Your staff already
use AI.

Shadow AI discovery finds the AI tools already in use across your organisation, establishes what company information has been going into them, then puts education and enforceable policy around it. It is for organisations that have not started with AI, and equally for those that have, since adopting one approved tool does nothing about the eleven others people are using on the side.

Staff using AI tools for work through accounts your organisation does not control and cannot see. It covers the obvious chat assistants, but also meeting transcription bots joining your calls, AI features inside browser extensions, and code assistants. The defining characteristic is that company information is leaving through a channel nobody approved and nobody is monitoring.

Almost certainly, and this is the part organisations most often miss. Rolling out an enterprise tool does not remove the personal accounts people were already using, and it does not cover the AI features quietly embedded in other software. Approving one tool is necessary and nowhere near sufficient.

You can, and staff will use them on personal devices where you have no visibility whatsoever. Prohibition converts a manageable problem into an invisible one. A sanctioned tool that is genuinely good enough, with a clear boundary around what may go into it, is the version people actually follow.

It depends on the tool and the account type, which is exactly why this needs establishing rather than assuming. Consumer tiers have historically retained conversations and in some cases used them to improve models. Business and enterprise tiers generally commit not to train on your content and offer retention controls. The practical position is that information put into a personal account should be treated as having left your control, and in a professional services or health context that may be a notifiable matter.

To a useful degree, yes, using data you already hold: third-party application consents in your Microsoft 365 or Google tenant, network and DNS data, expense claims, and browser extension inventories on managed devices. Personal accounts on personal devices are genuinely outside what anyone can see, which is precisely why education and policy do the work that monitoring cannot.

Which tools are approved and for what. What categories of information may never go in, named specifically rather than described vaguely. That AI output is checked by a person before it is relied on or sent. Who is accountable when AI-assisted work turns out to be wrong. And how someone requests a new tool, because without that route you are back to shadow use within a month.

We quote after scoping rather than before. Anyone pricing this work without looking at your environment is guessing, and the guess is rarely in your favour. Scoping itself is quick, and we tell you what it costs before we start it.

A first conversation takes about half an hour and costs nothing. Scoping is usually a week or two of our time depending on the size of the environment, and we agree the delivery dates with you before anything is booked in.

Yes, and it is common. We are happy to work as an extra pair of hands under your internal team, or alongside an incumbent provider on a defined piece of work. We will set out in writing where the responsibilities split, so nothing falls between us.

No. This can be delivered as a standalone piece of work for an organisation we have never worked with before, or folded into a managed agreement if you already have one with us. Plenty of clients use us for one thing and keep everything else where it is.

Our team is based in Auckland and we attend sites across the wider region. Most of this work is delivered remotely, so we support organisations throughout New Zealand, and we will say up front where being on site genuinely matters.

Named people, not a queue. You get a lead who knows your environment and stays with it, which is the difference between explaining your business once and explaining it every time you make contact.

You keep the documentation regardless, and anything registered in your name stays in your name. Whether we stay involved is your call. Some clients take it in house from there, others move it onto an ongoing agreement with us. We would rather you left cleanly than stayed because leaving was difficult.