AI Governance & Cloud Posture
Know which models touch personal data, where that data came from, and whether your cloud posture still matches what you told the regulator.
What it does
AI systems are the fastest-growing source of unmapped personal data processing in most organisations. A model fine-tuned on customer records is a processing activity, and the training set is personal data that someone may later ask you to erase.
This module keeps a register of AI and ML systems with the lineage that connects each one to the data it was trained and runs on. When a rights request or a retention rule touches a dataset, you can see which models are implicated rather than discovering it later.
The same posture engine extends to your cloud data stores, flagging drift — a bucket that became public, encryption that was disabled, a snapshot that outlived its retention rule.
Capabilities
AI/ML model inventory
A register of models in use, their purpose, owner and risk classification — including the ones procured rather than built.
Model-to-data lineage
Connects each model to its training and inference data, so a dataset's obligations follow it into the models that consumed it.
EU AI Act readiness mapping
Maps your inventory onto the Act's risk tiers for organisations with European exposure.
Cloud DSPM posture signals
Continuous checks on where data sits, how it is protected, and what changed since the last scan.
Drift detection
Alerts when a store's posture diverges from policy — public access, disabled encryption, expired retention.
Which duties this discharges
The obligations under the DPDP Act 2023 that this module is built to satisfy. The Act takes full effect on 13 May 2027.
- s.8(4)Accuracy duties extend to data used in automated decisions
- s.8(5)Reasonable security safeguards across all processing, including AI
- s.7Legitimate uses must still be specific — model training is a purpose
Section references are to the Digital Personal Data Protection Act, 2023 and are provided for orientation, not as legal advice.
Works with
Data Discovery & Classification
Find every piece of personal data you hold — across databases, cloud storage, SaaS apps and APIs — before you try to govern it.
Read moreGovernance, Records & Audit
The obligations that prove you are compliant — records, assessments, retention and audit integrity — kept current instead of rebuilt before each audit.
Read moreSee AI Governance & Cloud Posture on your own data
A 30-minute walkthrough against the systems you actually run — not a generic demo environment.