Find out where your prompts actually go
A technical inventory of every AI tool your staff use, where each one processes prompts, and which uses conflict with the data rules that apply to you.
Overview
Staff paste customer data into chat assistants, browser plugins and AI features inside tools you already pay for. Each one sends prompts to a data centre somewhere. Most companies cannot say where, or under which terms.
We build the inventory, trace where prompts are processed and stored, and map each use against the rules that apply to you. In the UAE that can include Federal Law No. 2 of 2019, Article 13, for health data, DIFC Data Protection Regulation 10 on autonomous systems, in force since 1 January 2026, and the Central Bank of the UAE guidance on AI from February 2026. For European clients we map against GDPR and the EU AI Act. We are engineers, not lawyers: we give your legal adviser the technical facts they need.
Signs you need this
- You have an AI usage policy but no list of the tools people actually use
- A regulator, auditor or enterprise customer has asked where your AI processing happens
- SaaS vendors have switched on AI features and you have not checked their processing regions
- Legal counsel needs technical answers your team has not had time to gather
What you get
- AI tool inventory
- Every AI service found through SSO logs, browser extension reports, expense records, DNS data and staff interviews.
- Data flow map
- For each tool, what data goes in, where it is processed and stored, whether it is used for training, and under which contract terms.
- Rule mapping
- A table linking each data flow to the provisions that may apply, marked for review by your legal adviser.
- Risk register
- Issues ranked by data sensitivity and exposure, each with a technical fix such as a regional endpoint, a block or a contract change.
- Technical controls plan
- Concrete steps such as DNS or proxy blocks, approved tool lists, tenant settings and logging for the tools you keep.
How the work runs
- 1
Discovery
1 to 2 weeks
We pull identity, network and expense data and interview team leads to find every AI tool in use.
- 2
Tracing
1 to 2 weeks
We check vendor documentation, data processing terms and tenant settings to confirm processing regions and retention.
- 3
Mapping and report
1 to 2 weeks
We map flows to the relevant rules, rank risks and present findings to your technical and legal leads together.
Timings depend on the size of your estate. The assessment fixes them before any build starts.
What you can check afterwards
- A written inventory lists every AI tool found, its owner and its processing region
- Each high-risk data flow has a named fix and an owner
- Your legal adviser has a technical brief to base their opinion on
- Blocked or unapproved tools no longer appear in network or identity logs after controls go live
Tools we work with
- Microsoft Entra ID
- Google Workspace admin
- Microsoft Purview
- Cloudflare Gateway
- Zscaler
- AWS CloudTrail
- Azure Monitor
- Google Cloud Audit Logs
Questions buyers ask
- Is this legal advice?
- No. We establish the technical facts: which tools, which data, which regions. Your lawyer decides what the rules require.
- Do you need to read our staff's prompts?
- No. We work from metadata such as sign-in logs, domains contacted and vendor settings. Where content matters, we ask teams to describe the data they use.
- What access do you need?
- Read-only admin access to your identity provider, productivity suite and network or proxy logs, plus time with a few team leads.
- What happens after the assessment?
- You get a prioritised fix list. Your team can carry it out, or we can help with the technical parts such as regional endpoints or private model hosting.
Talk to us about AI data residency assessment.
Tell us what you run and where. We reply within one business day with questions or a quote.