Switch on your AI assistants and agents without exposing your data.
An executive asks Copilot for "the comp plan" and gets a document they were never meant to see. Copilot doesn't open a new hole: it makes the oversharing you already had queryable in plain language. We get it under control before switch-on, not after the incident.
Copilot inherits your access rights, not your judgment.
You switch Copilot on. What looks like a leak isn't one: everything it surfaces was already accessible. The problem isn't the AI, it's a sharing configuration built up over years that no patch fixes for you (even after EchoLeak, CVE-2025-32711, since patched by Microsoft).
First, it's a GDPR risk: personal data becomes queryable by the wrong people. And a blind spot for AI governance: as a deployer, the EU AI Act expects you to know which AI tools run in your organisation and what they expose.
What the audit checks, before switch-on.
Six concrete points, with native Microsoft tools. The point isn't to buy yet another solution, but to set right what you already have.
Deliverable: a risk score and a prioritised remediation plan you can act on. Not a slide deck.
Entra ID: stale accounts, external guests, over-permissioned groups.
SharePoint Advanced Management: sites shared with the whole org, anonymous links, broken inheritance.
Purview: is business-critical content labelled, and is access actually restricted.
Exclude sensitive labelled content from what Copilot can process.
Restricted SharePoint Search: limit what Copilot reads during the pilot.
Which AI tools your teams already use, with no guardrails.
A free scoping call, then the audit that secures your rollout.
You know where you stand before you scale Copilot, not after the first incident. And you choose your level of commitment.
Scope, access, objectives, no commitment. You leave with a first read of your exposure.
A map of your oversharing and a risk score, on your tenant. To know where you stand before you commit.
The six points on your native tools (Entra ID, SharePoint Advanced Management, Purview), the prioritised remediation plan and support through to switch-on. No agent to install.
The scoping call is free, and the diagnostic is deducted if you move to the full audit. Indicative ranges (excl. VAT), adjusted to scope and country.
Know where you stand before you commit: a map of your oversharing and a risk score.
- 2 days on your Microsoft 365 tenant, then €950 per day depending on tenant size (4 days max)
- Oversharing map and risk score
- No agent to install
Deducted from the audit if you move ahead.
A first map of your oversharing exposure.
The six points, the prioritised remediation plan and support through to a secured Copilot switch-on. Price depends on the number of users and SharePoint sites, set at scoping. Carrying out the remediations (permissions, labelling, DLP) is quoted separately if you entrust it to us.
- SME: from €6,500
- Mid-market: from €12,000
- Enterprise: on quote
- Risk score, remediation plan, support
A secured Copilot and an access inventory, presented.
The same method for your other assistants and AI agents.
Gemini for Google Workspace, ChatGPT Enterprise, Claude for Enterprise, Copilot Studio agents or business agents deployed by Sync: an assistant inherits your users' permissions and data, whatever the vendor. We apply the six AI Secure points to each platform: access and identity, oversharing surface, sensitivity labels, assistant-aware DLP, indexing scope, usage reality. Diagnostic and audit at the same prices.
One audit, two outcomes.
On one side, Copilot you switch on with peace of mind. On the other, an inventory of access and usage that feeds your GDPR file and your AI governance (the documentation the EU AI Act expects from a deployer). One partner for both, not a security vendor on one side and a compliance firm on the other.