What we investigate
Determine whether information was merely accessible to the application, retrieved into context, returned to a user or sent to an external destination. Those are different exposure states.
Response work to agree
- Identify data owners, source systems and permission boundaries.
- Preserve relevant retrieval IDs, access logs and delivery records without creating unnecessary copies of sensitive data.
- Trace identities and recipients, including shared sessions, exports and external integrations.
- Coordinate containment and factual evidence with the organisation’s privacy, legal and communications owners.
What safe recovery requires
The response report separates confirmed disclosure, possible exposure and unknowns. Legal notification decisions depend on the facts and applicable obligations; a public enquiry does not determine them.
Start with a non-sensitive brief
Use the incident brief builder or contact the team. Describe the affected service, observed impact and whether activity is ongoing. Availability, authority and delivery scope are confirmed before response begins.
Turn observations into investigation questions
| Observation | Evidence to seek | Decision to resolve |
|---|---|---|
| A restricted file was available to an assistant | Source permissions, identity and access history | Was there an access-control failure, even without confirmed disclosure? |
| Sensitive material entered a response context | Retrieval IDs, session audience and output record | Did it remain internal or reach an unintended user? |
| Data was sent to an external integration | Destination, request and receipt records | What evidence supports actual delivery? |
Keep impact statements tied to evidence
Avoid treating every record the application could access as confirmed exfiltration. Equally, an absence of delivery logs does not prove that no data left. State the observed population, the suspected population and the reason for each uncertainty. Privacy and legal owners use this factual account for their decisions.
What we agree to deliver
The scope identifies the questions to answer, records available, customer owners and permitted changes. Typical outputs include an event timeline, the affected boundary, approved containment actions, recovery checks and unresolved risks. The deliverables page explains how findings connect to evidence.
Continue with ai data exposure assessment, or compare response engagement options.
