AI assistants are quickly becoming part of everyday tools: the backlog, the inbox, the document library. Each one sends content to a model. Before you switch one on, it’s worth knowing exactly where that content goes.
Follow the data path
Ask the vendor to draw the path a single prompt takes, from the user’s screen to the model and back. Every system on that path can, in principle, see or store the content. Fewer systems means fewer questions from your security team.
What “in your tenant” means
When an assistant runs in your own Azure subscription and uses a model deployment you own, content stays inside your cloud agreement. Your existing security controls, logging and data residency settings apply. The vendor provides software, not a service in the middle.
Questions to ask any vendor
- Does any content reach systems you control? Prompts, outputs, usage counts and identities all count.
- Is there telemetry? Ask what is collected, and whether it can be switched off.
- How is the licence checked? A check that calls the vendor is also a data path.
- Can we verify it? The honest answer is a network inspection you can run yourself.
- Does a person approve changes? An assistant that writes directly into your systems needs a review step.
How we answer them
We built G-Code for DevOps around these questions. It runs in your own subscription, sends nothing to us, checks its licence offline and writes nothing until a person approves it. You can check every one of those claims yourself.