What is investigated
Formal and informal — including personal accounts used for work, the most common and most invisible case.
Where customer data is copied into those tools: drafting, summaries, document review, translation.
Client identification, sensitive data, financial information, or privileged information, depending on your activity.
How many people, how often, in which areas of the organization.
The deliverable
What is delivered
A written report with concrete findings per workflow, presented as observable technical facts — "this data leaves through this path toward this provider" — never as a legal qualification of whether your organization complies with regulation. That distinction is not a shortcoming: it is the guarantee of a rigorous report within the limits of what a technical provider can state.
- Findings per workflow, with concrete evidence
- Exposure classification by data type
- Technical recommendation for next steps
- In-person delivery, with room for questions
What is not included
- No regulatory compliance qualification — that assessment belongs to your legal counsel
- No comparison of AI providers other than Privedge
- No technical implementation — that is a separate service, with its own scope
- No follow-up meeting beyond the report delivery
The natural next step
With the report in hand, the logical step is closing what was found exposed. The Deployment rolls out Privedge in your organization, configured on what the Diagnostic already identified.
See the DeploymentFrequently asked questions
Does the report say if we are GDPR compliant?
No. The report describes observable technical facts — what data leaves, by which path, how often. Compliance qualification requires a lawyer's judgment; the report gives you the evidence for that conversation to happen with rigor.
How long does the process take?
It is a fixed-scope process, designed to be resolved in days, not weeks. We confirm the exact timeline when you engage it.
Do we need to give access to internal systems?
The level of access needed is agreed before starting and limited to what is essential to observe the relevant workflows.
Does it work for any type of organization?
Yes. The Diagnostic is not built for one sector — it serves any organization handling third-party sensitive data that uses AI.
Is this available outside Spain?
The Diagnostic is currently delivered in Spain, in Spanish.
Currently delivered in Spain, in Spanish.