Outsourced DPO: your clients' AI, feature by feature, with the source.
What each AI reads at your clients, where the vendor processes the data, whether it trains its models on it, and the frameworks the public catalog links to it. The assessment remains yours.
A DPO's questions
- Which AI features touch employee, candidate or customer data?
- Which ones send data outside the European Union, and which ones train their models on it?
- A vendor changed its terms: what changed, and for which tools?
- How do I follow all my clients’ AI without spending my weeks on it?
What Ojja gives you
- A fact sheet per feature. A data sheet per tool and per edition: what it reads, where the data goes, whether it trains its models on it.
- Sovereignty. The place of processing, training on your client's data (yes, no, or not documented by the vendor), the date the vendor's data processing agreement was read, the date of its latest terms changes. An alert when a vendor changes its terms.
- Linked frameworks. The frameworks the public catalog links to each feature (data protection, the regulation on artificial intelligence, cybersecurity, information and consultation of staff representatives), each with its point to review. When the point has been reviewed, the line says so, with the date and the document.
- The law in the feed. When a text is published, the number of features at each of your clients that the catalog links to it, and the points to review.
- All your clients, each apart. One line per client in your portfolio; nothing passes from one client to another.
- Your assessment, in its place. If you are your client’s DPO, you are the one who reviews these points with them; Ojja never settles them.
On the Arvenne example
The third count of Arvenne's readout covers two AI features: the image generator, which trains on content, and the meeting transcription tool, which processes outside the EU. The meeting recaps fact sheet, a sample sheet with fictional values, says what it reads: meeting transcripts; where the data goes: the European Union; whether it trains on your data: no; whether it is on by default: yes. Linked framework: data protection.
Arvenne, a fictional company · sample data
What Ojja never does
- Ojja does not say whether a use is permitted: it gives the facts, and the points to review with your counsel.
- Ojja never concludes: no risk level, no role, no assessment of whether a text is respected.
- Ojja reads registers and configurations, never your clients' content.
- Ojja gives no figure per person.
Ojja does not provide legal advice: it records and documents; how the law applies to your situation is for your counsel to determine.