Security and data protection

Collect less

• Only AI tools on our published catalogue are recorded. Other websites and applications are ignored on the device.
• By default only metadata is recorded: the tool, the time spent, and what kind of account was used. Not what people type.
• Account email addresses stay on the device unless the organisation turns on account identification; otherwise only the domain and a hash keyed per organisation leave the device.
• Cookie values, passwords and sign-in tokens are never read or stored. To tell company from personal accounts the extension only checks whether a sign-in cookie exists.

Prompt capture, when an organisation turns it on

• Off by default. Turning it on requires an administrator to confirm a data protection impact assessment, and the change is recorded in the audit log.
• Text is redacted on the device first: passwords and keys, card and bank details, National Insurance numbers, email addresses and phone numbers are replaced by placeholders.
• It is then encrypted on the device (AES-256-GCM, with the data key wrapped by an RSA-4096 key specific to the organisation and month) before it is sent. The private keys are held in a dedicated key-management service; our servers store only ciphertext.
• Only administrator roles can read it, only within 10 minutes of passing a second factor, and every view is audit-logged.
• It is deleted automatically after the organisation's retention period (7 to 730 days). Destroying an organisation's keys makes any remaining copies, including those in backups, unreadable.

Access control

• Every request is checked against the user's role and organisation on the server, on every call. Removing someone's access takes effect immediately.
• Administrator roles need a second factor: a passkey (Windows Hello, Touch ID, a security key or phone), an authenticator app, or Microsoft sign-in with multi-factor authentication.
• IT providers see only their own clients. Client organisations see only themselves. Group managers see only the people in their groups.
• EAISight operators sign in with Microsoft and multi-factor authentication, from an allow-list of named identities.
• API keys are shown once and stored only as a hash. OAuth access for AI assistants (MCP) uses short-lived tokens that a user approves and can revoke.

Devices and transport

• Devices enrol with a key issued by the organisation's IT provider and then authenticate with their own signed device tokens, which can be revoked from the console.
• All traffic between devices, browsers and EAISight is encrypted with TLS.
• The browser extension talks only to the agent on the same device; it does not send data to the internet itself, and it has access only to the AI tools on the catalogue and to search result pages.

Hosting

EAISight runs on infrastructure in the United Kingdom operated by Fulcrum IT Services Ltd. Each service has its own database account, internal services are not reachable from the internet, and secrets are kept out of source code.

Sub-processors

These providers process personal data on our behalf. We will update this list before adding a new sub-processor that handles monitoring data.

Provider	What for	Data	Location
Stripe	Payments, invoices and payouts to IT providers	Billing contacts, organisation names, device counts, payment details	UK, EU and USA
Microsoft	"Sign in with Microsoft", only for users who choose it	Sign-in identifiers	EU and USA
Email delivery provider	Invitations, sign-in links, security and billing emails	Name and email address of console users	—

Monitoring data itself (AI usage records and captured prompts) is stored only on our UK infrastructure.

Reporting a security issue

If you think you have found a security vulnerability, please email help@eaisight.com with the details. Please do not access data that is not yours or disrupt the service while investigating. We will acknowledge your report and keep you informed.

See also our privacy policy and the monitoring notice for staff.