For operations, finance & IT leaders
Can your AI workflows pass a closer look?
Review the data, permissions, and decisions behind your AI tools. Download the 15-point PDF to review your Zapier and AI stack for data exposure, retention gaps, and missing controls.
Free working checklist
Bring the right questions to the table.
For each control, record the evidence, an owner, and a next action. An unknown answer is a reason to investigate. This checklist is a starting point for review, not a certification or a completed security audit.
Free PDF · 4 pages · No email required · Includes space for evidence and next actions
Assign an accountable owner
Name the business owner, technical owner, and approver for each AI workflow.
Inventory AI vendors and integrations
Record the provider, model, subscription or API tier, connected tools, and purpose.
Map the data flow
Identify what leaves each system, every processor it reaches, and where copies are stored.
Classify and minimize sensitive data
Identify customer PII, financial records, and confidential material. Remove or redact fields the workflow does not need.
Verify training-use terms
Check the terms for the exact product and account. Record whether prompts, files, or outputs can be used for model training.
Verify retention and deletion
Document provider logs, application state, backups, and deletion schedules. Confirm zero-data-retention eligibility and activation where required.
Confirm processing locations
Check processing, storage, support access, and subprocessors against your organization’s residency requirements.
Review vendor evidence
Collect current contractual terms and relevant independent assurance reports. Check the services and controls actually covered.
Limit identities and permissions
Use named service identities with the smallest access needed. Review who can add tools or expand permissions.
Protect and rotate credentials
Keep production keys in a secrets store. Assign an owner for rotation and revocation when access changes.
Define approval boundaries
Document which actions require a person, including payments, access changes, external messages, and deletion.
Test untrusted content and outputs
Test prompt injection, malformed inputs, and unsupported answers. Validate extracted fields before they change a record.
Keep useful, limited audit records
Capture actions, approvals, and failures with appropriate access and retention. Avoid unnecessary sensitive payloads in logs.
Plan failure response and shutdown
Name the responder, define alerts and recovery, and test a way to stop or roll back the workflow.
Set a baseline and review cadence
Record operating costs, cycle times, and error rates. Recheck performance and controls when models, vendors, or workflows change.
Operational Discovery Audit
Turn the gaps into a delivery plan.
With a fixed fee agreed before kickoff, we review the agreed vendors, workflows, and controls, establish an operational baseline, and deliver written findings with a prioritized roadmap. Fixed scope before kickoff; applicable taxes are additional.