Risk & compliance
Where is AI leaking
your data
out of Kenya?
A written map of generative-AI exposure, tools, prompts, and DPA risk, a written map, free of a maturity score nobody reads.
Somebody on your payroll opened ChatGPT this morning and pasted something they shouldn’t have. You probably can’t name who, which file, or which vendor region processed it. That gap is what the KDPA AI audit closes.
What we hunt for
Shadow tools beat approved tools, every time.
Under Kenya’s Data Protection Act, localisation and transfer rules carry real weight, far from academic. ODPC can levy serious penalties. More painfully, you cannot answer a board question with “we think people are careful.”
Read the deeper legal framing on our KDPA AI compliance pillar. The audit is the engagement that turns that pillar into your facts.
Deliverables
Files your CISO and counsel both keep.
Inventory
Named tools, owners, and whether usage is sanctioned or shadow.
Flow map
Narratives of where prompts and uploads go geographically.
Risk stack
Ranked: stop / contain / replace / accept, with owners.
Buy path
Whether you need private chat, gateway, managed GPUs, or on-prem next.
$ corvux audit --org your-org --out report TOOLS 11 found (6 unsanctioned) HIGH RISK KYC PDFs → foreign chat UI RECOMMEND private-chatgpt pilot + gateway shadow ✓ report.pdf + backlog.csv delivered
FAQ
Before you send the PO.
Is this a legal opinion?
No. It is a technical and operational exposure assessment your counsel and DPO use inside their KDPA programme.
How intrusive is discovery?
Interviews first. Optional SaaS exports, browser-extension reviews, and API-key scans with your approval.
How fast?
Most organisations: 1–2 weeks to report if stakeholders show up.
What do we get as files?
Inventory spreadsheet, data-flow narrative, ranked backlog, and a remediation workshop deck.
Book the audit
Fixed scope. Nairobi team. Clear next step into private AI, or an honest “you’re fine for now.”
Request audit pricing