Skip to content
Pro IT NW

AI services

Secure AI for business.
Start with the AI your staff already use.

Your people are probably using ChatGPT, Claude or Gemini at work already, often on personal accounts, with no policy and no admin control. We find what is in use, move it onto a business tier you control, and put rules and real controls around it. AI makes skilled people faster. The job is to make that safe, not to stop it.

Start a project → See how we engage

Secure AI for business, at Pro IT NW, a Seattle-based consultancy, means getting control of the AI tools your staff already use before adding new ones. We find what is in use, move people off personal accounts onto a business tier the company controls, set the admin and data settings, and write a policy backed by real controls. It is for owners, practice managers and IT leads. We resell no AI licenses and give no legal advice.

What does securing AI for a business involve?

It means knowing which AI tools are in use, who controls the accounts, and what data goes into them.

  • An inventory of the AI tools in use, and roughly how many people use each
  • Moving staff off personal accounts onto a business tier the company owns, with single sign-on
  • Admin and data settings on that tier: who can use it, what is retained, what is shared
  • An AI acceptable-use policy in which every rule maps to a control you can enforce
  • Data-loss prevention and discovery in Microsoft 365 and Microsoft Purview, where you already have the licenses
  • A clean way to remove access when someone leaves

Why does a personal AI account matter?

A personal AI account is an arrangement between the employee and the vendor, not the company.

  • The company has no admin console for it and cannot see what was shared
  • Consumer and business tiers can differ on data handling and retention
  • A policy with no matching control is just a memo

Where do we start? With an AI risk assessment.

The entry engagement is an AI risk assessment: a written reading of where AI is used, what data goes into it, and what to fix first.

For firms whose staff already use AI tools, that assessment takes the shape of our AI usage review. It covers four things: discovery of which AI tools are in use and by how many people; a data-exposure check of what is likely going into them and what your DLP can and cannot catch; an AI acceptable-use policy draft with an approved-tool shortlist; and a tool selection and setup plan to move staff onto a business tier the company controls.

How it runs

How does a secure-AI engagement run?

Each engagement is scoped up front, runs in a fixed order, and ends with written output you keep.

  1. Step 01

    Scope call

    Headcount, the tools you think are in use, the discovery data you have, and whether regulated data is involved.

  2. Step 02

    AI risk assessment

    Discovery, the data-exposure check, and a prioritized list of fixes in plain language.

  3. Step 03

    Sanctioned tool and settings

    You buy the business tier from the vendor you choose. We configure single sign-on, admin roles and data settings.

  4. Step 04

    Policy, controls and handover

    The acceptable-use policy, the controls that enforce it, and a walkthrough for your IT staff so they can run it.

What do we get at the end?

You get written findings, a configured tool, and rules your IT staff can enforce.

  • Discovery findings and a data-exposure summary
  • An AI acceptable-use policy draft with an approved-tool shortlist
  • A business-tier AI tool set up with single sign-on and the data settings you chose
  • A map of which control enforces each policy rule
  • A short recommendation for leadership on what was sanctioned and why

What is this not, and who is it for?

This is hands-on security work for the business that uses AI, not a sales channel for an AI product.

  • Not a resale channel: no license margins, no partner badges; you buy any tool from the vendor of your choice
  • Not legal advice: your counsel owns legal determinations
  • Not a plan to replace your IT staff: AI is a force multiplier for skilled people, and we train your team to run it
  • For owners, CFOs and practice managers who need an answer they can defend, and IT managers who have to make it work

Related

FAQ

Common questions about securing AI at work.

Our staff already use ChatGPT or Claude on personal accounts. What should we do first?

Find out what is in use before writing any rules. Banning AI outright rarely holds, because people move to their phones. The practical order is discovery, then a sanctioned business-tier tool that is at least as good as what people use now, then written rules with technical controls behind them. A personal AI account is an arrangement between the employee and the vendor, and the company has no admin console for it.

What is an AI risk assessment?

An AI risk assessment is a written reading of where AI is used in your business, what data goes into it, and which risks matter enough to act on. At Pro IT NW it is the entry engagement for securing AI. It covers the AI tools in use, the data likely going into them, what your existing data-loss controls can and cannot catch, and a prioritized list of fixes. It is operational and technical, not legal advice.

Do you only recommend Microsoft Copilot?

No. Pro IT NW is vendor-neutral and resells nothing, so we set up whichever AI tool fits how your people work, whether that is Claude, ChatGPT, Microsoft 365 Copilot, Gemini or a mix. Where you run Microsoft 365, discovery and data-loss controls often use Microsoft Purview and Defender features you may already license, but the AI tool itself is your choice.

Is the AI acceptable-use policy legal advice?

No. Pro IT NW drafts the operational policy: which tools are approved, what data may and may not go into them, how access is granted and removed, and which control enforces each rule. Your counsel, HR and, where it applies, your privacy officer own the final wording and any legal determinations.

How much does it cost?

It is scoped on a call. The effort depends on headcount, which AI tools are already in use, what discovery data you have such as firewall, proxy or Defender for Cloud Apps logs, and whether regulated data such as health records or controlled unclassified information is involved. You get the scope before any work starts.

Free checks

Not ready to talk yet? Start with one of these.

Sample report

See a Copilot readiness report

A sanitized sample assessment: findings scorecard, readiness ratings and remediation roadmap, so you can see what you would get.

Open →

10 questions

Could you take back the keys?

Ten yes / no questions: could you remove your IT provider's access without their help and keep control? Admin accounts, domain, licenses, backups, contract dates.

Open →

Runs in your browser

Who controls your domain?

See who runs your domain's DNS, where your email goes, whether you publish DMARC, and whether on-prem Exchange is still visible. Nothing stored.

Open →

Find out what AI is already in use.

Tell us roughly how many people you have, which AI tools you think they use, and whether regulated data is involved. We'll come back with scope.

Start a project →