Hidden Tokens / Shadow AI diagnostic
Shadow AI diagnostic: 12 questions, your score and three priorities
"Shadow AI" is the AI your teams use without a framework: personal accounts, client files pasted into a conversation, no trace. Twelve questions, ten minutes, to measure your exposure and see where to start. To be filled in by management, the DPO, the IT department or the partner in charge.
Your answers never leave this browser. No personal data is requested and nothing is sent: no form, no server, no analytics on your answers. They are kept on this device only, so you find them if you reload the page; "Start again" deletes them. If you choose to send us your score, the message carries only the score and the level.
hiddentokens.com/shadow-ai-diagnostic · Shadow AI diagnostic · · info@hiddentokens.com
Your result
12 questions left
Under control
AI has a framework. What remains is to prove it: a log of what the AI received and an attestation for your clients.
Needs a framework
AI is being used faster than the rules are written. A policy and a tool that enforces it are enough, if they come now.
Exposed
Client data is probably going to the AI in plain text, with no trace. Start by measuring: the leak test shows in 15 minutes what has already gone.
Score by area
- Use and data0 / 12
- Rules and profession0 / 9
- Control and proof0 / 12
- Phones0 / 3
Your three priorities
- Measure what has already left. use and data In 15 minutes, on your own computer, the leak test counts the names, IBANs and case numbers already in your ChatGPT or Claude history, and lists the conversations to delete first. We never see any data: you only show us numbers. You can also run the leak scanner yourself.
- End personal accounts. use and data An organisation AI account for everyone who needs one, and one simple rule: no organisation data on a personal account.
- Write the rule down. rules and profession A one-page AI use policy with a golden rule: no identifying data goes to an AI except through a tool that codes it. We give you our template, adapted to your country and your profession, in Word.
- Train the teams. rules and profession One hour is enough for the golden rule, the watched folder and reviewing the plan. For organisations established in the EU, the EU AI Act has required AI literacy since 2 February 2025.
- Make the rule automatic. control and proof Hidden Tokens codes your files on the computer before the AI reads them, in Claude, ChatGPT, Gemini, Copilot, Le Chat, Perplexity and DeepSeek. The rule no longer depends on everyone's goodwill.
- Be able to prove it. control and proof The "What Claude saw" log, the coverage report for your DPO and the seal your client verifies themselves: the answer to "what did the AI receive from my file?" becomes a page, not a promise.
- Close the phone door. phones Hidden Tokens doesn't cover phones today. The policy must say so: no client or employee data in an AI on a phone.
What we suggest
The pilot, for the proof (log, coverage report, seal).30 days · deducted from your first year
The free AI policy, then the pilot.1 week, then 2 · free
The leak test, this week.15 minutes · free
WhatsApp +212 680 092 567 or info@hiddentokens.com: we reply within one business day, free and with no commitment. The prefilled message contains only your score and level, never your answers.
Hidden Tokens · hiddentokens.com · info@hiddentokens.com. This diagnostic is neither an audit nor legal advice.
How the score works
Each answer is worth 0 to 3 points; the total is out of 36. The four areas are scored separately, and your three priorities come from the areas with the highest share of their maximum.
| Score | Level | What it means |
|---|---|---|
| 0 to 9 | Under control | AI has a framework. What remains is to prove it. |
| 10 to 20 | Needs a framework | AI is being used faster than the rules are written. |
| 21 to 36 | Exposed | Client data is probably going to the AI in plain text, with no trace. |