Outsourced DPO: your clients' AI, feature by feature, with the source.
What each AI reads at your clients, where the vendor processes the data, whether it trains its models on it, and the frameworks the public catalog links to it. The assessment remains yours.
A DPO's questions
- Which AI features touch employee, candidate or customer data?
- Which ones send data outside the European Union, and which ones train their models on it?
- A vendor changed its terms: what changed, and for which tools?
- How do I follow all my clients’ AI without spending my weeks on it?
The processes you carry at your clients
- Keeping your clients’ register up to date when a vendor changes its terms.
- Reviewing a new tool.
- Answering an access request or a candidate’s request.
- Answering a customer’s or an insurer’s questionnaire.
What Ojja takes off your plate
- Rereading each vendor’s terms and data processing agreements, for each client. Ojja estimate: 3 to 5 days per year per client, for 20 AI tools.
- Rebuilding the state of a tool at a given date. Ojja estimate: 1 to 3 days per request.
At launch, many catalog facts show as “not documented”: the catalog fills up tool by tool.
Each “Ojja estimate” is a starting order of magnitude, set by Ojja with its assumption when it has one: neither a measurement nor a promise. The measurements of our first customers will replace it.
Your levers, therefore your engagements
- Reviewing the data, lever by lever, coming. Each of your client’s levers shows the data it touches; you put it under review and give your dated opinion.
Your dated reason to call
- The alert when a vendor changes its terms, attached to each client’s tools.
What Ojja gives you
- A fact sheet per feature. A data sheet per tool and per edition: what it reads, where the data goes, whether it trains its models on it.
- Sovereignty. The place of processing, training on your client's data (yes, no, or not documented by the vendor), the date the vendor's data processing agreement was read, the date of its latest terms changes. An alert when a vendor changes its terms.
- Linked frameworks. The frameworks the public catalog links to each feature (data protection, the regulation on artificial intelligence, cybersecurity, information and consultation of staff representatives), each with its point to review. When the point has been reviewed, the line says so, with the date and the document.
- All your clients, each apart. One line per client in your portfolio (coming); nothing passes from one client to another.
- Your assessment, in its place. If you are your client’s DPO, you are the one who reviews these points with them; Ojja never settles them.
On the Arvenne example
The third count of Arvenne's readout covers two AI features: the image generator, which trains on content, and the meeting transcription tool, which processes outside the EU. The meeting recaps fact sheet, a sample sheet with fictional values, says what it reads: meeting transcripts; where the data goes: the European Union; whether it trains on your data: no; whether it is on by default: yes. Linked framework: data protection.
Arvenne, a fictional company · sample data
What Ojja never does
- Ojja does not say whether a use is permitted: it gives the facts, and the points to review with your counsel.
- Ojja never concludes: no risk level, no role, no assessment of whether a text is respected.
- Ojja reads registers and configurations, never your clients' content.
- Ojja gives no figure per person.
Ojja does not provide legal advice: it records and documents; how the law applies to your situation is for your counsel to determine.