Superseded content
63 outdated documents are searchable and can outrank current policy.
Step 6 of 12Risk flags
Compare with the red-team review
Sign in to save your workCompare your analysis with the red-team review. Each flag is a line of enquiry, not a conclusion.
No permission filtering
Answers can draw on documents the user is not allowed to open.
Confidential disclosure
A consultation plan was disclosed, a personal data and employee-relations incident.
Hallucination fallback
When no source exists, the model invents plausible but false policy.
Third-party personal data
Users paste colleagues' information, which is sent to the supplier and retained.
Indefinite logs
Conversation logs are kept forever and accessible to IT admins.
Uncontrolled model changes
The supplier can change the model without notice.
No content ownership
121 documents have no owner, so nobody keeps them current.
Phase 2 escalation
Connecting payroll raises the severity of every access-control failure.
No DPIA
High-risk processing of employee data started without a documented assessment.
What did you find, and what did you miss?
Which of these did your earlier analysis already cover?
Which did you miss? What does each change about your assessment?
Answers save automatically and sync to your account when you are signed in.