Bron: https://www.aistudio.nl/en/grip-on-ai/secure-ai Secure AI # Let your people use AI securely. Even with confidential client data Every major model in one environment, your data in the Netherlands, and everything within the boundaries you set. That is how your team **works with AI securely**, sensitive data included. You keep **a grip on who does what**, and you can explain it to your board, your clients and a regulator. Compliance and governance are where we start. [Request the security pack](https://www.aistudio.nl/en/grip-on-ai/secure-ai#dossier)[Book an intro call](https://www.aistudio.nl/en/contact/demo) In line with ISO 27001Toelichting bij In line with ISO 27001AIStudio is developed and maintained inside the ISO 27001 and NEN 7510 certified management system of DIJ, our sister company, which builds our software. Certification in our own name is in progress. GDPR Data in the Netherlands (BIT, Ede) No training on your data DORA-assessed EU AI Act-ready The problem ## Your people already use AI. You just cannot see where. Policy or no policy, your team uses AI: ChatGPT on a personal account, Gemini or Claude. That is how client data disappears into systems you have no view of. It is called **shadow AI**. Banning it does not work, and neither does ignoring it. What does work is **grip**: sight of what is happening, clear boundaries for what is allowed, and an environment where it can be done securely. Want to know where you stand first? [Take the AI Grip Scan](https://www.aistudio.nl/en/ai-grip-scan): 15 questions, about 2 minutes, and you get a report. 78% of employees use personal AI tools their employer does not know about. ChatGPT is by far the most used tool in our baseline assessments. Including at organisations that give everyone a Copilot licence. 50% of Dutch organisations have no AI policy at all. ### It is already going wrong The city of Eindhoven reported a data breach: staff put youth care files and citizen service numbers into ChatGPT. No bad intent, just people trying to do their work. [How the FD reported it (in Dutch) →](https://fd.nl/bedrijfsleven/1582289/tientallen-meldingen-over-datalekken-door-ai-gebruik-privacywaakhond-waarschuwt-voor-risico-s) The checklist ## Six questions you should ask every AI supplier. Choosing the right AI platform for your organisation is **not an easy job**. The market changes every month, every supplier calls itself secure, and the details sit in terms nobody reads. These six questions bring it back to what counts. Ask them of every supplier, and feel free to start with us. ![Two people in conversation, one listening critically](https://www.aistudio.nl/images/photo-gesprek-een-op-een.jpg)![Adviser answering questions from a group around a table](https://www.aistudio.nl/images/photo-klantgesprek-uitleg.jpg) 1 ### Where does my data sit? On servers in the Netherlands or the EU, or in the United States, out of your sight? The location decides which law applies, and who is allowed to look. 2 ### Is my data used for training? Free and consumer tools often use your input to improve their models. For company data you want a hard no, written into a data processing agreement. 3 ### Who does what, and can I see it? Without central user management and logging you cannot answer the simplest audit question: who shared what, with which tool, and when? 4 ### Does everything stay mine? Assistants, prompts and the knowledge you build up are yours. Switching model or supplier should never mean starting over. 5 ### Can I prove we comply? You have to meet the GDPR and the EU AI Act. Proving it is only possible if you know what is being used, by whom, for what, and where your data goes. 6 ### Are access and logging in place? Roles, rights and a view of usage are the difference between grip and shadow AI. ![Colleague explaining something at a whiteboard full of notes](https://www.aistudio.nl/images/photo-whiteboard-uitleg.jpg)![Three colleagues looking at a screen together](https://www.aistudio.nl/images/photo-collegas-scherm.jpg)![Colleague laughing while working at his laptop](https://www.aistudio.nl/images/photo-collega-lachend-laptop.jpg) The difference ## From scattered AI tools to one managed workspace. Only in one managed environment do you keep a grip on your data and your usage, while your people simply carry on working. Scattered AI toolsAIStudio Scattered AI tools ### Data out the door Client data ends up in tools you have no view of. AIStudio ### Data in the Netherlands Storage in the Netherlands at BIT in Ede (through [Exonet](https://www.exonet.nl)), processing inside the EU. Scattered AI tools ### Trained on your data Your input improves the supplier’s model. AIStudio ### No training on your data Your data stays yours, full stop. Scattered AI tools ### No view of usage Nobody knows who shares what, with which tool. AIStudio ### Central management and insight Roles, rights and logging: you see who does what. Scattered AI tools ### Tied to one model If the supplier drops out, your work stops. AIStudio ### Switch without migrating Change model without losing your set-up. Our approach ## Your data, your set-up, your grip. The AI world moves fast, and not always in your favour. Models come and go, suppliers change their terms, rules tighten. Tie yourself to **a single party** today and you may regret it next year. That is why we arrange it the way we do: your data in the Netherlands, every agreement on paper, and a set-up **that stays yours**, whichever model runs underneath. Not because an auditor asks for it, but because people only take to AI once they dare to trust it. Security is not a selling point we add afterwards. It is where we begin. Sven Haveman, co-founder and security officer ![Sven Haveman, co-founder and security officer at AIStudio](https://www.aistudio.nl/images/portrait-sven.jpg) How it is built ## This is how we have arranged it. Security does not live in a promise, it lives in **how the environment is built**. Your data stays in the Netherlands, every agreement is on paper, and you can see for yourself who does what. Below, part by part, how we have arranged it. ### Provable, not promised AIStudio is designed, built and maintained inside the ISO 27001 and NEN 7510 certified management system of DIJ, our sister company, which builds our software, and we are DORA-assessed. Certification in our own name is in progress. It is all in [the security pack below](https://www.aistudio.nl/en/grip-on-ai/secure-ai#dossier). ### Data in the Netherlands Storage on Dutch servers (BIT, Ede), processing inside the EU. Running it in your own cloud or infrastructure is also possible. ### No training on your data The model handles your question, sends the answer back and then forgets everything. Agreed in writing with every supplier: your input trains no models and goes to no third party. ### Human in the loop AI writes the draft, your people stay in charge and make the call. For sensitive work that check is the starting point, not something you switch on. ### Personal data masked Where it matters, we strip out names, email addresses and account numbers before any data reaches a model. ### Access managed centrally People sign in with the Microsoft or Google account they already have (SSO), with roles and rights per user. ### Full view of usage Logging, retention periods you set yourself, and an audit trail. You can always show who did what. ### Ready for the EU AI Act Choices recorded and defensible to your board, your clients and a regulator, including when the rules tighten. ![Cornelissen Bouw](https://www.aistudio.nl/images/logo-cornelissen-kleur.svg)Construction & engineering [](https://www.aistudio.nl/en/clients/cornelissen) In practice > “We work with data from clients and suppliers, and we do not want it out on the street.” “We cannot stop AI from being used. So let us make sure it is used well, and that we stay in charge.” Management, Cornelissen Bouw. Translated from Dutch. [Read the full client story (in Dutch) →](https://www.aistudio.nl/en/clients/cornelissen) Secure and productive ## From grip to growth. A secure workspace is **your solid foundation**. After that, what counts is what you get out of it: that your people genuinely use it and get more and better work done, faster. So you do not get a tool thrown over the fence, you get a fixed method in four phases, from kickoff to daily use and beyond. ### Grip The ground rules first: roles, model choice, data rules and access management. Plus the DNA of your organisation, so the assistants know your language and your processes. ### Start The first teams, the first use cases and the first assistants. We set the workspace up and you are live within one month. ### Adoption Training, AI coaches and champions, measuring usage, collecting feedback and adjusting. That is how your whole team ends up working with it daily. ### Growth New departments, integrations and assistants, in a fixed quarterly rhythm. Every round gets you more out of it. 37,563hours of meetings recorded, written up into minutes and turned into follow-up actions 84% average adoption at our clients, after the three-month implementation “ > This feels secure enough to put client data into. With ChatGPT the feeling was: we should not really be doing this. Now we dare to **roll it out widely**. ![Stolwijk Kennisnetwerk](https://www.aistudio.nl/images/logo-stolwijk-kleur.svg)Accountancy, translated from Dutch 4 hours saved per employee, per week ![Talen Vastgoedonderhoud](https://www.aistudio.nl/images/logo-talen-kleur.svg) In writing ## Is compliance your number one priority? Get our security pack. The ISO 27001 and NEN 7510 certificate of DIJ, our DORA addendum, the data processing agreement and the security and compliance overview. All of it together. ![Sven Haveman](https://www.aistudio.nl/images/portrait-sven.jpg) You get the pack personally from **Sven Haveman**, co-founder and security officer. And you can put your questions to him straight away. The AI Grip Scan A report on your grip on AI in two minutes. [Take the AI Grip Scan](https://www.aistudio.nl/en/ai-grip-scan#start) Frequently asked questions ## Can I use AI securely in my organisation? Is ChatGPT safe for company data? On a free or personal account, no. Your input can be used to improve models, you have no view of who is looking, and nothing is agreed about where your data ends up. Run that same model inside a managed workspace like AIStudio and the picture changes: there it is contractually agreed per supplier that no training happens on your data, storage sits in the Netherlands, and as an administrator you can see who does what. The difference is not the model, it is the environment around it. Can I let AI process client data under the GDPR? Yes, as long as you can show four things: where the data sits, who can reach it, whether it is trained on, and how long it is kept. The GDPR does not forbid AI, it forbids vagueness. With a data processing agreement, storage in the Netherlands, processing inside the EU and logging of usage, that is all arrangeable. Where it gets genuinely sensitive, we strip out names, email addresses and account numbers before the question reaches a model. Where does our data sit, and who can reach it? Storage sits on Dutch servers at BIT in Ede, processing happens inside the EU. Running it in your own Azure or Google Cloud environment, or on your own hardware, is also possible. Access is managed centrally: people sign in with the Microsoft or Google account they already have, with roles and rights per user. Everything is logged, with retention periods you set yourself, so at an audit you can show who did what and when. Is our data used for training? No. That is agreed with every model supplier in a data processing agreement: your input trains no models and goes to no third party. Technically it works like this: the model handles your question, returns the answer, and keeps nothing afterwards. What your organisation builds up in assistants, prompts and knowledge stays your property and stays inside your own environment. Is AIStudio ISO 27001 and NEN 7510 certified? The certificates are held by DIJ, the company that develops and maintains the AIStudio software, and not by AIStudio B.V. That is something you can check, because every certificate states a scope: the description of the work the auditor assessed. At DIJ that scope is “information security related to designing, developing and maintaining web applications together with clients”, and that is exactly the work on AIStudio. So our platform is designed, built and maintained inside an ISO 27001 and NEN 7510 certified management system, and AIStudio works under that same information security management system (ISMS). Certification in the name of AIStudio itself is in progress; we expect to complete it in the fourth quarter of 2026. ISO 27001 covers information security in general, NEN 7510 covers handling health data. For DORA no certification exists: we have been assessed in the supplier reviews of financial clients. The certificates, statements and underlying documents are in [the security pack](https://www.aistudio.nl/en/grip-on-ai/secure-ai#dossier), which you can request here. With it you can answer a procurement or compliance question without having to come to us first. What does the EU AI Act mean for our organisation? The EU AI Act requires organisations to know which AI they use, what for, and at what risk. For ordinary office work it stays with transparency requirements and the duty to make your people AI-literate. For uses that count as high risk, such as decisions about people, heavier requirements come on top. In both cases it starts with an overview: which tools are running, who uses them and what for. You will not get that overview out of separate subscriptions. How do I stop shadow AI without banning AI? By offering one environment that works better than the tools people already found themselves. Shadow AI rarely comes from unwillingness: someone needs a solution and picks up whatever is at hand. A ban only moves it to a private phone. Offer one workspace instead, with the models they want, set up around their own work, and the reason to go elsewhere disappears. And because the usage is visible, you see straight away where the demand is. Can I use AI in work covered by professional confidentiality? Yes, as long as two things are fixed: the data does not leave, and it is not trained on. Both are agreed contractually. On top of that, the person decides. AI writes the draft, your employee reviews and signs off. For sensitive work that check is the starting point, not something you switch on separately. And to account for it afterwards, logging, roles and retention periods are on by default. What happens if an AI supplier drops out or cuts off access? Then you switch to another model, without losing your set-up. Your assistants, prompts and knowledge base sit on a neutral layer above the model, so a switch is a setting on our side and not a migration project. Availability is a security question too: DORA counts a supplier dropping out as a risk. How that works is on [the page about vendor-independent AI](https://www.aistudio.nl/en/grip-on-ai/vendor-independent-ai). ## Move AI from scattered experiments to secure daily use. In thirty minutes we look at your situation together and show you how other organisations tackled it. By the end you know three things: how AI fits your business, what it will get you, and how you go **live within one month**. [Book an intro call](https://www.aistudio.nl/en/contact/demo) ![Noor de Feber](https://www.aistudio.nl/images/portrait-noor.jpg)![Daniel van der Valk](https://www.aistudio.nl/images/portrait-daniel.jpg)![Matthijs Mali](https://www.aistudio.nl/images/portrait-matthijs.jpg)![Ludo Haveman](https://www.aistudio.nl/images/portrait-ludo.jpg)![Sven Haveman](https://www.aistudio.nl/images/portrait-sven.jpg)