For CISOs, security leads and IT managers
See how AI is used. Protect data as people type and paste.
See which AI tools are in use and record the decision for each one. Engineers get help as soon as keys, passwords or customer data appear in their text.
Prefer to try it yourself? 14 days free, no credit card.
Engineers already paste into AI tools. Oversight lags behind.
Developers use AI to summarise log lines, analysts paste a configuration into ChatGPT and someone tries a free tool to write a script. It saves time. But those texts hold API keys, passwords, IP addresses and customer data, and a key that has been in a prompt is a key you have to rotate. Here's how to stay in control, in four steps.
1 See
See which AI tools are in use.
For the supplier register, the CISO wants to know which AI services are really in use, beyond the approved Copilot environment. The catalogue shows the tools seen in the organisation, from Copilot and Security Copilot to Tracecat, Dropzone AI and DeepSeek, each with a risk score and the organisation's decision. For this, BeeSensible reports only the domain, with no page, text or user ID. Usage and Compliance show what share of use goes through allowed tools.
More about SeeAn impression of the AI tools catalogue. The tools and risk scores come from the product. The decision in the last column is your organisation's own.
2 Decide
Weigh the facts for each tool and record the decision.
A developer uses DeepSeek to rewrite a script, because it is free and answers quickly. It has only just appeared. The screen shows the assessment of DeepSeek: a Chinese vendor storing data in China, which trains on input by default, offers no data processing agreement (DPA) and has documented incidents with sources. The organisation decides, in this case, not to allow it, with Copilot as the alternative, and records that in the AI register. Anyone who opens DeepSeek sees that decision and the alternative.
More about DecideProduct example with fictional data.
3 Help
Help engineers take secrets out before they are shared.
A developer pastes log lines from an outage into an AI tool for the postmortem. They contain a service account, an IP address, a live API key and a password. BeeSensible highlights all four in the text, and flags the key and the password as critical. One click turns each one into a placeholder such as [NAME1], or removes it. The organisation can also set masking to happen automatically when text is pasted or sent, so a pasted configuration never goes out with the key still in it. A postmortem can be anonymised the same way before it is shared.
Detection cannot know a hostname, a migration's codename or an incident number on its own, so you add those as custom terms, one at a time or as a CSV.
Custom terms that fit here
- Project Walrus Project
- srv-dc01 System
- INC-20418 Code or reference
- Harbour cluster System
GeminiPostmortem: phishing campaign
First click at 09:14 by d.hofman, from 145.94.28.117. The message arrived at invoices@veldkampgroup.example.
The analysis showed the submitted password Summer2026! was also in use on two other services.
DeepSeek is not allowed here
Your organisation does not allow this tool for work. Use an allowed alternative.
Use instead
Open Microsoft 365 CopilotAlso allowed: Microsoft Security Copilot ·Claude
DeepSeek is allowed here, with limits
Your organisation allows this tool with limits. Only use it with anonymised data.
Use instead
Open Microsoft 365 CopilotAlso allowed: Microsoft Security Copilot ·Claude
No decision yet on DeepSeek
Your organisation has not made a decision on this tool yet. Do not share personal data or confidential business information here.
Use instead
Open Microsoft 365 CopilotAlso allowed: Microsoft Security Copilot ·Claude
Only enter public information here
Product example with fictional data.
4 Substantiate
Show the board and the auditor how the control works.
The board wants to know what control is in place for AI use, and the auditor asks for evidence that it works. Each month or quarter you create a report: how many tools have a decision, how many critical details were adjusted before sending, and how often staff chose the approved alternative after a notice. Each topic notes what the GDPR, NIS2 and the AI Act ask for. Always for the whole organisation, never per person, as a PDF.
More about SubstantiateNotices about tools
Shown when someone opens a tool without a decision, or one that is limited or not allowed.
Browser use only, counted at most once per tool per day.
Product example with fictional data.
A customer's view
"Everyone here knows you have to be careful with customer data. But that awareness fades when you're busy. Knowledge is no guarantee of behaviour. That's exactly why we use BeeSensible."
Debby Elfrink Operations director, Speck Pompen This customer works in a different sector.
Trust and getting started
Your data stays safe, and getting started is quick.
What happens to your data
- Text is checked on our own servers, hosted by the European companies Scaleway and Hetzner, and deleted straight away.
- The dashboard shows totals for the whole organisation, never a breakdown by employee. Figures only appear once five or more users are active.
- You get a data processing agreement (DPA). The product DPIA and security information are available on request.
How to get started
- Install the extension on a few workstations, or have IT roll it out centrally through Intune or Group Policy, on any plan.
- Employees get an explanation and short videos about what they'll see and what they can do.
Good to know
Questions we often get.
How does this fit alongside DLP and our other controls?
BeeSensible works at the point where someone types or pastes text, or adds a file to an AI conversation. DLP remains your control for files, email and network traffic. BeeSensible runs as an extension in Chrome and Edge and as a desktop app on macOS and Windows, with no proxy, network change or extra certificates. Central rollout through Intune or Group Policy is available on every plan.
Is there a SIEM integration or an API?
No. There is no SIEM integration, no webhook and no public API. You can export the AI register as CSV or PDF, and the report as PDF. Events carry no user ID and the content is not kept, so they cannot be used to tie activity to individuals or to reconstruct an incident.
What if someone ignores a highlight?
They can, within your organisation's settings. If something is sent despite a highlight, that is counted, without content and without a name. So you see how often critical data still goes out, and whether more explanation or stricter settings are needed.
How does this fit the GDPR, NIS2 and the AI Act?
The GDPR asks for appropriate measures you can demonstrate, NIS2 (in the Netherlands, the Dutch Cybersecurity Act or Cyberbeveiligingswet) for risk management across the supply chain, and the AI Act for AI literacy. BeeSensible is a control at the point where text goes into an AI tool, with an overview of AI vendors and figures on how the control is applied. Whether that is appropriate is for the organisation to judge.
Does BeeSensible block AI tools?
Not on its own. People see what was found and what you decided about a tool. You decide whether someone can still go ahead with a tool that is not allowed, and whether masking happens by default. What happens after a highlight or a notice is counted, without content and without a name.
Start by seeing which AI tools are in use
Start on a group of workstations, or see it in a demo first.
14 days free, no credit card. Rolled out across your organisation within an hour.
