Assessment at a fixed price — credited toward your pilot.
Example: AI gateway log
09:12
Translate a product description for the website
PublicCloud model
09:14
Summarize the supplier thread: [name], [phone]
InternalGateway, masking
09:15
Compare the terms of two supply contracts
SensitiveLocal model
09:17
Show the department’s payroll
SensitiveDenied: no access rights
Monthly cost limit34% used
An extension of your cybersecurity and cloud
Your staff already use AI, often through personal accounts and without any rules. SENSETI works in cybersecurity, cloud solutions and infrastructure, so we build AI security into the same setup. You get a policy, technical limits and a request log that work together.
When you need this
Staff are already sharing data with AI
Contracts, customer databases and reports end up in public services through personal accounts. Nobody in the company knows who shared what.
A ban didn’t work
AI access was blocked by an internal order, and people moved to their personal phones. Without an approved tool, a ban only hides the problem.
You process personal data of EU customers
You need to know where data is processed, what contract you have with the provider and what GDPR requires.
You’re planning an AI project
Access rights, logging and where the model runs are easier to settle before the pilot. Reworking a finished solution always takes longer.
43%43%
of security incidents studied by IBM involved shadow AI, meaning AI tools employees use without approval (up from 20% a year earlier).
We find out which AI services your staff already use, from which accounts and with what data. We report findings without assigning blame, so people speak openly.
AI use policy
Which tools are approved, which data must not be shared, who is accountable for the output and what to do if something goes wrong. Written in plain language, so people actually read it.
Data classification
We sort your data into public, internal and sensitive. For each class, we define where a model can run and who has access.
Access, logging and a model gateway
A single entry point to AI models with request logging, cost limits and masking. Access rights apply at the search stage, so AI won’t show an employee a document they aren’t allowed to see.
AI provider terms review
We read the contracts and data processing terms of the providers you use or are considering. Where data is stored, whether it may be used to train models, which region processes it. You get written conclusions before you sign.
GDPR and EU AI Act for EU companies
Processing region, provider contract and GDPR assessment. A list of EU AI Act requirements that apply to how you use AI, including staff AI literacy measures.
How we work
We look at how AI is already used in your company, what data you handle and whether you have EU customers.
What you get
Top-priority risks and a next step.
To move on
It’s clear which data and processes the assessment will cover.
Stage 1 of 5 · 60 minutes
Shadow AI audit, data classification and a review of the providers you use or plan to use. For EU companies, we add a list of GDPR and EU AI Act requirements.
What you get
A current-state report, a data map showing where the model runs, and a draft AI use policy.
To move on
You’ve approved the data classification and the list of permitted tools.
Stage 2 of 5 · about 2–3 weeks
We set up the model gateway, access rights, logging and masking for one process, and roll out the AI use policy to that process’s team.
What you get
A working setup with request logging and limits, and an approved policy.
To move on
The setup passes acceptance. Restricted data is blocked, the log is complete and the limits kick in.
Stage 3 of 5 · about 4–6 weeks
We bring other teams and processes into the secure setup and replace personal accounts with corporate access.
What you get
One secure setup for all of your company’s AI tools.
To move on
Every new team has been briefed on the AI use policy.
Stage 4 of 5 · after acceptance
We review the logs, update the policy for new tools and provider terms, and repeat the shadow AI audit.
What you get
A regular report on AI usage and incidents.
To move on
A repeat audit finds no new uncontrolled channels for data.
Stage 5 of 5 · ongoing
We look at how AI is already used in your company, what data you handle and whether you have EU customers.
What you get
Top-priority risks and a next step.
To move on
It’s clear which data and processes the assessment will cover.
Shadow AI audit, data classification and a review of the providers you use or plan to use. For EU companies, we add a list of GDPR and EU AI Act requirements.
What you get
A current-state report, a data map showing where the model runs, and a draft AI use policy.
To move on
You’ve approved the data classification and the list of permitted tools.
We set up the model gateway, access rights, logging and masking for one process, and roll out the AI use policy to that process’s team.
What you get
A working setup with request logging and limits, and an approved policy.
To move on
The setup passes acceptance. Restricted data is blocked, the log is complete and the limits kick in.
We bring other teams and processes into the secure setup and replace personal accounts with corporate access.
What you get
One secure setup for all of your company’s AI tools.
To move on
Every new team has been briefed on the AI use policy.
We review the logs, update the policy for new tools and provider terms, and repeat the shadow AI audit.
What you get
A regular report on AI usage and incidents.
To move on
A repeat audit finds no new uncontrolled channels for data.
Our approach
AI security is part of cybersecurity
We connect AI services to the same access controls, logs and rules as the rest of your infrastructure. You don’t need a separate security island for AI.
An approved tool instead of a ban
When people have a convenient corporate AI tool, personal accounts become unnecessary. A ban with no alternative just moves the leak where you can’t see it.
Limits built into the architecture
Instructions to the model won’t stop a malicious command hidden inside a document. Technical limits do: no write access, masking and human approval for any change.
Least-privilege access
AI sees only the data a task needs, and no more than the employee using it can see. Access is widened for a specific task and for a set period.
Where the model runs
Where a model runs depends on how sensitive the data is. We classify your data together during the assessment and review each provider’s terms separately.
Data
Where it runs
Why
Public: website copy, open documents, general questions
Cloud models
Disclosure doesn’t harm the business, so quality and cost matter most.
Internal: procedures, correspondence, reports without personal data
Cloud models through a gateway with logging, masking and business terms
Every request is logged, unnecessary details are masked, and the provider contract sets how data is handled.
Sensitive: personal data, trade secrets
Private cloud or local on-prem models
Data stays inside a perimeter you control. For EU companies, we also check the processing region and the GDPR contract.
What you get
Shadow AI report
Which services are in use, by whom, with what data and what risks.
AI use policy
A ready-to-use document for staff listing approved tools and data.
Data classification map
Data classes, where the model runs for each class, and who is responsible.
Configured model gateway
A single entry point with request logging, cost limits and masking.
Provider terms findings
A written assessment of the contracts and data processing terms of your chosen AI providers.
Plan for EU companies
What GDPR and the EU AI Act require for your use of AI, what’s already done and what’s left.
Security in our projects
Trading company, EU (import and distribution)
In progress
Task
Let AI work with a customized business system without putting live data at risk. An earlier attempt to feed the configuration to AI as a flat folder produced made-up answers.
What we did
AI works only with isolated copies and has read-only access to live systems. Automated checks catch invented commands.
Result: Acceptance was defined before the start: 8 blind tests, including a trap for made-up answers that must be passed 5 out of 5 with no partial credit.
SENSETI, built for ourselves
Trial operation
Task
Run an AI content pipeline with costs and actions under control.
What we did
Model requests go through a gateway with a $100 monthly budget cap. A dry run before launch and manual approval before anything is published.
Result: Actual spend of about $9 a month.
Find out where your data is already going
In a free 60-minute consultation, we’ll look at how your team already uses AI and decide what the assessment should check first.
It’s AI services that staff use without approval, often through personal accounts. The company doesn’t know what data went there or on what terms it’s processed.
Usually not. People switch to personal devices, and the company loses even the visibility it had. A safer route is an approved tool with logging and clear rules.
No. Zero data retention at the provider doesn’t mean the data is processed in the EU. EU companies need the right processing region, a contract with the provider and a GDPR assessment.
When AI works with sensitive data such as personal data or trade secrets. In that case, we deploy the model in a private cloud or on your own on-prem servers. For public and internal data, cloud models through a gateway are usually enough.
If your company operates in the EU market, some requirements may apply, for example on staff AI literacy. During the assessment, we list the requirements relevant to how you use AI, and a lawyer gives the final legal opinion.
It’s a single entry point to all models. It logs every request, masks data according to your rules, enforces cost limits and lets you pick the right model for each task.
The AI use policy names the people responsible. We can support the setup going forward: reviewing logs, updating the policy and repeating the shadow AI audit.
