Services · PRIVACY AUDIT
AI Data Exposure Audit
We trace where your agent and LLM pipelines send prompts, retrieved context and outputs, and verify that sensitive data only reaches the providers, logs and stores your policies allow. The result is evidence, not a promise.
USD 3,500 USD · flat fee
Technical scope
What we test.
For regulated companies that need to show where AI-processed data goes before a security review, a customer questionnaire or an audit.
Data-flow mapping
Every place context can travel:
- Calls to third-party model and embedding providers
- Retrieval sources and vector stores
- Tool and plugin calls that carry context
- Observability: logs, traces and prompt stores
Exposure testing
What actually leaves, verified by testing:
- Sensitive fields reaching providers that should not receive them
- Context leaking across users or tenants
- Secrets and credentials in prompts or logs
- Retention and training settings of each provider
Controls
What is in place to prevent it:
- Redaction and minimization before model calls
- Provider and region allowlists
- Access control on logs and vector stores
Methodology
Autonomous reconnaissance. Human exploitation. Human validation.
AI-assisted reconnaissance maps the attack surface. Security engineers build the attack paths, exploit them and validate every finding before it reaches your report.
Deliverables
- Data-flow diagram of the AI pipeline
- Findings with evidence of each exposure
- Mapping to OWASP LLM02:2025 Sensitive Information Disclosure
- Remediation guidance per data flow
- Retest validation
No test starts without a contract, a defined scope and written authorization. Customer data, code, configurations and credentials are not submitted to public third-party commercial LLM services as part of the assessment workflow.
Scope your AI Data Exposure Audit engagement.
Tell us about the system, its architecture and your deadline. We reply with a proposed scope and a fixed price, usually within one business day.