DRAFT FOR APPROVAL · not indexed, not live · content pending approval by Green Racks
AI Hardware LabSovereign AI · field guides Take the audit →

Self-assessment · about 3 minutes

Sovereignty Audit

Ten questions about your AI stack. Each answer scores 0 to 3. Scoring runs entirely in your browser, and nothing is sent unless you choose to submit the follow-up form at the end.

Progress0 / 10 answered

This is a conversation starter, not legal advice. For the background, read our CLOUD Act guide.

Q1 / 10

Where are your AI prompts and completions processed?

Why it matters: Check deployment types: 'Global' options can process prompts in any geography.

Q2 / 10

Who is the ultimate parent of your main cloud or AI provider?

Why it matters: The CLOUD Act turns on possession, custody or control, not on where the disks are.

Q3 / 10

Who holds the encryption keys for your sensitive data at rest?

Why it matters: Customer-managed keys inside the provider's own key service still sit with the provider.

Q4 / 10

Where do your embeddings / vector stores live?

Why it matters: Embeddings are derived from your documents and can reveal their content.

Q5 / 10

Do you know whether your AI provider stores prompts for abuse monitoring or logging?

Why it matters: Some providers keep flagged prompts for staff inspection unless you are approved to opt out.

Q6 / 10

Have staff been told which data can go into AI tools?

Why it matters: Most leakage is pasted in by well-meaning staff.

Q7 / 10

Does your privacy policy / APP 5 notice cover overseas disclosure by AI providers?

Why it matters: The OAIC suggests telling individuals when foreign law may compel disclosure.

Q8 / 10

Could you export and permanently delete all AI data (including logs and backups) within 30 days?

Why it matters: An exit plan is part of sovereignty.

Q9 / 10

Where would a self-hosted model physically run today?

Why it matters: Office cupboards throttle GPUs and trip circuits.

Q10 / 10

If you received a foreign data request tomorrow, would you know?

Why it matters: With a hosted provider the order may go to them, not you.