Who it’s for

Whoever answers for AI at work.

IT approves the tools. Compliance writes the rules. Everyone else uses AI every day. One workspace serves each of them.

IT and security leads

People use AI tools you never approved, and you hear about it last.

Keep one register of the tools you allow, what each is for and which data it may see. Everyone can look it up before they start.

  • Approved, restricted or under review
  • Allowed data per tool
  • Reviews flagged when they come due

The AI tool register

AI tools: three tools in the register: one approved, one restricted, one under review that becomes approved

Compliance and privacy

You wrote an AI policy. You cannot show who read it.

Publish it as a version nobody can edit. Each person agrees to that exact text, and a new version asks everyone again.

  • Version, text hash and statement kept with each agreement
  • Agreements as CSV for an audit
  • An activity trail that shows any change

Policies and agreements

Policy: version 3 of Using AI tools at work; 18 of 24 people have agreed, then 19

Everyone who uses AI tools

You want help from an AI tool, but the text has a key or a customer’s details in it.

Paste it into the scanner first. It points to what looks sensitive, masked, so you can take it out. The text stays in your browser.

  • Keys, tokens, card numbers, Aadhaar, PAN, emails and phone numbers
  • Your company’s own confidential terms
  • Nothing to install

The scanner

Scanner results: three findings, each masked, with a Save summary button that saves counts only

Founders and team leads

AI is in every team now, and nobody owns the risks.

Write each risk down with an owner, a score and a due date. Alerts tell the owner when it is overdue.

  • Likelihood times impact, shown with its parts
  • Notes and history on every risk
  • Try it for 7 days

The risk register

Risk: a risk scored 3 times 4, high, being mitigated by its owner

Auditors

You are asked to trust a record that anyone could have edited.

Each activity record seals the one before. The Activity page checks the chain, and the export carries every hash.

  • A read-only auditor role
  • Saved scan summaries as CSV, never the text
  • Downloads recorded too

Roles and activity

Activity: three records in the activity trail and a check that none was changed or removed

Use AI with your eyes open.