What is included

A new area with clear risks: leakage through prompts, dependence on an external service and responsibility for the data.

Discuss the scope

Survey of current use

We find out which services staff already use and what ends up in them.

Usage policy

What may be sent, what may not, which services are permitted. A clear document rather than a blanket ban.

Anonymisation

Automatic removal of personal data from prompts before they are sent to an external service.

Local deployment

A model inside your own network for cases where the data must not leave at all.

Contracts

Formalising the relationship with the service provider, including a personal data processing agreement.

Logging

What was sent and what came back. Needed both for troubleshooting and for inspections.

How the work runs

We start with a picture of reality: bans without an alternative do not work, people simply stop mentioning what they do.

01

Survey

We look at the network traffic and interview the departments. Usually it turns out that more is being used than anyone thought.

02

Rules

We prepare the policy and explain it with examples rather than in general terms.

03

A safe alternative

We provide an approved tool: corporate access to a service or a local model.

04

Control

Logging, periodic review, updating the list of approved services.

Under the data protection law the responsibility for the data stays with you even when an external service processes it. An employee who pastes a spreadsheet of client surnames into a chatbot has formally created a cross border transfer of personal data. This is the case where the policy is needed before the technical measures.

Frequently asked questions

A ban without an alternative leads to staff using these services from personal devices, and you lose even the visibility of what is happening. What works is an approved tool plus clear rules about what may be sent to it.

Entirely realistic. Modern open models run on a single server with a graphics card and give acceptable quality for typical tasks such as summarising text, searching documents and helping with correspondence. The data never leaves your network.

By surveying the network traffic: requests to known services, their frequency and their volume are visible. The content of the prompts is not read, but the scale of use becomes clear.

Let us discuss safe use of AI

Tell us which tasks you want to cover and how sensitive the data is. We will propose an approach, from a policy to a local model.