Turn your organisation’s privacy requirements into clear checks, so you can identify applications that conflict with them.
We analyse application code, legal documents and public information to connect privacy signals across data types, purposes, third parties and locations — and identify privacy violations.
Application Approval Policy
“This policy applies to applications used for work documents and meeting content. AI processing of this content must remain within the European Union and the UK, including processing by external model providers.”
Fireflies
Alert
Craft
Warning
Bluedot
Compliant
Check your software
Identify which privacy practices need review, and what information is missing before you adopt an application.
Each result comes with an explanation — see exactly what triggered an alert or warning and how the app’s privacy signals connect.
FirefliesAlert
DataAudio recordings
DataText prompts
ProcessingAI processing
RecipientExternal AI model providers
Processing regionUnited States
Give your team evidence
Explore the documentation and code behind each privacy signal, so your team can investigate warnings and make an informed decision.
Bring traceable evidence into supplier reviews, privacy impact assessments and AI risk assessments. Use findings linked to your requirements and their sources to support relevant ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 assessment activities.
FirefliesAlert
Audio recordings
APK Code
AudioRecord.startRecording()AudioRecord.read(...)
Terms of Service
“…including the content of meetings or recordings you grant our Services access to…”
AI processing
Terms of Service
“…for the purpose of generating transcriptions, summaries and other responses…”
External AI model providers
Subprocessor list
OpenAI
Anthropic
United States
Product docs
“By default, your data is stored and processed in Fireflies' secure cloud infrastructure in the United States (AWS and GCP).”
How the pilot works
We identify your privacy requirements, assess your chosen applications and present the findings in an interactive report with supporting evidence.
Identify your requirements and applications
We work with you to identify the relevant requirements in your data protection policies, AI usage policies, acceptable use rules and supplier requirements. You can also describe prohibited or restricted privacy practices in your own words.
Choose any list of applications you want to assess, or connect Microsoft Intune in read-only mode to use the application inventory available in your environment.
Information Security Policy
Generative AI Usage Policy
Data Retention Policy
“All personal information, including health data, must not be retained by the organisation or its service providers for longer than five years.”
+
Your App Inventory
Find apps that violate your requirements
We assess your applications against your privacy requirements and distinguish confirmed violations from potential risks. Alert when a violation is established and supported by evidence. Warning when a capability to violate the requirement exists or key information is not stated.
React Health
AlertViolation detected
Health data
Retention10 years
Calm
WarningPotential violation
Health data
RetentionAs needed
Briefly
CompliantAssessed practice
Audio recordings
Retention30 days
Explore your findings and supporting evidence
You receive access to an interactive report where you can explore findings. Follow each finding to the requirement in your policy documents, then inspect the supporting vendor documentation or evidence from application code.
Use this report to discuss findings with your team, investigate potential violations and document your decisions. The findings can also provide supporting technical evidence for relevant ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 controls during assessments and audits.
Consider integration
Explore connecting Cyberlytica to your Microsoft environment for ongoing privacy monitoring. A Microsoft Intune connection will provide your app inventory as the starting point.
Ongoing monitoring helps you identify emerging privacy violations when applications change their code, privacy policies or terms and conditions, or when your organisation’s privacy requirements change.
Pilot terms
Security
Your pilot data is hosted on Microsoft Azure in the UK and encrypted in transit and at rest. Access is limited to authorised users.
The pilot does not require software installation in your infrastructure.
Privacy
The assessment uses the application information and privacy requirements agreed for your pilot. This may include policy documents, requirements described in your own words and your chosen application list.
If you connect Microsoft Intune, we agree the application, device, user and group information needed for the assessment. The connection is read-only: Cyberlytica does not change Intune settings or send commands to deploy, remove or restrict applications.
Leaving the pilot
You can leave the pilot at any time. Under the planned pilot terms, deleting your Cyberlytica account triggers deletion of the account and associated pilot data within 24 hours.
Discuss a pilot
Tell us which applications or privacy requirements you want to investigate. We’ll agree the scope, deliverables and success criteria for your pilot.
Fireflies
Craft
Bluedot
