DoNotLeakFor DPOs
Are you a DPO? Everything is ready to frame the AI your teams already use.
Documents leave for AI assistants from every desk; you see none of them, and you are the one people will turn to. Take the diagnosis, then run the 90-day plan with a kit ready to adapt, to show your due diligence. Free, with no form and no address to leave.
Your organisation’s diagnosis
How well does DoNotLeak fit you?
A first inventory in ten questions, not a DPIA: a score out of 100 and the paths that fit you. Nothing is sent: everything is computed in your browser, and the link can be shared with your management.
Your result
Answered: 0 of 10
Answer a first question: your result builds here as you go.
20 / 100
Not a priority today
Said plainly: from your answers, DoNotLeak is not what you need first. The kit below stays free, and useful.
Where this score comes from
- Exposure0 / 50
- Suspected uses: 0 of 30 — a personal account counts 20, “I don’t know” 10, each other use 5.
- Sensitive data: 0 of 20 — 4 per category ticked (0).
- Coverage0 / 30
- No document language ticked yet.
- Deployability20 / 20
- The page, the API and the server image exist today.
Computed in your browser — none of your answers is sent or kept. The link carries your answers after the #, the part of an address a browser never sends to a server.
What we recommend
Try it now
Paste a fictional text on the home page and see what would leave. To show it to your teams: the awareness webinar (in French for now), in the kit below.
Open DoNotLeakA customised instance
An instance set to your documents and your languages — let’s define it together.
Message Contee on LinkedInThe API in your flows
Your workflows call DoNotLeak just before the AI or the partner: only the protected text goes on.
The API and hostingOn your own servers
The server image runs on your machines, behind your identity provider: the texts never leave your information system.
Hosting it yourselfAccompaniment
Training at three levels — everyone, managers, the Seals — and leading the change: the 90-day plan below.
The 90-day kit
The kit
A frame in 90 days, and the means to prove it.
Seven streams, from the executive committee’s sponsorship to notifying a breach. What exists downloads freely; the rest is on its way.
The whole kit, in one archive
Every deck of the kit, free, in French or in English: one .zip file, no form.
PDF and Word versions, and the site’s eight other languagesSoon
Days 1–15
Decide
- The calculator, for your executives
The executive-committee note
PowerPoint · FR, EN
Fifteen minutes to win a sponsor: the situation, the risk, what the texts say, the plan, the decision asked.
- Read the Shadow AI page
The problem, sourced
Web page
Shadow AI as your teams live it, each figure with its source.
Days 1–30
Frame
- The texts and the frame: governance
The AI charter
PowerPoint · FR, EN · The example AI charter
Ten short sections to adapt: the instructions the organisation gives everyone — allowed and forbidden uses, what to protect first, whom to call.
DoNotLeak’s entry for your record
PowerPoint · FR, EN · The templates to copy
The tool’s entry in the record of processing activities, ready to copy.
Elements for your DPIA
PowerPoint · FR, EN · The templates to copy
What concerns the tool in your impact assessment, ready for the file.
The vendor security questionnaire, pre-answered
PowerPoint · FR, EN · The templates to copy
Each answer with its evidence — the controls are already described, and verifiable, on the security page.
A note for the works council
PowerPoint · FR, EN
Informing staff representatives about the tool and the charter — to have reviewed by your counsel.
Days 31–45
Launch
The communication plan
PowerPoint · FR, EN · The 90-day plan
Who says what, to whom, through which channel, how often.
Announcement e-mails
PowerPoint · FR, EN · The templates to copy
Three texts to copy, without jargon: management announces the frame, the webinar invitation, the call for Seals.
Posters and a leaflet
One picture, one line, one call.
PDF, A4 and A3Soon
The awareness webinar, 45 minutes
PowerPoint · FR, EN · The awareness webinar
28 slides for all staff: where the data goes, who answers for what, the right reflex before each prompt, what to do if something left. The sources are in the notes.
Days 31–75
Train
Training at three levels
PowerPoint · FR, EN
Everyone (the webinar), managers, and the Seals — Seal and Engage Against Leaks: in each team, a volunteer who relays the reflex and answers questions.
The managers’ trainingSoon
The training attestation
It records that a person followed the training — a trace, for your documentation, of the measures article 4 of the AI Act asks for. Not a certification: no certificate is required.
PDFSoon
Days 46–90
Animate
The Seals’ kit
PowerPoint · FR, EN
Launch the community in five steps, then keep it alive: rituals, three levels, points to earn.
The newsletter, the badges and the gameSoon
Days 61–90
Measure
Volumes, never people
PowerPoint · FR, EN · The 90-day plan
Tools approved, people trained, incidents reported; DoNotLeak’s detections by type of data once it runs inside — never the content.
At any time
React
- The incident path, on the governance page
The incident path
PowerPoint · FR, EN · The templates to copy
Say it at once, contain, assess, notify the supervisory authority within 72 hours where feasible, unless the breach is unlikely to result in a risk to people: a report form, the elements of the notification and the letter to the people concerned, to adapt.
These documents are examples to adapt with your counsel: none of them is legal advice.
Your questions
What a DPO asks first — and where the proof is.
Each answer links to the page that proves it; what does not exist yet is said as such.
If something leaks, will they turn to me?
The controller is the organisation: it puts the measures in place and must be able to demonstrate compliance (GDPR, article 24). The CNIL, France’s authority, says so: the DPO is not personally responsible for the organisation’s non-compliance. Your role — inform, advise, monitor, raise awareness (article 39) — the kit makes visible, item by item.
Another tool nobody will use?
Ten seconds, no account, nothing to install: paste a text, see what would leave, keep what the AI needs. The reflex is learnt in the gesture itself: each detection is shown with its type, before sending.
Where does the data go?
The text you scan is processed in memory for the time of the scan, then forgotten: it is neither stored nor logged. The service calls no one — no AI provider, no third-party service. It is hosted by OVH, a French company, and published by Contee, in Paris.
Is it a surveillance tool?
No. The page asks for no account and sets no audience-measurement cookie; nobody reads what people write. The measurement the kit proposes counts volumes — tools approved, people trained, incidents reported — never people.
Is the detection perfect?
No, and the page says so: every detection lets something through. DoNotLeak shows everything it found, and the person reviews before sending. Replacing is pseudonymising, not anonymising: the protected text is still personal data under the GDPR.
Can it stay in the EU — or inside our walls?
The public page is hosted by OVH, a French host. For your teams, the same scan comes as a headless server image to run on your own servers, behind your identity provider: the texts never leave your information system.
And the works council?
The example charter is adapted with your staff representatives, where required. The kit holds a note for the works council, with four slides for the meeting, to inform them about the tool and the charter — to have reviewed by your counsel.
How do we meet article 4 of the AI Act?
Since 2 February 2025, an organisation that uses AI systems takes measures to develop its staff’s AI literacy; no certificate is required. The awareness webinar and the Seals’ training download today; the managers’ training, and the attestation that keeps its trace, are on their way.
The managers’ training and the attestationSoon
Start with your organisation.
Ten questions, a kit with no form, the tool to try with no account on a fictional text. An instance set to your documents, your own servers, support in leading the change? Write to Contee.