AI for Security · Solutions

Know where sensitive data sits, who opens it and which rules it breaks.

It does not certify compliance. Each field and file gets a proposed sensitivity label, the system shows who opened what, and real use is compared with your written retention and access policy. A reviewer reads every flag. Whether any standard or law is met stays with your own lawyer or security adviser, who work from the lists the system prepares.

Share your requirements

What it is

Customer phone numbers, staff bank details and scanned identity papers end up in old exports, shared drives and helpdesk attachments that nobody listed. The policy says one thing. The folders say another.

The software reads field names, sample values and file types from your own systems and shared drives, then proposes a label for each one. A person decides each one. Odd cases go to a review list.

Where it goes wrong today

The problems this is meant to ease.

Nobody can list where personal data lives

Copies keep spreading. An old export, a sales sheet and the helpdesk each hold customer details, so a customer who asks what you keep gets an answer reconstructed from memory.

Access that nobody reviews

Permissions only ever grow. Staff change roles, interns get a shared login and a folder opened for one project stays open for years, because no one looks at who can read what.

Retention periods that exist only on paper

The rule is written. Scanned identity papers and old payroll sheets sit in shared folders long after the period your policy names, because nobody owns the job of listing what has expired.

Records an auditor asks for are missing

Evidence is often thin. Who approved an export, who changed a permission and why a copy exists are questions an auditor asks, and the answers sit in mail threads and one manager’s memory.

Policies nobody turns into checks

A policy needs an owner. Written rules about exports, sharing and deletion stay in a document, so a breach of them is found by accident, usually when something has already gone wrong.

Inside the module

What AI data governance and compliance does.

Discovery across your systems

It lists what it finds. Table columns, attachments and mail archives you connect are scanned for names, numbers and identity papers, and each place found is added to an inventory a person can read.

Labels a person confirms

Every label is a suggestion. Fields and files get a proposed class such as public, internal, personal or restricted, and the data owner accepts or changes each one before it is stored.

Who opens what

Access is made visible. Reads, exports and permission changes from your drives, CRM and helpdesk are gathered by user and role, so a restricted file opened by an unusual role shows up.

Retention and lifecycle reminders

Nothing is deleted by the software. Records past the period you chose are listed for a person to decide on, with the owner, the last use and the reason the period was set.

Policy exceptions and gaps

Gaps are listed too. Your written rules become plain checks, and a missing owner, a missing retention date or an unrecorded approval is flagged as a gap in the governance record for review.

Lineage and audit log

Every step leaves a trace. Where a field came from, which report or export it feeds and who changed its label are recorded in an audit log, so a reviewer can follow one value.

Review workflow and specialist check

Specialists make the final call. Open flags move through assign, review and close steps, and the counts and history go to your lawyer, auditor or security adviser, who decide what any standard requires.

Where it gets used

What this looks like in a working week.

A clinic with patient letters

A clinic finds patient referral letters in a shared scanning folder and staff mail, labels them restricted, and lists who opened them for the practice manager to review. The manager decides what changes.

An accounting firm with client folders

Client tax papers sit in project folders opened to every employee, so the firm labels them, compares access with its own rule, and lists folders with too many readers. Partners decide who keeps access.

A college with student records

A college holds student records in the admissions sheet, the exam office files and an old mail archive, and the inventory shows which fields repeat in all three. The registrar retires extra copies.

A distributor exporting its customer list

A wholesale distributor exports its customer list for a marketing agency each quarter, and the access log shows who exported it, when, and whether the export was ever approved. Missing approvals become a flag.

A credit union answering a member

When a member asks a credit union for a copy of their data, the system lists every place the member appears and the compliance officer writes the reply. Nothing leaves without that officer’s approval.

Who touches it

The people who open this every day.

Data protection lead or office manager

Works the flag list each week. Every decision is written down with its reason, so the next audit finds a trail where there would otherwise be a blank page and a long search.

IT administrator

Fixes the folder permissions. Folders shown by the labels to be open to more people than the policy allows are closed, and old exports with personal data are retired once the owner agrees.

Owner or director

Signs each retention batch. A short weekly list of open flags comes to the owner, and no batch of old records is removed from any system before the owner has approved it.

External auditor or lawyer

Reads the review history. Label counts, review notes and the audit log arrive in a form they can work from, and the conclusions about any standard or law are theirs alone to draw.

How it is set up

From first conversation to daily use.

Map the systems
Start with a map. The data lead lists your systems, shared drives, mail archives and the written policy, and names an owner for each system and an approver for labels and retention.
Make the data readable
Check what can be read. Exports and read access are arranged for the drives, the CRM and the helpdesk, and the policy is split into checks short enough for a manager to read.
Trial on one system
Try it on one system. One system, often the helpdesk or the customer sheet, is scanned first, and the proposed labels are compared with the labels the data owner would have chosen by hand.
Check with the data owners
The owners review it. Data owners and the reviewer work through the first flags, marking each as fine, fixed or wrong, and the wrong ones are used to adjust how columns are read.
Go live with named reviewers
Switch on the routine. The weekly flag list, the retention batch review and the access report go to named people, and your lawyer or security adviser confirms which rules the checks follow.
Review after a quarter
Look back after a quarter. At quarter end the data lead reviews flags closed as fine, label corrections and gaps still open, and the policy checks are reread for rule errors.

Measuring it

How you would know it is working.

Record where you stand before it goes live, so the change is measured against your own figures.

Classification coverage is the share of known fields and files that carry a confirmed label, counted from the inventory taken in the first week before any labelling started.
Policy exception resolution is the number of flags closed with a reviewer note against the number raised, and the baseline is the open exception list kept before go-live.
Audit readiness counts how many records an auditor asks for, like label history and access logs, can be produced from the system, against the baseline of the last audit.
Review workload counts the flags waiting for a reviewer each week, set against the same count in the first week after the scan, before any rule was tuned.

Used responsibly

Where a person stays in charge.

Supports governance, certifies nothing

No certificate comes from this. Labels, counts and review history are prepared here, but compliance with any standard or law is not certified, because only a qualified assessor can do that.

A person approves every label and deletion

Suggestions wait for a person. Labels, retention batches and replies to access requests stay as drafts until the named owner approves them, and the software deletes, moves or sends nothing on its own.

The review list is private

Flags name real people. Because a flag names a user, access to the review list is limited to the data lead and the director, and samples are read only to label fields.

Coverage has limits

Odd columns will be missed. Oddly named columns, scanned images with poor print and data held in systems that give no log can be missed or mislabelled, so coverage states what was not reached.

Rules vary by place

Law is not built in. Retention periods and consent rules change from one country to another, so your own lawyer or accountant sets them, and nothing here counts as legal, tax or security advice.

How it fits

It is one part of a system, not an island.

A module earns its place by what it passes to the next one. These are the connections we set up most often.

Document management
Roles and permissions
Audit trail
Your CRM and helpdesk exports
Shared drives and mail archives

Already built in

Products that include it.

Expense Management Software

Built for you

How we would put it in.

Common questions

Questions owners ask about AI data governance and compliance.

Does this make us compliant with data protection rules?

No, it does not. It prepares labels, counts and review history for your lawyer or accountant, and legal duties vary with where you operate, so what counts as enough is their decision.

How often will the labels be wrong?

Sometimes. Oddly named columns such as one called notes2 are the usual trouble, so every label stays a suggestion until a person accepts it. Early weeks bring many corrections. Each correction teaches the classifier your team’s naming habits, so later weeks bring fewer items to the review list for the data lead.

What has to be in place first?

A rough written policy will do. A named person must own it, because rules nobody owns are rules nobody checks and the flag list only grows without end. Read access to the drives, the CRM and the helpdesk logs is also needed, and it is arranged in advance with whoever administers each system.

When is this not worth setting up?

Sometimes a checklist wins. If one person keeps all records in one tidy system and knows every place the data goes, a checklist does the job and this adds nothing. Look again once copies spread.

What does it connect to?

It reads what you already run. Drives, mail archives, your CRM and the helpdesk are the usual sources, and each needs read access or an export that your administrator sets up for it. No log means no access view.

Who approves what the system proposes?

Only people approve anything. Owners accept each label, the director signs each retention batch, and the reviewer closes each flag with a note that stays on the record.

What effort and cost should we expect?

Mostly your time at the start. The first load needs a policy owner, a few review sessions with data owners and read access to your systems, and the price rises with each system added.

Who needs it most

Businesses that ask for this.

Next to it

Modules that work with it.

Talk to us

Tell us how you handle AI data governance and compliance today.

A spreadsheet, a register or another system: say which, and we will tell you plainly what is worth changing.

No obligation
A reply within one business day
Your details stay private

Start with your requirements

Seven short steps that tell us what you need. An engineer reads them before getting in touch.