Executive summary
Bitkom reports that around 42% of companies in Germany suspect that employees use private, unapproved AI tools — this report shows which of them are visible on your network.
Detected services
| Service | Category | Events | Share | Account signal | Flags |
|---|---|---|---|---|---|
| ChatGPT (OpenAI) | Chat & Assistants | 34 | 23,1 % | Consumer | Consumer-only access seenTrains on data by default (consumer)US provider |
| US provider; data is processed outside the EU. Consumer inputs are used for model training by default (opt-out available). Business, Enterprise, Edu and the API are excluded by default. | |||||
| Claude (Anthropic) | Chat & Assistants | 18 | 12,2 % | Consumer | Consumer-only access seenUS provider |
| US provider; data is processed outside the EU. | |||||
| GitHub Copilot | Code Assistants | 15 | 10,2 % | Unknown | Enterprise access availableUS provider |
| US provider; data is processed outside the EU. Endpoints are plan-specific (individual / business / enterprise), which yields an account-tier signal. | |||||
| DeepL | Translation AI | 13 | 8,8 % | Consumer | Consumer-only access seenEU provider |
| EU provider (Germany, Cologne). Strong EU data-residency positioning. | |||||
| Gemini (Google, consumer) | Chat & Assistants | 12 | 8,2 % | Consumer | Consumer-only access seenTrains on data by default (consumer)US provider |
| US provider; consumer chats may be human-reviewed and used for training by default, with stronger protections applied in the EEA, Switzerland and the UK. | |||||
| Cursor | Code Assistants | 11 | 7,5 % | Unknown | US provider |
| US provider; data is processed outside the EU. | |||||
| Perplexity | AI Search | 9 | 6,1 % | Consumer | Consumer-only access seenUS provider |
| US provider; data is processed outside the EU. Enterprise queries are excluded from training. | |||||
| OpenAI API | Model API Platforms | 8 | 5,4 % | Unknown | US provider |
| US provider; data is processed outside the EU. API data is not used for model training by default. | |||||
| Azure OpenAI Service | Model API Platforms | 7 | 4,8 % | Unknown | US provider |
| US provider; data is processed outside the EU. A customer-selected Azure region can keep data in the EU. | |||||
| Otter.ai | Meeting Notetakers | 6 | 4,1 % | Consumer | Consumer-only access seenUS provider |
| US provider; data is processed outside the EU. | |||||
| Midjourney | Image & Video Generation | 5 | 3,4 % | Consumer | Consumer-only access seenUS provider |
| US provider; data is processed outside the EU. | |||||
| ElevenLabs | Audio & Voice Generation | 4 | 2,7 % | Consumer | Consumer-only access seenUS provider |
| US provider; data is processed outside the EU. | |||||
| DeepSeek | Chat & Assistants | 3 | 2,0 % | Consumer | China-based providerConsumer-only access seenTrains on data by default (consumer) |
| China-based provider; consumer inputs are used for model training by default (opt-out available); per its privacy policy (dated 10 Feb 2026) data is stored in China (PRC); no EU adequacy decision for China. | |||||
| Ollama | Local Model Hubs | 2 | 1,4 % | Unknown | Downloads visible, usage notUS provider |
| US provider; data is processed outside the EU. Models run locally; only registry and download traffic (registry.ollama.ai) is network-visible. | |||||
Categories & flags
Usage pattern
- week 31
- week 32
- week 33
Blind spots of this analysis
Network logs do not show everything. This analysis makes no claim about:
For these services the method only yields an indicator, not an event count.
- Google Workspace Gemini
- Microsoft 365 Copilot
- Notion AI
EU AI Act — context
Since 2 February 2025, the AI literacy duty (Art. 4) has applied to providers and deployers of AI systems. Since 2 August 2025, governance and penalty rules apply; since 2 August 2026, full obligations and national supervision apply — with fines of up to €35M or 7% of worldwide annual turnover for prohibited practices, and up to €15M or 3% for general violations. High-risk obligations follow from December 2027.
A compliance layer for the EU AI Act follows in a later stage.
Recommended next steps
An audit conversation places the detected services in legal and organizational context and clarifies next steps with leadership and the works council.
Request shadow-AI auditMethodology & privacy
Analysis ran locally in the browser; no raw log data was transmitted. Catalog version and parser version are documented below. Retention and deletion follow the period stated in the privacy notice.
Katalog 1.0.3+31ef99b9-verified · Parser fortigate@1.0.0
Imprint
Imprint- EU-hosted (Hetzner, Germany)
- No US CLOUD Act exposure in our hosting and processing chain
- Log analysis runs locally in your browser — your logs never leave your device
- Aggregated analysis only — no performance or behavior monitoring of individual employees