Ungoverned
Personal AI accounts
Company information pasted into personal ChatGPT or Claude accounts nobody at work can see.
It leaves your control, with no record of where it went.
You can't control the AI you don't know exists.
Your team is probably using more AI than anyone approved. We find it, write the rules, and monitor it every month.
See what the service includes1. Find the AI already in use.
We look at what your team uses, what it can reach, and who gave it access. Here's where it usually turns up.
Unreviewed
Meeting note-takers
Tools like Otter or Fireflies record calls under terms nobody read.
Sensitive conversations end up stored somewhere you don't control.
Unvetted
Browser AI add-ons
Add-ons that can read the pages you open, including email and your client records.
They keep that access long after anyone remembers installing them.
Unmonitored
Apps someone clicked "Allow" on
One click gives an app lasting access to a whole mailbox, drive, or client database.
Access to your whole Microsoft 365 account that nobody is tracking.
Unsanctioned
Homemade shortcuts
Someone hooks their own AI account into a spreadsheet or automation, and nobody reviews it.
It works, until they leave and nobody knows it exists.
Unreviewed
AI switched on by default
Software you already approved adds a new AI feature and turns it on.
Nobody decided to use it. It just showed up.
What we do
Find the AI your team is using
We identify approved and unapproved AI tools through monitoring, account reviews, and conversations with your staff.
Check who can see what
Folders shared with everyone, old accounts that still have access, and links anyone can open.
Find personal AI accounts
Many free and personal AI accounts can train on what your team types. Your company can’t see those accounts.
You get an inventory of the AI tools we identify and what’s shared too widely.
2. Clean up access and write the rules.
We fix the access problems in scope, then write simple rules so everyone knows what’s allowed.
Copilot can open anything you can open.
It doesn’t break in. It reads whatever the person asking is allowed to open, so a folder shared with everyone is a folder it can answer from.
AI didn’t create the leak. It found it.
Example: a front desk coordinator asks Copilot what the salaries on the operations team are. Copilot answers with a summary from the payroll file, because the payroll folder is shared with everyone at the company.
Example
What we do
Clean up file access
We clean up SharePoint, OneDrive, and Teams so people, and the AI tools they use, only reach what their job needs.
Example: payroll goes from everyone to HR only, the public link on client contracts is turned off, board notes go from the whole company to the board only, and a former employee's access is removed.
ExampleSet up approved, managed AI workspaces
Your team works in business AI accounts your company controls. They don’t train on your data, and you can close one the day someone leaves.
Example: the sales team's ChatGPT moves from personal accounts to a business account, training on what they type is turned off, your company can see the accounts, and the account of someone who left is closed.
Example
Write the rules
Three short documents. Pick one to see a sample.
The policy
Which tools are approved, what information never goes into them, and who to ask.
Build your free policyAI Policy Builder · 12 questions · about 5 minutes
Riverside Services, Inc.
Artificial Intelligence Acceptable Use Policy
3. Approved AI tools
Approved
- ChatGPT Business
- Microsoft Copilot
4. Information handling
Minimal RiskPublic and sample data
Low RiskInternal documents, notes
High RiskCustomer and employee data
Confidential / RestrictedHealth data, IDs, credentials
Your approved AI tools list
Every AI tool you use, who owns it, how risky it is, and whether it's approved.
AI System Register
| System ID | AI system or feature | Business owner | Internal risk tier | Lifecycle status |
|---|---|---|---|---|
| AI-001 | ChatGPT Business | Operations lead | Low | Approved |
| AI-002 | Meeting notetaker | IT manager | Moderate | Pilot |
| AI-003 | Copilot in Outlook | IT manager | Moderate | Proposed |
| AI-004 | Personal AI accounts | HR director | High | Rejected |
Noventech • AI Governance
AI Tool Approval Request
6Review and decision
- Tool name
- Meeting notetaker (browser add-on)
- Data involved
- InternalSensitiveHighly sensitive
- Outcome
- ApprovedRestricted, conditions belowProhibited
- Conditions
- Internal meetings only. Not for client calls.
We build all three with you during the one-time setup. See what's included
3. Monitor it every month.
New AI tools show up all the time. Each month we check what changed and send you a report.
What we do
Protect sensitive information
Personal details, ID numbers and passwords are stripped from prompts before they reach an AI tool, risky tools can be limited to no uploads or no sensitive data, and every warning and block is reviewed monthly. With the Microsoft 365 add-on, we also stop sensitive files leaving by email or shared links.
Example: an email to a personal Gmail address with the client list attached is stopped, because the file contains 214 Social Security numbers.
Example · Microsoft 365 add-onWatch for new AI tools
We catch new AI tools and features, and bring you anything that needs a decision.
Example: a meeting notetaker found on client calls is limited to internal meetings, an old CRM connection still reading a mailbox is removed, and Copilot for the sales group is waiting on your decision.
Example
Send a monthly report
What we found, what we did, and anything waiting on you.
This month: 2 new AI tools found, 2 policy findings, 5 access grants reviewed, and 1 decision waiting on you.
| Finding | Action taken | Status |
|---|---|---|
| Information going where it shouldn'tCustomer list uploaded to a personal ChatGPT account | Flagged to the sales manager; account restricted; team reminder sent | Closed |
| AI arriving without approvalMeeting notetaker joining external client calls | Reviewed; limited to internal meetings in the tools list | Closed |
| Permissions nobody re-checkedOld CRM connection still reading a shared mailbox | Access removed; connection taken off the tools list | Closed |
| AI arriving without approvalCopilot switched on for the new sales group | Rules for what it can see proposed; waiting on the operations lead | Open |
Each finding:
- Flag to a named owner
- Decide approve, restrict, or shut off
- Record it in the tools list
Sample report for a made-up company. The monthly service also includes a quarterly review and a yearly reassessment.
4. Train your team.
A policy only works if people follow it. We keep training short and use examples from your team's own work.
What we do
Short training for each team
Finance, HR, and the front desk each get examples from their own work.
An easy way to ask and report
People can ask for a new tool or report a mistake without getting in trouble.
A one-page guide
What to use, what never goes in, and who to ask. Every employee gets one.
- Use
- ChatGPT Business and Microsoft Copilot
- Never paste
- Client records, passwords, health information
- Ask first
- New tools, extensions, or connections to email and files
- Made a mistake?
- Tell the IT manager today. No blame.
What's included.
Two parts: a one-time setup (steps 1 and 2), then a monthly service (steps 3 and 4).*
One-time setup
1. Find what's in use
- An inventory of the AI tools we identify
- A check of which AI apps can reach your data
2. Write the rules
- Your AI policy and approved tools list
- Risk levels, vendor checks, and a plan for when something goes wrong
- A simple way to approve new tools, with a named owner
Add-on: Microsoft 365 data protection
- Oversharing in SharePoint, Teams and OneDrive found and fixed, before Copilot
- Sensitive files labelled, and stopped from leaving by email or shared links
- Its own setup and monthly fee; recommended if you use or plan Copilot
Ends with staff training, a summary for leadership, and a plan for what’s next.
See everything includedMonthly service
3. Monitor it
- Watching for new and unapproved AI tools
- Approving new tools, checking vendors, and managing accounts
- Help when something goes wrong
4. Train your team
- Short refreshers as tools and rules change
Includes a monthly report, a quarterly review, and a yearly reassessment.
See everything included* This service isn’t legal advice or a certification.
Find out what's already connected before you approve anything new.
Thirty minutes with Vince. Leave knowing where you stand and what to do first.
Local, direct accountability
Guided by federal AI risk guidance
Vendor-neutral
Direct advisory line, call or text
(630) 590-9906
Book a call
A confidential conversation, direct with a Noventech advisor.
Not ready to talk? Get the free handbook, build your free AI policy, or browse our free tools.
- Week 1Kickoff and discovery
- Weeks 2–3Observe and assess
- Weeks 3–5Govern and configure
- Weeks 4–6Train and hand off
Discover
- Shadow AI discovery and an AI service inventory
- Review of how AI is used and the use cases behind it
- Data-access and exposure risks identified
- Existing AI policies and controls reviewed
- Which AI apps can reach your data: connected apps and the permissions they were given
- Data classification and handling rules
- A governance and risk baseline
Govern
- AI acceptable use policy
- Approved AI tool register
- Use-case, vendor review, and risk registers
- Risk tiers and human oversight requirements for each use
- AI incident and data-leakage response policy
- Approval process for tools, connectors, integrations, and agents
- Business and technical owners for every use
- Approved AI platforms configured, where in scope
- Offboarding, change, and reassessment processes
Hand-off
- Initial acceptable use and safe-use training
- Executive findings and a prioritized remediation roadmap
- A reporting baseline for the monthly service
Monitor
- Ongoing AI use and Shadow AI monitoring
- Policy violations and data-risk findings reviewed
- New AI apps and integrations, where supported
Maintain
- AI service inventory and the use-case, vendor, and risk registers
- Acceptable use policy and approval processes
Approve
- New AI tools, connectors, integrations, and agents
- Standard vendor reviews, with an allowance set in your order
Administer
- Approved AI workspace configuration
- User provisioning and deprovisioning
- Groups, roles, and license administration
- Offboarding retired tools and integrations
Respond
- Incident review and documentation
- Tool or account isolation, and access revocation
- Coordination with your security, legal, or insurance providers
Educate and report
- Ongoing safe-use education and policy refreshers
- Monthly AI governance report
- Quarterly governance and strategy review
- Annual reassessment
Microsoft 365 data protection is an add-on with its own fee: oversharing fixes in SharePoint, Teams and OneDrive, sensitivity labels, and data-loss rules for email and shared files. Larger migrations, complex vendor or legal reviews, and deep Microsoft 365 remediation are scoped separately.
AI Risk Indicator
Live
Low exposure so far
- LowContained
- Worth a lookSome gaps
- Needs reviewAct soon
Your AI Risk Indicator will move as you answer the questions.
Before you start
