Your staff are already using AI. Is it your account or theirs?
ChatGPT, Microsoft Copilot, Claude, Google Gemini and Grok each come in a personal version and a company version, and they look the same on screen. One keeps your data under your control. The other puts client records, pricing and contracts into an account you don't own and can't close when someone leaves.
- ChatGPT
- Microsoft Copilot
- Claude
- Google Gemini
- Grok
- and the AI built into other apps
Free 30-minute AI exposure call
Talk to a consultant about which AI tools your staff are likely using and where your data could be going. No sales pitch, just a straight answer.
Available until the end of this quarter.
Claim the callEvery major AI tool comes in two versions
Staff sign in with whatever account is to hand. Often that's a personal one, on a work laptop, with company data. These are the versions to look for.
| AI tool | Personal version The employee's own account |
Company version Licensed and managed by you |
|---|---|---|
| ChatGPT (OpenAI) | Free, Plus, Pro | Business, Enterprise |
| Copilot (Microsoft) | Copilot signed in with a personal Microsoft account | Microsoft 365 Copilot and Copilot Chat signed in with a work account |
| Claude (Anthropic) | Free, Pro, Max | Team, Enterprise |
| Gemini (Google) | Gemini with a personal Google account | Gemini in Google Workspace |
| Grok (xAI) | Grok through a personal X or Grok account | Grok business plans |
What changes between the two
| Personal version | Company version | |
|---|---|---|
| Who owns the account and the chat history | The employee | Your company |
| Chats can be used to train the vendor's models | Often yes, depending on the user's settings | No, under business terms |
| You can cut off access when someone leaves | No | Yes |
| Admin controls and visibility of use | None | Admin console, with audit and retention on higher tiers |
| Sign-in with company identity (SSO) | No | Yes, on most business plans |
Based on each vendor's published plan terms at [DATE CHECKED]. Plan names and data settings change often, so we check the current terms as part of every review.
What ends up in personal AI accounts
Nobody sets out to leak data. Staff paste things in to save ten minutes. Whichever tool they use, these are the categories we find most often.
Client personal data
Names, addresses and case notes pasted in for a quick summary. Under UK GDPR that's processing you haven't recorded and can't reverse.
Commercial information
Pricing, bids, contract terms and supplier deals, pasted in to be rewritten as a tidier email.
Credentials and code
API keys, config files and scripts dropped in for help with debugging. Those keys now live outside your control.
HR and board papers
Disciplinary notes, salary reviews and board minutes condensed into a summary for someone who missed the meeting.
Company licences carry their own risk
Microsoft 365 Copilot, Gemini in Workspace and Claude connected to company drives can all surface any file a user already has access to. If your SharePoint, OneDrive or Google Drive permissions are untidy, switching these on turns an old permissions problem into a live data exposure.
Are you ready for AI tools?
Ten questions. Answer honestly. "Not sure" counts as a gap, because if you can't answer it, you can't control it.
Want to share this with your board or IT team? Get the printable AI readiness checklist (PDF)
Consultant-led reviews, done by people
Every review ends with a written report in plain English and a call to walk through it. You get a fix list ranked by real risk to your business, not a 200-page scanner export.
AI readiness review
A consultant-led look at how your organisation uses AI today and what it's exposing.
- Discovery of AI tools in use, approved or not
- Licence check across ChatGPT, Copilot, Claude, Gemini and Grok
- Data exposure findings mapped to UK GDPR
- An AI use policy ready to adopt
Vulnerability review
Find the weak points in your systems before someone else does.
- External attack surface scan
- Internal vulnerability scan
- Every finding checked by a consultant, false positives removed
- Fix plan ranked by risk, with effort estimates
Cyber Essentials
Certification with an authorised body that helps you pass, not just marks the test.
- Pre-assessment gap check
- Help fixing anything that would fail
- Assessment and certificate
Zero Trust workshop
A working session for IT and leadership on where your network trusts too much.
- Your current access model mapped
- Where trust is assumed and shouldn't be
- A phased plan you can act on
Bundle: book the AI readiness review and the vulnerability review together as one engagement, with a single report and walk-through.
Ask about the bundleScanners find issues. Consultants decide which ones matter.
- Step 1
Scope
We agree what's in and out of scope and get written authorisation before anything is touched.
- Step 2
Scan
External and internal scanning of the agreed systems, timed to avoid disrupting your working day.
- Step 3
Consultant review
Each finding is verified by hand and ranked by what it would mean for your business if exploited.
- Step 4
Report and walk-through
A plain-English report, a fix plan, and a call to go through it with whoever will do the work.
Find out what your AI use is exposing
Leave your details and a consultant will call you within one working day.
Phone 0203 3070370
Email [email protected]
Head Office
Dalton House, 60 Windsor Avenue,
London. SW19 2RR
[email protected]
0203 3070370