendor settings. A shadow AI review finds them with evidence.
0–9 Exposed
Staff AI use is largely unmanaged. Start with an inventory of tools and the data reaching them.

The check reflects your answers only. It does not inspect any tool or system, and it is not an assessment.

Your next actions list every No first, then every Partly, in question order.

After your score

What usually comes next.

  • This week: turn off training on your data in every AI tool you pay for
  • No inventory: survey staff, no blame, on the AI tools they use
  • No policy: write one page on approved tools and data that never goes in
  • Want facts, not guesses: the $2,500 Shadow AI Review
  • You build AI: scope a red-team assessment before the next release

Find out where your data goes when your staff use AI.

Ask a security engineerStart a shadow AI review · $2,500

Book a time