This is an example report. Fabula Media does not exist. This is a complete Noxiom audit report for a fictional company, published so you can see exactly what you get before you pay anything. Names, numbers and prices are illustrative. The format and depth are not.

The verdict, in short

Your team uses AI well. Keeping an overview of it just hasn't been anyone's job yet.

Noxiom Audit Score: 3.0 / 5

What this report is based on

Three sources of evidence.

1. Anonymous team survey. 14 of 17 people responded (82 percent, sufficient participation for high confidence). Results analyzed as totals and per survey.
2. Your own admin screens. A guided screen-share. Three parts. The billing pages of your named tools, the connected-apps page of your Google Workspace, and the data settings of the AI tools in use.
3. Your subscription list. The tool names, plans and seat counts provided at kickoff, checked against public vendor pricing.

Finding 1: What's actually in use

Reported tools: 5
Tools in use: 13

Reported (from your kickoff list):

Found in addition (survey plus connected-apps review):

Nobody here did anything wrong. These are people finding faster ways to do their work. Keeping track of the tools was simply not anyone's task yet. The first item on the plan fixes that.

Why this matters. Rules, budgets and safety checks only cover the tools you know about. The 8 tools that weren't on the list sat outside every policy and every review, and several of them handle client data.

Finding 2: Where your data goes

The part most owners never had time to check, so it gets the most room in this report. To make it concrete, follow one sentence through the system.

Someone on your team pastes a client's pricing terms into a free ChatGPT account to draft an email. That text leaves their laptop, crosses the network, and lands on OpenAI's servers, typically in the United States. On a free personal account with default settings, the published terms allow that conversation to be used to improve future models. Whatever was in it can become part of what a future model learns from, and there is no way to pull it back out.

The same sentence pasted into your paid ChatGPT Team workspace makes the same trip to the same servers, but the business terms state it is not used for training. It's the same tool. The only difference is that the business plan puts your data's protection in writing, where the free plan leaves it uncertain. Nobody did anything unusual in either case, which is exactly why this is worth knowing.

Every tool below has its own version of that journey. The table shows where each one ends and what the published terms say happens there, as available during the audit*. Nothing here is speculation, and where the terms say nothing, the table says unknown.

Where the plan is unknown, the terms differ per plan, so the row covers both.

* Vendor terms change continuously. Where the data goes, which country it sits in, and what gets used for training can all change after this report. Keep someone aware of it, or at least know that it can move, so there are no surprises later.

From there, three findings that matter, and one thing you're doing right.

2.1 Client calls appear to be recorded outside company control. Fireflies.ai shows up in your connected apps, and one survey response reports it being used on client calls. It is not on your subscription list, so the company does not pay for or control the account it runs under. The recordings themselves do not stay on your machines, they live on Fireflies' servers, reachable through whoever created the account. If client calls are being recorded there, it is worth checking whether clients agreed to being recorded. Confirming this and moving call recording under company control is the most urgent item in this report.

Why this matters. Those recordings hold your clients' voices and whatever was discussed on the call, and the company can't open, delete, or even list them, because the account isn't yours. If the person who created it leaves, the recordings leave with them, while under the GDPR your company stays responsible for that data. And if a client ever asks you to delete everything you hold on them, you can't delete what you can't reach.

2.2 Client contracts go through free DeepL. Four people report translating client documents on the free tier, where the published terms allow using submitted text to improve the service. The paid tier states texts are not used for training. Which tier client documents should go through is a decision worth making deliberately, and the plan leaves that choice with you.

Why this matters. Client contracts are some of the most sensitive text in the company: prices, terms, names. Once text has been used to improve a service, there is no taking it back, so this is a decision to make once, on purpose, instead of every day by accident.

2.3 Client briefs in personal ChatGPT accounts. Three people report using personal free accounts, where data may be used for training, while you already pay for ChatGPT Team, where it is not. This is a routing problem, not a spending problem: the safe option exists, is paid for, and has 4 empty seats.

Why this matters. You already pay for the version whose terms keep your data out of training, while the briefs go through the version that may not. The risk isn't the tool, it's the route: same work, same people, and the protection you bought just isn't being used.

2.4 What you're doing right. Your Google Workspace is set up well. Two-step verification is enforced and external sharing is restricted. And your writing team's use of ChatGPT Team is genuinely good practice, a shared prompt library, a house style prompt, drafts always human-edited. Keep that going.

Why this matters. Good habits like these are usually the first thing to disappear when tools change or new people join. Because the audit wrote them down, the policy can name them, and the next hire learns them on day one instead of by accident.

Finding 3: What your money could do instead

An estimated €200 per month, €2,400 per year, in subscriptions doing nothing or doing double.

These numbers come from your billing pages and reported usage, so treat them as close estimates. The money is already being spent, so the real question is what it should buy. The same €200 per month covers paid tiers with clear data terms for the tools your team actually uses, or the build time for both automations in finding 4, several times over. The cleanup itself is plan item 6.

Why this matters. Nobody notices €200 a month leaving, which is exactly how it survives. And unused subscriptions are not only money: every forgotten seat is also a live login that can be phished and data sitting somewhere, so cutting them makes you slightly safer, not just slightly richer.

Finding 4: What's worth automating (and one thing that isn't)

These came from the survey answers and the leadership interview. The filter is simple: hours saved versus effort to build, using tools you already pay for.

4.1 Monthly client reporting. Account teams report spending about 6 hours per month each pulling GA4 and Meta exports into report decks. A template plus your existing ChatGPT Team can draft the text from those exports, a person edits and sends. Estimated saving: 12 to 15 hours per month. Effort to build: about two days.

4.2 Call follow-up emails. Follow-up emails after client calls are currently written from scratch. Meet transcription plus ChatGPT Team can produce a first draft to edit and send. This also replaces the recording setup from finding 2.1. Estimated saving: about 3 hours per week. Effort to build: one day.

4.3 A website chatbot, considered and advised against. It came up in the interview, but your inbound volume is too low for it to save real hours, and a bad chatbot costs more than it saves. It's your call, but at this stage I don't see a scenario where it pays off. My advice: skip it for now.

Why this matters. An hour lost to repeated work isn't lost once, it's lost every week, forever, and it's usually your most experienced people losing it. Both automations run on tools you already pay for, so the return starts the week they're built. And the filter cuts both ways: the same math that picked these two is what keeps you from building things that only feel useful.

Your AI usage policy

If you don't have one, I write it from these findings, short enough that people actually read it. If you already have one, I review and harden it, including where practice differs from paper. Either way it covers which tools are approved, what client data stays out of them, and how someone requests a new tool. It looks forward, not back. Nobody gets punished for anything found here.

The 6-month plan

Every item traces to a finding. High: 1 month. Medium: 3 months. Low: 6 months.

Every item on this list is written so your team can execute it without me. If you want support with items 7 and 8, Noxiom runs guided sprints, where your team builds and I sit with you to guide the choices, daily check-ins included, so the result is yours to maintain and repeat. Item 10 is available as a half-day training.

What moves the scores

A re-audit uses the same written method, so the next time you receive this audit you can see exactly what improved. Which work improves which score:

• Visibility and control: the tool register, and the policy's route for requesting new tools.
• Data safety: moving call recording under company control, a deliberate DeepL tier choice, moving everyone onto the ChatGPT Team seats, and removing the browser extension.
• Spend efficiency: cancelling the unused subscriptions, and keeping the quarterly review going.
• Leverage: building the two automations.

Start from the top. The visibility and data safety work is also the cheapest and fastest on the plan.

What happens next

A one-hour roadmap session, on video or on site, walking you through everything above. Bring anyone. Ask anything.

And once the audit is done, it's yours to show. Companies that complete one can display the badge:

About the rules: as a company using AI, the EU AI Act's literacy obligation applies to you, and if any of your clients fall under NIS2, expect their security questionnaires to start asking about your tooling. Neither is scored in this audit, and this report is not compliance advice. Both are covered by items on the list above.

This is a fictional example. Fabula Media does not exist and any resemblance to a real company is coincidental. Prices shown are illustrative. Noxiom, 2026.