AI Exposure Review

Your clients trusted you with their most sensitive information. Do you know what has access to it now?

AI is already inside your case management system, your email, and your documents. The AI Exposure Review shows you where that information goes, and what to put in place before you rely on it.

Start the conversation What it costs

The AI did not ask permission.

Most of the AI now touching your data arrived quietly. A feature switched on inside a platform you already pay for. A tool a staff member started using on their own. None of it announced that it would read your clients’ records, send them to an outside company, or keep them for a while.

97% of organizations that experienced AI-related security incidents lacked proper AI access controls.

IBM Cost of a Data Breach Report, 2025

Among organizations that experienced a breach, 63 percent had no AI governance policy or were still developing one. Staff are already using tools on their own. The question is not whether AI is in your organization. It is whether anyone is paying attention to what it is doing there.

For an organization serving survivors, children, families, or anyone whose safety depends on confidentiality, that quiet shift is the whole problem. The information you are trusted to protect can leave the building without anyone deciding it should.

Turning off training is not the same as keeping data private.

One question: will the company train its AI on your information? You can usually turn that off. The other: who can hold, read, or be compelled to produce your information, and for how long? That is controlled by the kind of account and the contract behind it. That is not one setting. For privileged records, the second question is the one almost no one is asking.

What the review gives you.

AI Inventory
Every place AI touches your data: standalone tools, AI in everyday software, and AI embedded in your sector platforms.
Exposure Map
Where client information travels, who can hold it, for how long, and what that means for the people you serve.
Obligation Alignment
How your AI use lines up with your duties including privilege statutes, FERPA, and funder confidentiality.
Vendor Question Set
The exact written questions to put to each vendor, so marketing claims become enforceable contract terms.
Prioritized Findings
What to address first, in language your board, counsel, and funders can act on.
Engagement Summary
A written record of what was reviewed, found, and recommended, so you can show you took reasonable steps.

Built for organizations that hold what matters most.

Domestic violence and sexual assault advocacy programs whose staff hold a legal privilege over survivor communications.
Child advocacy centers, CASA programs, mentoring and youth development organizations, and school-connected services holding sensitive records about minors.
Legal aid, immigration legal services, public defenders, and any organization whose clients hold attorney-client privilege.
Community health centers, mental health providers, substance use treatment programs, and any organization holding protected health information.

Judgment you cannot get from a generic AI consultant.

RAISE Tech builds AI tools for vulnerable populations. The person reviewing your exposure is the same person who builds these systems and knows what they actually do with data. Behind that sits two decades inside the work itself: direct service to survivors, a decade on a family drug treatment court team, and co-authorship of reference material on child protection law. It is someone who understands your populations, your obligations, and your systems at the same time.

What the review does

  • ✓Maps your AI exposure and explains it plainly
  • ✓Aligns your AI use with your legal and funder obligations
  • ✓Gives you the exact questions to ask vendors and counsel
  • ✓Shows you which exposures are settings you can change and which are contract terms you cannot.
  • ✓Documents what was reviewed and recommended

What it does not do

  • Make the final risk decision for you
  • Provide legal advice or legal opinions
  • Negotiate or sign contracts with AI vendors on your behalf
  • Configure or implement changes in your systems
  • Replace your attorney or your IT team

The review makes your lawyer, your IT, and your vendor conversations sharp and informed. The decisions, and the legal calls, stay with you and your counsel. That is exactly what protects you.

Some organizations want help acting on the findings. Remediation support is available as a separate engagement, scoped after your review.

Where to Begin

Most organizations start here.

A 90-minute briefing for your board, your leadership team, or your new AI committee. One question drives the session: what is your AI actually doing with your clients’ information?

Most rooms find they do not know. That is not a failure, and it is more common than not. The AI arrived without anyone deciding to let it in. What happens after this session is an actual decision.

What the room works through

The three doorways. Where AI is already touching your data: the tools staff open and type into, the assistant sitting inside your email and documents, and the one built into your case management system that can read real records.

Why your obligations raise the stakes. Advocate privilege over survivor communications. Duty of care and FERPA for records about minors. Your exposure is not the same as a company protecting sales data.

Your own map. A short exercise where the room lists where client information actually lives and which of those places now has AI in it. Most rooms surprise themselves.

What you leave with

Three or four questions to put to your vendors and your counsel right away. A one-page reference sheet that stays with you after I leave. And a clear picture of what you know and what you have been assuming.

What this is not

Not alarmist, and not legal advice. I raise the questions and name the standard. Your counsel makes the call. That separation is what makes it safe to have your attorney in the room.

90 minutes
$1,500 flat
Virtual or in person

No commitment to a full review required.

Questions, answered.

Are you telling us we cannot use AI?
No. The opposite. Used with the right protections in place, AI can help your team serve more people. The point of the review is to know your exposure and put those protections in place first, so you are using these tools deliberately rather than by accident.
Is this legal advice?
No. The review identifies your exposure and frames the questions your counsel should resolve. It is built to make your attorney more effective, not to replace them.
Will you negotiate with our software vendors for us?
No. You receive the exact written questions to put to each vendor and help interpreting their answers, but the negotiation and signing stay with your leadership and counsel. That separation is what keeps you protected.
We already have security and a privacy policy. Is that enough?
Security protects against a breach. It does not answer whether an AI feature is sending privileged records to an outside company, retaining them, or reusing them to improve a product. Those are different questions, and they are the ones this review answers.
What does it cost?
Most engagements start with a 90-minute briefing for your leadership team at $1,500 flat, which often leads into a full review. The full review maps where AI touches your data and what your obligations require.

Full reviews start at $10,000, scoped to your size and the number of systems involved. Systems means your case management platform, the everyday software your team already pays for, and any AI tools staff have adopted on their own. A limited sliding scale is available for grassroots organizations, with two engagements reserved each year. Qualification is based on budget size, staff size, the population you serve, community-led leadership, and funding history. Reach out and we will scope it together.

How long does it take?
A full review typically runs two to four weeks. A briefing can happen much sooner and is the usual starting point.

Sessions are virtual. In person is available in Austin by arrangement.

Ready to find out what your AI is actually doing with your clients’ information?

Start with a briefing. $1,500 flat, 90 minutes, no commitment to a full review required.

Book a briefing

or reach out directly at hello@raisetech.org

RAISE Tech builds AI tools for vulnerable populations and advises organizations on AI data exposure. This service identifies exposure and frames the questions your counsel and IT should resolve. It is not legal advice.