Data, privacy and AI advisory
Data, privacy and AI review of a third party SaaS platform
A business wanted an independent view of the SaaS platform holding its most sensitive client data, including its AI footprint and assurance evidence.
What leadership received
Leadership received a prioritised list of questions to take to the platform vendor.
Vendor policies reviewed
4 independent evidence sources
Prioritised vendor questionsAustralian business running on a third party SaaS platform
- Platform type
- SaaS
- Subject
- Third party SaaS platform
- Engagement
- Independent platform advisory
- Deliverable
- 31 page advisory report
The situation
The client runs its business on a third party SaaS platform that holds its most sensitive client data. It wanted an independent advisory review rather than a penetration test. The questions were practical. How does the platform handle our data? What is its AI footprint? Does the assurance evidence stand up when an enterprise customer asks for it?
What we did
Data & Privacy Advisory- Sat with the team on site and watched the platform being used, then put a structured question set to the platform's developer.
- Worked through the vendor's policy library, its independent penetration test results and a third party risk assessment commissioned by one of the client's enterprise customers.
- Mapped how AI is used inside the platform and what data reaches it.
- Rated every area for likelihood and impact, then wrote it in plain English for leadership rather than engineers.
The outcome
What leadership received
Leadership received a report it could use. Every area was rated, every rating was explained, and the reasoning remained visible rather than buried in an appendix.
The practical output was a prioritised conversation list for the vendor. The client now knows what to ask, in what order and what evidence to expect back. That matches the assurance position its enterprise customers expect.
The measures behind the work
These are observed measures from the engagement, not estimates of business returns. The source for each measure is shown below.
- in the advisory report for leadership
- 31 pagesObserved measureClient advisory report | 2026
- vendor policies reviewed
- 35Observed measureVendor policy library reviewed | 2026
- independent evidence sources examined
- 4Observed measureAdvisory working papers | 2026
- prioritised list to take to the vendor
- 1Observed measureClient advisory report | 2026
Want this looked at in your business?
Start with the situation. We will tell you whether this kind of engagement fits.
Private references are available with client consent.