ServicesCompliance controls for AI in use
Controls for the AI your teams already use
Your staff already paste customer records, contracts and code into AI tools. We put controls in between: personal data masked before it leaves, approved models only, access by role, and a log your DPO can read.
- Works with the tools staff already use
- Runs in your environment
- Evidence your auditor can review
typed by the user
Draft a reply to Maria Keller about her refund. Her account is DE89 3704 0044 0532 0130 00 and she was born 14.03.1981.
sent to the model
Draft a reply to [PERSON_1] about her refund. Her account is [IBAN_1] and she was born [DATE_1].
The controls
Configured to your policies and the laws you fall under.
Detection and masking
Names, identifiers, account and card numbers, health details, secrets and source code detected in prompts and files, then replaced with placeholders that are swapped back in the answer.
Policies by law and by team
Rules such as "health data only to the private model" or "no customer data to consumer tools", set per team, per data category and per jurisdiction.
Approved models
A short list of models and vendors you've reviewed, with unapproved AI services blocked or redirected through your proxy or identity provider.
Access by role
Single sign-on through your identity provider, so access follows the joiner, mover and leaver process you already run.
Audit log
Who sent what kind of request, when, to which model, which policy applied and what was masked, without keeping the sensitive values themselves.
Retention and deletion
Prompts, outputs and logs kept for the period you set. Vendor retention and training settings checked and configured to match.
What happens to one prompt
staff member
your gateway
GDPR Art. 32
GDPR Art. 30
approved model
back to the user
The placeholders and the real values they stand for never leave your environment. The log records what was masked, not the values.
How the controls map to the rules
The most common ones. We map to other laws and frameworks too.
| Rule | What it expects of AI use | References |
|---|---|---|
| GDPR and UK GDPR | Only the personal data the purpose needs, protected by design, recorded in your processing records, and transferred abroad only with safeguards. | Art. 5(1)(c)Art. 25Art. 30Art. 32Art. 35Art. 44 |
| HIPAA | The minimum necessary PHI, unique user IDs, access controls, audit controls, and a business associate agreement with any vendor that receives PHI. | §164.502(b)§164.312(a)§164.312(b)§164.308(b) |
| EU AI Act | AI literacy for staff, human oversight and log keeping for high-risk uses, and telling people when they're dealing with AI. | Art. 4Art. 14Art. 26Art. 50 |
| CCPA and CPRA | Notice at collection, purpose and retention limits, and contracts that restrict what service providers do with the data. | §1798.100 |
| SOC 2 | Logical access controls and monitoring that cover the AI systems in scope, not just the core application. | CC6.1CC7.2 |
Not a full list: the same controls support the UAE and Saudi PDPL, India's DPDP Act, ISO/IEC 42001 and many more. Whether they meet your obligations is for your DPO, counsel or auditor to decide.
Why not just ban it?
Samsung did, after engineers uploaded code to ChatGPT. But 78% of AI users bring their own tools to work, so bans rarely hold.
Use moves to personal devices
Blocked at work, people use their phones. The data still leaves.
You lose the benefit
Drafting, summarising and searching save real time. Controlled use keeps that.
Controls create evidence
A log of what was masked and where it went can be shown to a regulator.
Staff learn the rules
When a request is masked or redirected, the user sees why.
Questions
Does masking make the answers worse?
Usually not, because the model rarely needs the real name or account number to draft, summarise or classify. Where it does need a value, policy can send that request to a private model instead. We test on your real tasks so you can see the difference.
Will this work with Microsoft Copilot or features inside our SaaS tools?
Partly. Built-in AI features have their own admin settings, and we configure those: data access, retention, regions and which groups can use them. Where traffic can be routed through a gateway, masking and logging apply too.
Where does the gateway run?
In your cloud account or on your servers. The logs and any mapping between placeholders and real values stay with you.
Can it detect our own sensitive data, like case numbers or product codes?
Yes. Alongside standard personal data types, we add detectors for the identifiers that matter in your business and test them on your real documents.
How our live systems handle data
Every case study has a section on how its data is handled: what the AI sees, what it never sees and which rules that maps to.