The GhostAudit team. We are a small, early-stage company, so the people on your kickoff call are the people who set up the workspace, read the data and write the documents.

Is the price really fixed?

Yes: $1,500, once, excluding tax, for one organization of up to 1,000 employees. There is no per-employee charge during the 30 days. If you are larger, or want several legal entities covered, tell us in the form and we will quote before anything starts.

Do we have to install software on every computer?

No. You choose the group in scope. The usual choice is to push the browser extension to a department or the whole company through your browser management, which takes one policy. You can also start by connecting Google Workspace or Microsoft 365, which needs nothing installed, and add the extension afterwards.

What if we only connect Google Workspace or Microsoft 365?

Then the report covers which AI tools were given access to work accounts, by how many people and with which permissions. It cannot say how much each tool is used or find tools used with personal accounts; that takes the browser extension. We will say plainly in the report which of the two it is based on.

Will you read what our employees type into AI tools?

No, and we could not if we wanted to. GhostAudit collects which AI tool was used and for how long. It does not collect prompts, responses, page content or full web addresses. Privacy by design has the whole list.

Are the policy and the notice legal advice?

No. They are complete, specific drafts built from your own data and the product's templates, and edited by a person. They are meant to be reviewed by your counsel, and they mark the places where a legal decision is yours to make.

What happens to our data if we do not subscribe?

Monitoring stops and the workspace is paused. The report, policy and notice are yours to keep. You can export your data, and we delete the workspace on request as set out in the data processing addendum.

Can a consultant or managed service provider run this for us?

Yes. The Starter is also something partners deliver for their clients. See partners.

AI Governance Starter. Thirty days to a report, a policy and a notice.

A customer questionnaire asks how you govern AI, and the honest answer is that nobody knows which tools are in use. The Starter fixes that in a month, for a fixed price. We measure what is in use, write it up, and leave you with the two documents you need to act on it.

Fixed price

$1,500one-off, excluding tax

30 days of AI usage monitoring
A written AI usage report
An AI acceptable use policy
An employee AI monitoring notice
A kickoff call and a findings call

Ask about the Starter

One organization, up to 1,000 employees. Prefer to do it yourself? See subscription pricing.

Report
AI usage report
What 30 days of measurement found: tools, people, departments, licences and next steps.
PDF and Word
Policy
AI acceptable use policy
Written around the tools you actually use, with your approved list and data rules.
Word, for your edits
Notice
Employee AI monitoring notice
What is collected and what never is, with an acknowledgment block and employer notes.
Word, for counsel
Calls
Kickoff and findings calls
One to agree scope and rollout, one to walk your team through the results.
Two sessions

01Scope

What you get, exactly.

30 days of monitoring: A GhostAudit workspace for your organization with every Govern feature for the period. Measurement comes from the browser extension, from a Google Workspace or Microsoft 365 connection, or from both. We set it up with you and watch that data is arriving.
Ready for employees and customers: Because the workspace has every Govern feature, the policy we deliver can be published to your employee AI hub for people to read and acknowledge, and a draft AI trust center page can be prepared from the same records. We set both up with you on the findings call if you want them. Publishing either is your decision, and the statements about customer data on a trust page are confirmed by you, not by us.
AI usage report: A written report, in PDF and Word: which AI tools are in use, by how many people and for how long, which are not approved, how use splits by department where your settings allow it, how any AI licences you tell us about are used, and what we recommend you do next. It is produced with the product's usage report and reviewed by a person, who adds a short covering note on what stands out.
AI acceptable use policy: A policy written around the tools the measurement found: which are approved and on what conditions, what data may go into them, and who decides about new ones. It starts from the product's template and your answers to a short questionnaire, and is edited by us. Delivered in Word so that you and your counsel can change it.
Employee AI monitoring notice: The notice that tells employees what is recorded and what never is, with an acknowledgment block and employer notes on the notice laws of New York, Connecticut and Delaware and on the GDPR. It reflects the settings actually used in your workspace. You receive the draft in the first week, because employees should be told before sensors are deployed.
Kickoff call: We agree the group in scope, the identity mode (named, pseudonymous or anonymous), how employees will be told, and who does what.
Findings call: We walk your team through the report and the two documents, and answer questions. You decide what to approve, what to restrict and what to look at next.

02Timeline

Thirty days, start to finish.

Before day 1
Kickoff call
Scope, identity mode and rollout plan agreed. We create your workspace and send the draft employee notice and the policy questionnaire.
You and us
Week 1
Tell employees, then switch on
You send the notice. Then you push the browser extension with one browser policy, or connect Google Workspace or Microsoft 365, or both. We confirm that devices are reporting and that findings are arriving.
You, with our help
Days 1 to 30
Measurement
Sensors report which AI tools are used and for how long. Nothing is blocked and nobody is asked to change how they work.
Runs by itself
Around day 30
Report, policy and notice
We produce the usage report, write the acceptable use policy around what was found, and finalise the notice.
Us
Within a week
Findings call
We present the findings and hand over the documents. You choose whether to keep the workspace running.
You and us

03Your part

What we need from you.

The Starter is short because the work on your side is small, but it cannot be skipped.

A named contact with the authority to deploy a browser extension or grant read-only access to your identity provider. Usually the IT or security lead.
One of two ways of measuring, or both. Deploy the browser extension to the group in scope through Google Admin, Microsoft Intune or Group Policy: one policy to install it and one to configure it. Or connect Google Workspace or Microsoft 365 with read-only credentials that you create and can revoke.
Tell employees first. We supply the notice; you send it, and you decide with your own advisers whether anyone needs to be consulted before monitoring starts. We will not help with a covert deployment.
Half an hour for the policy questionnaire: which tools you already approve, what data is off limits, who owns the decision.
Optional: your AI licences. Tell us the seats and prices you pay for and the report will include how they are used.

The two ways of measuring see different things. The extension sees every AI site opened in a managed browser and how long it was used. An identity connection sees AI tools that were given access to a work account. How discovery works.

04Not included

What the Starter is not.

Legal advice. The policy and notice are drafts for your counsel to review. We are not a law firm.
Certification or an audit opinion. The Starter does not certify you against ISO/IEC 42001, SOC 2 or anything else, and GhostAudit holds no such certifications itself.
A data protection impact assessment or works-council process. We give you the technical facts those need. Carrying them out is for you and your advisers.
Framework assessments. Assessing systems against the EU AI Act or NIST AI RMF is part of the Govern plan, not of the Starter.
Blocking, remediation or tool rollout. The month is for measuring. What you do with the findings is the next step.
Content inspection. No prompts, no page content, no screenshots. The product does not collect them.

05Afterwards

What happens on day 31.

The workspace we set up is an ordinary GhostAudit workspace, and it is yours. At the end of the 30 days you choose a subscription to keep it running, with everything measured so far in place: Monitor at $4 or Govern at $7 per covered employee per month, with the 50-employee minimum described on the pricing page.

If you decide not to continue, monitoring stops and the workspace is paused. The report, the policy and the notice are yours either way, and there is nothing further to pay.

We would rather you continue because the first month was useful than because leaving was awkward.

Enquire

Ask about the Starter.

Tell us roughly how many people you have and how you would prefer to start. We reply with available start dates and a short scope note to confirm, usually within one business day. Nothing is charged until you have agreed the scope.

Price: $1,500, one-off, excluding tax
Length: 30 days of monitoring, then the findings call
Delivered by: The GhostAudit team
Or write to: [email protected]

FAQ

Questions about the Starter

Who delivers it?: The GhostAudit team. We are a small, early-stage company, so the people on your kickoff call are the people who set up the workspace, read the data and write the documents.
Is the price really fixed?: Yes: $1,500, once, excluding tax, for one organization of up to 1,000 employees. There is no per-employee charge during the 30 days. If you are larger, or want several legal entities covered, tell us in the form and we will quote before anything starts.
Do we have to install software on every computer?: No. You choose the group in scope. The usual choice is to push the browser extension to a department or the whole company through your browser management, which takes one policy. You can also start by connecting Google Workspace or Microsoft 365, which needs nothing installed, and add the extension afterwards.
What if we only connect Google Workspace or Microsoft 365?: Then the report covers which AI tools were given access to work accounts, by how many people and with which permissions. It cannot say how much each tool is used or find tools used with personal accounts; that takes the browser extension. We will say plainly in the report which of the two it is based on.
Will you read what our employees type into AI tools?: No, and we could not if we wanted to. GhostAudit collects which AI tool was used and for how long. It does not collect prompts, responses, page content or full web addresses. Privacy by design has the whole list.
Are the policy and the notice legal advice?: No. They are complete, specific drafts built from your own data and the product's templates, and edited by a person. They are meant to be reviewed by your counsel, and they mark the places where a legal decision is yours to make.
What happens to our data if we do not subscribe?: Monitoring stops and the workspace is paused. The report, policy and notice are yours to keep. You can export your data, and we delete the workspace on request as set out in the data processing addendum.
Can a consultant or managed service provider run this for us?: Yes. The Starter is also something partners deliver for their clients. See partners.

Prefer to run it yourself?

Everything the Starter uses is in the product. Start a 14-day trial with every Govern feature, deploy the extension to a pilot group and download your own report. No card is needed to start.

Start 14-day trial Talk to us See pricing