AI GOVERNANCE
Staff paste customer data, contracts and code into AI tools every day, often on personal accounts nobody can see. StructLine shows what leaves and whose account it is on, then turns it into an audit-ready record mapped to the EU AI Act and GDPR.
Live in an afternoon. No security team required.
Across early deployments
Governance dashboard
What your team is doing with AI
7
AI tools in use
3
On personal accounts
2
High-risk tools
1,284
Prompt submissions
Discovered tools
Latest high-risk findings
The governance dashboard. Sample data, illustrative.
THE QUESTIONS YOU WILL BE ASKED
Most staff who use AI on a work device reach it through a personal account. A client list goes into a personal ChatGPT and surfaces weeks later by accident. Then an enterprise prospect sends a security questionnaire, the cyber insurer asks at renewal, or an auditor wants the AI register, and the honest answer is a guess.
See it, prove it, stop it. The first two on every paid plan, the third with Enforce.
WHAT IT DOES
Every AI tool your team touches, with personal, corporate and other-organisation accounts told apart. Anything undetectable is marked unknown rather than assumed.
Every observation becomes an audit-ready artefact: the AI Register, an Exposure Report, vendor due-diligence records and an audit trail, mapped to the EU AI Act and GDPR.
Your policies act before anything leaves the browser: warn, coach towards the approved tool, block, or mask the sensitive values out of the prompt. Off by default, and it fails open, so a broken rule never takes a work tool down.
Masking, on the wire
What your teammate sends
Chase the overdue payment on DE89 3704 0044 0532 0130 00 and draft a polite reminder
What the AI tool receives
Chase the overdue payment on [REDACTED:IBAN] and draft a polite reminder
Mask rewrites the outbound request itself, on the device. With tokenisation on, the value becomes a reversible token instead, and the key never leaves your side.
Enforce never silently intercepts. An admin authors the rules, per team, role and tool, and flips the switch.
If a decision cannot be made in time, the send proceeds and the stand-down is recorded. Governance never takes a work tool down.
Every decision lands in a tamper-evident, hash-chained log: which policy, which action, when. Metadata only, never the content.
IN THE BROWSER
StructLine runs as an extension on every enrolled browser. Each person can open it and see, in plain language, exactly what their organisation sees. That transparency is often what gets a DPO or works council to say yes.
WHAT IT LOOKS FOR
Nearly every check has to add up: a real payment card, a valid passport number, an IBAN that passes its checksum. Everyday text does not set it off. StructLine names what it found, flags what the whole paste looked like, and estimates the size of a bulk one, all without keeping the text itself.
Analysis stages
Basic detection
4 foundDeterministic, on-device. Checksum-gated personal data, secrets and wallets. Always runs, and the only stage that runs in zero-retention mode.
Advanced detection (AI)
1 foundA self-hosted open-weights model for unstructured, contextual data: health details in prose, confidential project names, trade secrets. Opt-in, and never a third-party AI.
Custom policies
1 violationYour own rules, applied to every finding.
Names, email addresses, phone numbers and postal addresses. A list with no card numbers in it is still personal data, and StructLine flags it.
IBANs, credit and debit cards, VAT numbers and routing numbers, each validated so an ordinary number never trips the alarm.
National ID and passport numbers across the EU, UK, US and the Gulf, each checked against its real format.
Passwords, API keys and tokens for 15+ vendors, private keys, and database logins with embedded passwords.
Bitcoin and Ethereum addresses, checksum-verified.
No customer names, no unreleased code-names, no internal financials. Flagged in findings on every paid plan, enforced in real time on Enforce.
PRIVACY BY DESIGN
Most tools that watch AI usage store everything your staff write. StructLine is built the other way round, and each guarantee is precise about what it covers.
The pattern engine runs locally in the browser. In zero-retention mode the raw text is analysed there and never sent anywhere.
Which tools, personal or corporate accounts, the kinds of sensitive data, how much and when. All without storing a single word your team typed.
Opt into deeper AI detection and it runs on an open-weights model StructLine hosts, or that you host. Your data never goes to OpenAI, Anthropic or Google.
Right after enrolling, the extension shows each person what the organisation can see: the kinds of data and counts, never the values.
Full data control
Configurable retentionOne-click org-wide erasurePer-person GDPR exportStrict tenant isolationCOMPLIANCE OUTPUTS
Other tools give you an alert. StructLine gives you the record: clean, self-contained documents you can hand to an auditor or attach to a security questionnaire.
One entry per discovered tool: purpose, deployment type, accounts seen, data categories, risk, the vendor profile, EU AI Act transparency notes (Art. 50) and a GDPR block (Art. 30, plus DPIA recommended yes or no, with named reasons).
What is actually happening: totals, the categories flowing out and to which tools, top risks, and per-tool and per-person breakdowns. Both export as PDF.
AI Register · entry
HIGHChatGPT
OpenAI · SaaS assistant
Admin
Manages everything across the organisation.
Compliance
Read-only, org-wide, for auditors and DPOs.
Users
See only their own activity.
A full audit trail records every privileged action, as metadata only, never content or secret values.
Mappings show where StructLine helps you meet each framework. They are not a certification, an audit or legal advice. Regulatory references current as of mid-2026.
EARLY DEPLOYMENTS
Five AI tools found in week one where the firm expected two or three, with 33% of activity on personal accounts.
“Now when a client asks how we govern AI, we have the register to show them.”
Fifteen people with due-diligence material and portfolio financials in the browser all day. The first scan flagged 20% of activity on personal accounts.
“When a founder asks how we handle their numbers, the answer is on file.”
Across all early deployments: 7,800+ findings recorded, 37% involving personal accounts.
PRICING
Governance covers everyone's AI use, so the price follows total headcount and the rate steps down as you grow. Discover is free. Above 250 people, or for in-region and on-premise deployment, we scope a Sovereign contract with you.
The way in.
€0
Any team size
The evidence layer.
€125/month flat
Teams up to 25, then €4.50 per employee per month
Active control, on your terms.
€375/month flat
Teams up to 25, then €11 per employee per month
For 250+ and regulated, in-region.
Custom
Annual contract, scoped with you
Rates by team size, billed yearly
| Team size | Comply | Enforce |
|---|---|---|
| Up to 25 | €125 /month flat | €375 /month flat |
| 26 to 100 | €4.50 /employee/month | €11 /employee/month |
| 101 to 250 | €3.50 /employee/month | €8.50 /employee/month |
| 250+ | Sovereign | Sovereign |
List prices, billed yearly. Monthly billing is available at a higher rate.
Prices are net of VAT and in EUR.
QUESTIONS
Only if you ask it to. Discover and Comply observe and record; nothing is intercepted. On Enforce, an admin turns on policies that warn, coach towards approved tools, block, or mask sensitive data, decided on the device. Enforcement ships off by default and fails open, so a broken rule never takes a tool down.
By default, no. Zero-retention records metadata only: the tool, the account type, the kinds of data and counts. Content collection is a separate, explicit admin opt-in, with redaction on by default even then.
No. AI detection runs on an open-weights model StructLine hosts itself, or that you host in a Sovereign deployment. No third-party AI provider is involved at any stage.
No. An admin adds the corporate domains, picks a privacy mode, invites the team and enrols a device with a single-use token. Most teams are live in an afternoon. For larger rollouts we run the pilot and go-live with you.
The EU AI Act, the EU GDPR and the UK GDPR. The register, the exposure report and the audit trail are mapped to all three, alongside ISO 27001, SOC 2, ISO 42001 and PCI-DSS controls.
Yes. Right after enrolling, the extension shows each person what the organisation can see: the kinds of data and counts, never the values.
Per employee on total headcount, billed yearly by default with monthly available. The per-employee rate steps down as you grow, and Discover is free.
SEE IT ON YOUR OWN AI USAGE
In twenty minutes we show you the shadow-AI picture for a team like yours and the register it builds, mapped to the EU AI Act and GDPR. Nothing your staff type has to leave their machines.
WHAT COMES WITH IT