Free Self-Audit

The 5-Question Shadow AI Self-Audit

Five questions that reveal where your business is leaking time, money, or risk through AI tools nobody's tracking. Score yourself in 90 seconds. No email required to read.

From the team that does Shadow AI audits for Digital Worker customers. This is the self-serve version.

01

How many AI tools is your team actually using right now? Name them.

Most founders guess three. Actual count is closer to twelve when you include Chrome extensions, Copilot features baked into existing products, free-tier ChatGPT accounts people signed up for personally, and AI features quietly rolled into your CRM, email, and note-taker.

2 points — you have a written list you update monthly.
1 point — you can name 5+ but haven't written it down.
0 points — you can name 3 or fewer, or you know there's more but you haven't looked.
02

Who has OAuth access to your Google Workspace, Microsoft 365, or CRM? When was the last review?

Every AI tool your team has ever connected to your email, calendar, or CRM still has access. Even the ones they tried once and forgot about. A typical business accumulates 20+ OAuth grants before anyone does a cleanup.

2 points — you've reviewed OAuth grants in the last 90 days.
1 point — you know where to find the list but haven't reviewed recently.
0 points — you've never looked or don't know where to start.
03

If an employee pasted a customer list into ChatGPT yesterday, would you know?

This is the single highest-frequency data leak happening in Canadian and US businesses today. Employees don't know their ChatGPT inputs may train future models or sit in breach-risk databases. Nobody tells them because nobody's looking.

2 points — browser-layer DLP or equivalent monitoring is in place.
1 point — written policy exists, no monitoring.
0 points — no policy, no monitoring, no idea.
04

What is your email deliverability rate right now? Spam-complaint rate?

If you do any cold outreach or marketing email, these numbers determine whether you reach inboxes or junk folders. Most founders have zero visibility. Google Postmaster Tools is free and will tell you in 10 minutes.

2 points — deliverability above 95%, spam rate under 0.1%, you check weekly.
1 point — you know the numbers but haven't checked this month.
0 points — you don't know either number.
05

If a competitor had read-only access to your AI tool transcripts for a month, what would they learn?

This is the question most founders have never asked. Every conversation you have with Claude, ChatGPT, or Copilot is a window into your strategy, your customer list, your pricing, your problems. Your competitor can't see them. Your AI vendor can. That gap matters.

2 points — you use a zero-retention or local-model deployment for sensitive work.
1 point — you have internal rules about what not to paste.
0 points — you have not thought about this before.

What your score means

8 to 10 points: you have actual shadow-AI governance. Rare. Keep it up.
5 to 7 points: you know about the risks but have not operationalized them. Middle of the pack.
0 to 4 points: shadow AI is running your business without oversight. Not unusual, but actionable.

Most founder-led Canadian businesses score between 2 and 4. The good news: moving from 3 to 8 takes about one week of focused work, not six months.