Turn every AI interaction into
Legal teams often have no idea what data the company's AI systems send to third-party LLM providers, and no evidence to fall back on when something goes wrong. Igris logs every LLM call with its actor, model, and policy action, so responding to a GDPR data subject request, an EU AI Act audit, or an India DPDP Act 2023 inquiry is a targeted query, not a manual investigation under deadline.
Data Processing Evidence Trail
A customer files a data subject access request or a breach complaint. Legal needs to know exactly what data was sent to which LLM provider, when it happened, and what was done with it. Under GDPR, CCPA, and India's DPDP Act, "we do not have that information" is not an acceptable answer, it is a liability. The honest reality in most organizations is that AI interactions are not logged in any form that could satisfy a regulator, survive an investigation, or hold up under scrutiny. When something goes wrong, legal is left reconstructing a timeline from fragments, under deadline pressure, with no guarantee the picture is complete.
Igris logs every LLM call with its timestamp, provider, model, actor, connection, and the policy action applied. If PII was detected and redacted, the audit event records exactly what was caught and masked. Where full content logging is enabled, legal can retrieve the exact encrypted request and response within the retention window. Everything is queryable by date range, connection, actor, and event type, so responding to a GDPR data subject request or a regulatory inquiry is a targeted query, not a manual investigation built under pressure.
When a request arrives, you retrieve the record. You show exactly what data was sent, to which LLM provider, at what time, and what protective action was applied. That is evidence, not an estimate, not a reconstruction, not a best guess assembled after the fact.
Vendor Data Flow Documentation
Your privacy policy lists the third party vendors that receive company data. Your vendor risk assessments are supposed to cover AI providers. But if a regulator asked today for a complete, accurate list of every LLM provider currently receiving company data, with evidence of what each one receives, how often, and under what conditions, you could not produce it confidently. Teams add providers without informing legal. Assessments are completed at onboarding and never revisited. The policy reflects what was approved six months ago. What is actually running in production is a different question entirely, and under GDPR Article 28 and the EU AI Act's transparency requirements, that gap is a compliance exposure.
The Igris connections list functions as a live AI vendor registry, every LLM provider and MCP server the company uses, each showing provider name, upstream URL, authentication type, and current status. Audit events grouped by provider show which vendors received data, how much, and how often. This feeds directly into privacy disclosures, GDPR Article 28 processor documentation, and vendor risk assessment questionnaires, without requiring legal to chase engineering teams for the current state of the stack.
Your vendor documentation reflects what is actually happening in production, not what was approved at onboarding. Privacy policies stay accurate. Vendor assessments are grounded in real data flow evidence. And when a new provider is added without approval, it surfaces immediately, before it appears in a regulator's inquiry.
Data Minimization Proof
Under GDPR Article 5(1)(c), the EU AI Act's requirements for high risk AI systems, and the NIST AI RMF's governance controls, regulators and auditors expect proof that only necessary data reaches external AI providers, not just a policy document asserting that it does. Most organizations have the policy. Few have the evidence. Auditors are increasingly asking for both. And "we have a written commitment to data minimization" is a fundamentally different answer than "here is technical documentation showing it is enforced on every single call." One is a statement of intent. The other is proof.
Igris provides data minimization proof in enforceable, documented form. PII redaction policies show that sensitive data is stripped before reaching any provider, with an audit log of every redaction event as verifiable evidence. Content guards restrict what content can be sent to which models. Allowed model lists prove that only approved models receive data. Token limits demonstrate that prompts are kept within defined size bounds, preventing bulk data transfers to external LLMs. Every control is active and enforced at the proxy layer, not aspirational at the policy layer.
When an auditor asks for data minimization proof under GDPR, EU AI Act, or NIST AI RMF requirements, you produce technical evidence: active policies, enforcement logs, redaction records. The gap between what your documentation says and what actually runs in production closes entirely , and you can demonstrate that to anyone who asks.
Incident Forensics for Legal Proceedings
After a data breach involving an AI system, the questions arrive fast: What happened? What data was exposed? Which LLM provider received it? Who was notified and when? Under GDPR Article 33, you have 72 hours to notify the supervisory authority with specifics, not approximations. In a legal proceeding or regulatory investigation, you need evidence that can withstand scrutiny: an immutable record of what occurred, created at the time of the event, not assembled from memory and partial logs days later. Most organizations reach for that record and find fragments. Timestamps from one system, logs from another, a Slack thread that someone might have the context to interpret, maybe.
Igris groups related audit events into incidents with a structured timeline, severity level, and documented scope, so the forensic picture is already assembled when you need it, not built under deadline. The audit trail is an immutable record of every action: who acted, which tool or model was involved, when it happened, and the outcome, allowed, denied, or redacted. Webhook logs provide documented proof that security was notified in real time. Each organization's data lives in its own isolated tenant schema, ensuring that evidence cannot be contaminated or confused with another organization's records, a critical requirement in any legal proceeding or SOC 2 audit.
When the 72 hour GDPR Article 33 notification window opens, you have a structured incident record ready to submit, not a scramble to piece one together. When legal proceedings require evidence, you have an immutable audit trail created at the time of the event. That is a fundamentally different position to be defending from.
Have the evidence ready before the request arrives
See how legal teams produce data minimization proof, vendor data flow documentation, and forensic incident records on demand.