For DPOs, privacy officers and compliance
See everyday AI use, and the personal data that goes into it.
See which AI tools colleagues use and record the decision and documents for each one. Colleagues get help as soon as personal data appears in their text.
Prefer to try it yourself? 14 days free, no credit card.
Personal data is already going into AI tools. Your record of processing doesn't show it yet.
Colleagues use AI to summarise reports, rewrite customer emails and sort data subject requests. Names, ID numbers and health details go in with them, often to tools that are not in the record of processing activities or have no data processing agreement (DPA). As a DPO you want to know before something goes wrong, and be able to show what is in place. Here's how, in four steps.
1 See
See which AI tools colleagues use.
You want to know whether personal data ends up in AI tools. That starts with knowing which tools colleagues actually open. The catalogue shows the tools seen in the organisation, from Copilot and ChatGPT to Otter.ai and DeepSeek, each with a risk score and the organisation's decision. Usage and Compliance show what share of AI use goes through approved tools, and which tools are in use without a decision.
More about SeeAn impression of the AI tools catalogue. The tools and risk scores come from the product. The decision in the last column is your organisation's own.
2 Decide
Record what is allowed for each tool, and what is in place.
ChatGPT turns out to be used every day for meeting notes and customer emails. You want to be sure a DPA is in place and that the DPIA covers that use. The screen shows the ChatGPT register entry: the decision and who made it, whether each use case involves personal data, the DPA and the DPIA with their dates, and the next review. So for every tool you see which documents are in place and which are still missing. The catalogue supplies the vendor facts; the decision stays yours.
More about DecideProduct example with fictional data.
3 Help
Help colleagues protect personal data while they work.
A colleague asks an AI tool to summarise an access request for tomorrow's meeting. The text holds the requester's name, his social security number and a health detail. BeeSensible highlights all three in the text. One click turns them into a placeholder such as [NAME1], or removes them, and the summary is just as useful. The organisation can also set masking to happen automatically when text is pasted or sent. The logged request can be anonymised the same way before it is shared.
More about Help
GeminiAccess request: log entry
Requester Daniel Whitfield, born 29 September 1988, SSN 078-05-1120, reachable at d.whitfield@example.com.
The request concerns a file that records burnout complaints. The response deadline is in fourteen days.
DeepSeek is not allowed here
Your organisation does not allow this tool for work. Use an allowed alternative.
Use instead
Open Microsoft 365 CopilotAlso allowed: ChatGPT ·Claude
DeepSeek is allowed here, with limits
Your organisation allows this tool with limits. Only use it with anonymised data.
Use instead
Open Microsoft 365 CopilotAlso allowed: ChatGPT ·Claude
No decision yet on DeepSeek
Your organisation has not made a decision on this tool yet. Do not share personal data or confidential business information here.
Use instead
Open Microsoft 365 CopilotAlso allowed: ChatGPT ·Claude
Only enter public information here
Product example with fictional data.
4 Substantiate
Back up your register, your DPIA and your annual report.
You are updating the record of processing activities, revisiting a DPIA or writing the annual report to the board. You want to show that the measure works. Each month or quarter you create a report: how many tools have a decision, how many critical details were adjusted before sending, and how often colleagues chose the approved alternative after a notice. Always for the whole organisation, never per person, and downloadable as a PDF.
More about SubstantiateNotices about tools
Shown when someone opens a tool without a decision, or one that is limited or not allowed.
Browser use only, counted at most once per tool per day.
Product example with fictional data.
A customer's view
"Everyone here knows you have to be careful with customer data. But that awareness fades when you're busy. Knowledge is no guarantee of behaviour. That's exactly why we use BeeSensible."
Debby Elfrink Operations director, Speck Pompen This customer works in a different sector.
Trust and getting started
Your data stays safe, and getting started is quick.
What happens to your data
- Text is checked on our own servers, hosted by the European companies Scaleway and Hetzner, and deleted straight away.
- The dashboard shows totals for the whole organisation, never a breakdown by employee. Figures only appear once five or more users are active.
- You get a data processing agreement (DPA). The product DPIA and security information are available on request.
How to get started
- Install the extension on a few workstations, or have IT roll it out centrally through Intune or Group Policy, on any plan.
- Employees get an explanation and short videos about what they'll see and what they can do.
Good to know
Questions we often get.
What exactly does BeeSensible process and keep?
Typed text is checked in the working memory of our own servers at Scaleway in Amsterdam and Hetzner in Germany, then discarded straight away. What remains is an event without a user ID: the type of data, the level, the app, the time and what was done with it, plus a check value that merges repeats within the same hour. We keep those events for at most 24 months.
Can I reconstruct a data breach with BeeSensible?
No, that is not what it is built for. Content is not kept and there is no user ID. The dashboard shows counts, only once five or more users are active, and has no per-employee view. Over a period you see which kinds of data came up in which apps and what was done with them. That helps your risk assessment, not the investigation of one specific case.
Which personal data does BeeSensible recognise?
65 data types in 11 categories, in English and Dutch: from names, addresses and national ID numbers to health data, financial details and technical keys. In each detection profile you decide which types are included and which count as critical. File codes and project names the detection does not know can be added as custom terms.
How does this fit the GDPR and the AI Act?
You are the controller, BeeSensible is the processor. A DPA comes with every contract; the product DPIA and the list of subprocessors are available on request. The AI register feeds into your record of processing activities and your own DPIA. The legal basis, the risk assessment and the judgement of what is appropriate are yours to record.
Does BeeSensible block AI tools?
Not on its own. People see what was found and what you decided about a tool. You decide whether someone can still go ahead with a tool that is not allowed, and whether masking happens by default. What happens after a highlight or a notice is counted, without content and without a name.
Start by seeing which AI tools your organisation uses
Start with a few colleagues, or see it in a demo first.
14 days free, no credit card. Rolled out across your organisation within an hour.
