AI governance for teams without a security team

Your team is putting company data into AI. See exactly what, and prove you handle it.

Your staff paste customer data, contracts, and code into AI tools every day, often on personal accounts you can’t see. StructLine shows you what’s leaving and whose account it’s on, and turns it into an audit-ready record mapped to the EU AI Act and GDPR.

Book a demo Try the detection engine

Live in an afternoon. Discover is free, forever.

7,800+

findings recorded

37%

on personal accounts

See case studies →

Mapped to regulations and standards
Zero-retention by default
No third-party AI
Automated audit-ready reports
Mask or block risky prompts

This is the stuff you didn’t know was leaving.

chatgpt.com

ChatGPTpersonal account

Tidy up this customer note: Anna Kovács, [email protected], IBAN DE89 3704 0044 0532, card 4111 1111 1111 1111|

StructLine sees: email · IBAN · card

Sent with a policy warningStructLine · No bank details in public AI tools

On the device

▲New high-risk finding

StructLine

Governance dashboard

What your team is doing with AI

AI tools

Personal

High-risk

Latest high-risk findings

nowCustomer data → ChatGPTPERSONAL
09:58Password → GeminiPERSONAL
09:12Bank details → ChatGPTPERSONAL

The risk isn’t the tools you approved. It’s the ones you can’t see.

Of the employees who use AI on corporate devices, 67% reach it through personal accounts. Someone pastes a client list into a personal ChatGPT account, and it surfaces weeks later, by accident. In DLP datasets, shadow AI is now the third most common non-malicious insider action, a fourfold rise in a year.

Only 17% of organizations have technical controls that block public AI tools and scan what flows into them. The rest rely on training, warning emails, or a written policy — and have no way to know.

The stalled deal

68%

of enterprise due-diligence questionnaires ask about AI governance

Enterprises send 47% more of them than in 2023. A poor answer delays a deal six to eight weeks, or disqualifies the vendor outright.

The insurance renewal

81%

of cyber insurers ask about AI governance at renewal

Claims have been denied where the applicant answered optimistically rather than accurately. Firms with documented controls have seen premiums fall 20–50%.

The Copilot illusion

76%

choose ChatGPT when Copilot is also available

Buying a licence is not governance. Only 36% of employees with Copilot access actively use it, against 83% for ChatGPT. The sanctioned tool is not where the work is happening.

The blank register

2 Aug 2026

EU AI Act Art. 50 transparency obligations apply

GDPR Article 30 already requires a record of processing. An ISO 42001 or 27001 surveillance audit asks what your AI controls are in practice. Most firms answer with a policy document and no evidence.

Sources: Verizon DBIR 2026; Kiteworks AI Data Security and Compliance Risk Survey, fielded by Centiment; enterprise due-diligence and cyber-insurance survey data, 2026; Microsoft 365 adoption analyses, 2025–26. Current as of mid-2026.

What you’ll be asked

Three questions you can’t answer today.

01
Which AI tools does our team actually use?
02
What kind of data flows into them?
03
Can we prove we handle that responsibly?

See itProve itStop itThe first two on every paid plan; the third with Enforce.

See it

Shadow-AI discovery

StructLine discovers every AI tool your team touches and identifies what kind of sensitive data flows into each. The core shadow-AI signal is the account: a managed company login, someone’s personal one, or a side-business account.

Every AI tool in use, not just the ones you approved
Personal vs corporate vs other-org accounts, inferred, never guessed
The kinds of sensitive data going where, by tool and by person
Every event scored low, medium or high from what was detected and where it went. Financial or identity data on a personal, unmanaged account is the classic high-risk combination.

Prove it

The compliance record

Every observation becomes an audit-ready artifact: the AI register, an exposure report, vendor due-diligence records, and an audit trail, mapped to the EU AI Act and GDPR. For each tool StructLine records whether the vendor trains on inputs, split by free and paid tier, where it hosts data, and whether it will sign a DPA.

AI Register and Exposure Report, exportable as clean PDFs
EU AI Act (Art. 50) and GDPR (Art. 30) alignment, built in
Vendor profiles that become DPIA triggers, with named reasons
A full audit trail: metadata only, never content or secrets

See it in action

Three situations. See what StructLine catches.

A candidate’s file in a personal ChatGPT, a dumped customer list, a password shared over chat. These are the everyday moments where sensitive data slips into AI. Pick one and see what an enrolled browser flags, and what your dashboard receives. In the product it all happens on the device.

The numbers have to add up, so lookalikes stay quiet.
See what a finding contains when nothing is stored.
Toggle to preview what a masked version looks like.

Three situations a team runs into every week. Pick one to see exactly what an enrolled browser would flag. In the product, this runs on the device; nothing typed ever leaves the browser.

New chat · ChatGPT (personal account)

Score this candidate against the JD and draft the rejection email. Julien Dubois, Senior Payroll Analyst [email protected] · +33 6 12 34 56 78 18 Rue des Lilas, 75011 Paris Right-to-work file: Passport L898902C3 National insurance QQ 12 34 56 C Current salary €68,000. Payroll set-up sent ahead: FR76 3000 6000 0112 3456 7890 189

What StructLine flags

Email addressPhone numberPostal addressPassport numberNational IDBank account (IBAN)looks like a candidate record

What your dashboard would receive

zero retentionThe finding above (tool, account type, categories, schemes, counts) is what gets recorded. The text never leaves the browser; no excerpt is built or stored. This is the default.

Your recruiter pastes an applicant’s file into a personal ChatGPT account. No DPA covers that account, and the applicant has no idea where their passport number went.

Case Studies

How StructLine works in the real world

BIZNIS AKTIVRAČUNOVODSTVO

Accounting · Slovenia

An accounting firm handling client financial data, deployed in one afternoon. Week one surfaced 5 AI tools in use where the firm expected two or three, with 33% of activity on personal accounts.

“We expected two or three tools. The first week’s register showed 5, with 33% of the activity on personal accounts. Now when a client asks how we govern AI, we have the register to show them.”

Forge Ventures

Venture studio · United Kingdom

Forge Ventures co-founds and scales startups: 15 people with due-diligence material and portfolio financials in the browser all day, among StructLine’s first installs. The first scan flagged 20% of the activity on personal accounts.

“Our week is finances and due diligence: models, cap tables, data rooms. StructLine flags when any of that heads into an AI tool on a personal account. When a founder asks how we handle their numbers, the answer is on file.”

Aggregate across all early deployments: 7,800+ findings · 37% involving personal accounts

Enforce · the control layer

Seeing a leak is not the same as stopping it.

Comply shows you that a card number went into a chatbot yesterday, and gives you the record to prove you handled it. Enforce keeps it from going in at all. Your policies act at the moment of send: warn, coach toward the approved tool, block, or mask the sensitive values out of the prompt, decided on your team’s devices before anything leaves the browser.

What your teammate sends

Chase the overdue payment on DE89 3704 0044 0532 0130 00 and draft a polite reminder

What the AI tool receives

Chase the overdue payment on [REDACTED:IBAN] and draft a polite reminder

Mask rewrites the outbound request itself, on-device. With tokenization on, the value becomes a reversible token instead, and the key never leaves your side.

Warn

A heads-up, not a wall

The send goes through; the person sees which policy it touched.

Coach

An intern on personal ChatGPT

The send is held with your message and a path to the approved tool. "Send anyway" stays possible, and is recorded.

Block

A customer file heading out

The send stops; the prompt stays in the composer. Nothing reaches the tool.

Mask

An IBAN inside a useful prompt

The sensitive values are rewritten out of the outbound request, on the wire. The person keeps working.

Off by default

Buying Enforce never silently intercepts. An admin authors the rules, per team, role and tool, and flips the switch.

Fails open

If a decision cannot be made in time, the send proceeds and the stand-down is recorded. Governance never takes a work tool down.

Proof of prevention

Every decision lands in a tamper-evident, hash-chained log: which policy, which action, when. Metadata only, never the content.

Privacy by design

The one governance tool that isn’t a data honeypot.

Most tools that watch AI usage hoover up everything your team types. StructLine is built the other way. The guarantee is tiered, and every tier is honest about what it does.

On-device

Basic detection runs on the device

The deterministic, pattern-based engine runs locally in the browser. In zero-retention mode, the device analyzes raw text and never sends it to our servers. It is the only detection stage that runs in that mode; AI detection and custom policies need content collection turned on.

Default

Zero-retention, out of the box

See which tools, personal vs corporate accounts, the kinds of sensitive data involved, how much, and when. All without storing a single word your team typed.

No 3rd-party AI

AI detection, without feeding a third party

Opt into deeper AI detection and it runs on an open-weights model we host ourselves, or that you host in sovereign deployments. Your data never goes to OpenAI, Anthropic, or Google.

Transparent

Your workforce sees what you see

Right after enrolling, the extension shows each person what their organization can see: the kinds of data and counts, never the values. That transparency is often what wins over a DPO or works council.

Full data control

Configurable retentionOne-click org-wide erasurePer-person GDPR exportStrict tenant isolation

What it looks for

It catches the sensitive stuff, and ignores the noise.

Nearly every check has to add up: a real payment card, a valid passport number. Everyday text doesn’t set it off. StructLine names what it found (a Visa card, a password, a customer’s passport), flags what the whole paste looked like, and estimates the size of a bulk one, say 1,200 records at once. All without keeping the text itself.

Analysis stages

✓
Basic detection
4 found
Deterministic, on-device. Checksum-gated PII, secrets, wallets. Always runs.
✓
Advanced detection (AI)
1 found
Self-hosted open-weights model for unstructured, contextual data. Opt-in. Never a third-party AI.
✓
Custom policies
1 violation
Your own org rules, e.g. “no customer names.” Flags violations in findings.

Custom policies

Your own rules, flagged alongside the built-in checks: no customer names, no unreleased code-names, no internal financials. On Discover and Comply they detect and flag. On Enforce, the same rules warn, coach, block or mask a prompt in real time, decided on-device.

Personal data (PII)

Names, email addresses, phone numbers and postal addresses. A list with no card numbers in it is still personal data, and StructLine flags it.

Bank & payment details

Bank account numbers (IBAN), credit and debit cards, VAT numbers, and bank sort/routing numbers, each validated so an ordinary number never trips the alarm.

Identity documents

National ID and passport numbers across the EU, UK, US and the Gulf, each checked against its real format rather than guessed.

Passwords & keys

Passwords, the access keys and tokens behind the tools your team uses, and database logins.

Crypto wallets

Bitcoin and Ethereum wallet addresses.

Compliance outputs

The evidence a regulator, or a client’s security review, asks for.

Other tools give you a ping. StructLine gives you the record: clean, self-contained documents you can hand to an auditor or attach to a security questionnaire.

AI Register

One entry per discovered tool: purpose, deployment type, accounts seen, data categories, risk, the vendor profile, EU AI Act transparency notes (Art. 50) and a GDPR block (Art. 30, plus DPIA recommended yes/no with named reasons).

Exposure Report

What’s happening: totals, the categories flowing out and to which tools, top risks, and per-tool and per-person breakdowns. Both export as PDF.

AI Register · entry

HIGH

ChatGPT

OpenAI · SaaS assistant

Accounts seen: PERSONALCORPORATE
Data categories: Financial, Identity, Secrets
EU AI Act: Art. 50 · transparency
GDPR: Art. 30 record
DPIA: Recommended: free tier trains on inputs

Admin

Manages everything across the org.

Compliance

Read-only, org-wide, for auditors and DPOs.

Users

See only their own activity, nothing else.

A full audit trail records every privileged action, as metadata only, never content or secret values.

Frameworks & regulations

Mapped to the frameworks you’re audited against.

Certifying to ISO 42001, answering a SOC 2 auditor, evidencing GDPR: StructLine gives you the inventory, the detection, and the audit-ready record these ask for; on the Enforce plan, it adds the on-device controls that act on them at the point of use.

Standards & certifications

ISO/IEC 27001:2022

Information security (ISMS)

A.8.12A.8.23A.5.10

How we help

Documents the AI data-leakage exposure and shadow-AI use across your team as evidence for your ISMS. With Enforce, DLP-style masking and blocking at the moment data is pasted.

SOC 2 Type II

Security & Confidentiality

CC6.6CC6.7

How we help

A historical audit trail and exposure reports that give auditors documented evidence of AI data-boundary monitoring across the evaluation window. With Enforce, local interception and tokenization before data leaves the device, in a tamper-evident log.

ISO/IEC 42001:2023

AI management system (AIMS)

Clause 6.1Annex A.10Annex A.8.3

How we help

The live AI inventory, per-tool risk classification, and an audit trail that show an auditor your AI controls operate in practice. With Enforce, coach and block controls that act on those risks at the point of use.

PCI-DSS 4.0

Payment card data

Req. 3Req. 4

How we help

Detects when someone pastes a card number (validated by its check digit) into a public AI tool, and records where it went. With Enforce, masks or blocks card data before it leaves the browser.

HIPAA Security Rule

Sovereign plan

Protected health information

§164.312(a)(2)

How we help

Flags PHI-shaped data (national IDs, medical formats) entering AI tools, so the exposure is visible and recorded. With Enforce, reversible tokenization lets teams use AI without exposing patient data.

NIST AI RMF 1.0

Sovereign plan

incl. Generative AI Profile (600-1)

GOVERNMAPMEASURE

How we help

A continuous inventory of every AI tool (MAP), live risk exposure on sensitive data (MEASURE), the register and evidence to govern acceptable use (GOVERN), and, with Enforce, inline remediation (MANAGE): coach, block, mask, tokenize.

Regulations

EU AI Act

Regulation (EU) 2024/1689

Art. 50Art. 4

How we help

Builds and exports your AI register from real usage — the record of AI processing GDPR Art. 30 requires and shows your workforce what’s seen, supporting AI-literacy duties (Art. 4). With Enforce, inline coaching toward approved tools.

EU GDPR

General Data Protection Regulation

Art. 25Art. 35Art. 30Art. 44–49

How we help

Zero-retention delivers data protection by default (Art. 25). Automated DPIA recommendations with named reasons (Art. 35). The register records AI processing (Art. 30). Vendor hosting flags identify where a transfer needs Standard Contractual Clauses and a transfer impact assessment (Art. 44–49). With Enforce, on-device masking and blocking of non-compliant transfers.

UK GDPR

UK GDPR · Data Protection Act 2018

Art. 25Art. 35Art. 30Art. 44–49

How we help

Retained by the European Union (Withdrawal) Act 2018: the same articles, so the register and DPIA reasoning carry over. The ICO, the sole supervisory authority, treats an inadequate Art. 30 record as a documentary failing. Transfers use the International Data Transfer Agreement and the ICO Addendum, not SCCs, with the DUAA data protection test since 5 February 2026. Hosting flags feed it. With Enforce, the same on-device masking and blocking.

Internal InfoSec & AUP

Acceptable use · IP · credentials

Shadow AIIP protectionCredentials

How we help

Discovers shadow AI, detects API keys, database logins and source-code-like pastes, and flags your own custom policy rules in findings. With Enforce, those rules act: warn, coach, block or mask on violation.

Mappings show where StructLine helps you meet each framework; they are not a certification, an audit, or legal advice. Regulatory references current as of mid-2026.

Why StructLine

Built for the company that carries the risk but not the headcount.

Compliance-native, not security-native

Other tools block threats and show a dashboard of alerts. StructLine produces the evidence: the record you can hand to an auditor or a client.

Private by default, no third-party AI

Basic detection is on-device; zero-retention by default. Opt into AI detection and it runs on a self-hosted open model.

No security team needed

Opinionated defaults, live in an afternoon, run by whoever owns the risk. No CISO, no SASE stack, no rollout project.

Coach, don’t block

People keep the AI productivity they rely on; you get the control and the record. Nobody uninstalls it.

A sales asset, not insurance

The AI question is on enterprise security reviews now. StructLine is how a smaller company answers “yes, here’s how we govern it” and wins the deal.

A budget line, not just a risk line

You are paying for AI seats. StructLine shows which ones people actually use and which tools they reach for instead, by team and by person.

Why now

The regulatory clock is already running.

EU AI Act

Article 50 transparency obligations apply from 2 August 2026. GPAI rules are already in force. The register work starts now.

GDPR (EU and UK)

The ever-present baseline, in the EU and in the UK GDPR retained in UK law. Data flowing into AI tools is processing that has to be recorded under either, and, where risky, assessed with a DPIA.

Pricing

Priced on headcount, not per seat. Flat for small teams.

Governance covers everyone’s AI use, so you pay on total headcount, and the rate steps down as you grow. Discover is free, forever.

Yearly billing saves up to 22%

Discover

Free

The way in.

€0

Full shadow-AI discovery
Personal vs corporate accounts
Starter AI register
On-device, zero-retention detection

Start with Discover

Comply

The evidence layer.

€125/mo flat

Teams up to 25 · additional €4.50 /emp/mo

Saving up to 22% vs monthly

Everything in Discover
AI Register & Exposure Report (PDF)
DPIA recommendations with named reasons
Vendor risk profiles, roles & audit trail
Optional self-hosted AI detection

Start with Comply

Enforce

Active control, on your terms.

€375/mo flat

Teams up to 25 · additional €11 /emp/mo

Saving up to 19% vs monthly

Everything in Comply
Mask, block or coach, on-device
Policy engine: allow / warn / block / coach
Tokenization with keys on your side

Start with Enforce

Sovereign

250+ seats

For 250+ and regulated, in-region.

Custom

Everything in Enforce
In-region / on-prem deployment
Your own infrastructure for detection
HIPAA & NIST AI RMF coverage
Custom annual contract

Contact sales

All figures are per employee, per month. Annual is the billed-yearly headline rate, charged once per year (the monthly figure × 12); monthly is the pay-monthly premium. All prices are in EUR.

Prices are net and exclude VAT. VAT is added at checkout, calculated on your billing location.

On the roadmap · not live yet

Next: wider coverage, same architecture.

Not live yet: response awareness, so what the AI sends back is governed alongside what goes in, and on-prem or sovereign deployment that keeps detection, enforcement and data inside your own country or infrastructure.

Questions

What people ask first.

Does StructLine block AI or slow my team down?

Not unless you ask it to. Discover and Comply are observation-only: visibility and the audit record, nothing intercepted. On the Enforce plan, an admin can turn on active enforcement: policies that warn, coach toward approved tools, block, or mask sensitive data, decided on-device. It ships off by default and fails open, so a broken rule never takes a tool down.

Do you store what my team types?

Not by default. Zero-retention is the default: StructLine records metadata only, the tool, the account type, the kinds of data, and counts. Content collection is a separate, explicit admin opt-in, with redaction on by default even then.

If we turn on AI detection, does our data go to OpenAI or Anthropic?

Never. AI detection runs on an open-weights model StructLine hosts itself, or that you host in sovereign deployments. No third-party AI provider is involved at any stage.

Do we need a security team or a rollout project?

No. An admin adds your corporate domains, picks a privacy mode, invites the team, and enrolls a device with a single-use token. A guided checklist walks through it. You can be live in an afternoon.

Which regulations does it cover?

The EU AI Act, the EU GDPR and the UK GDPR. The register, the exposure report and the audit trail are mapped to all three.

Can employees see what’s collected about them?

Yes. Right after enrolling, the extension shows each person what their organization can see: the kinds of data and counts, never the values. Transparency to the workforce is built in.

How are we billed?

Per employee on total headcount, billed annually by default (monthly available). The per-employee rate steps down as you grow, and Discover is free, forever.

See it on your own AI usage

Book a demo, or start with Discover.

In 20 minutes we’ll show you the shadow-AI picture for a team like yours and the register it builds, mapped to the EU AI Act and GDPR. Nothing your staff types has to leave their machines.

→ Live in an afternoon
→ Zero-retention by default
→ No third-party AI

Trusted in production: 7,800+ findings recorded across early deployments.