Seeing which AI tools your people actually use

Why your list is wrong

Trial accounts. AI tools are free to start and ask only for a work email address. There is no procurement moment, no invoice and therefore no trace in the books.

Features that get added. A package you have used for three years puts an AI assistant in it. Nothing changes in the price and nothing in the contract, but data does go to a new model.

Models that switch. In your own product, switching models is one line of code. The tool in your register is then formally the same, but what happens under the bonnet has changed.

Keys in someone's name. A developer creates a personal API key to try something. It works, so it stays. Two years later production code runs on the key of someone who no longer works there, and nobody knows.

Why that is a problem

Not because every tool is dangerous. Most are not. The problem is that you can't answer four questions:

• Where does our data go and which country does it sit in.
• Who has access, and what happens when that person leaves.
• What does this cost us in total.
• Is what we tell our customers and our accountant accurate.

On top of that: one loop in code talking to a paid model without a limit can produce a bill of thousands of euros over a weekend. That isn't a legislative problem, but it does hurt.

What companies try

Asking around. Works once. You get the tools people remember and not the tools they used in passing.

Banning it. Backfires. People then use it on their own account and their own laptop, and you have less visibility rather than less usage.

Going through the invoices. Finds only what is paid for. The free trial accounts, which carry the most risk, appear nowhere.

Filtering network traffic. Works for companies with their own IT department and a managed network. For a company of twenty people with laptops and people working from home it is too heavy.

What does work at this size

Making sure the AI traffic of your own products and processes passes one point. Not to block it, but to see it.

In practice that means: instead of every project talking directly to OpenAI or Anthropic, they talk to one address inside your own environment, which forwards the request. From that moment you know per project which model is used, what it costs and when something new turns up. Keys sit centrally and can be revoked per project, and you can set a budget per project that closes automatically.

This doesn't cover everything. A colleague using a chatbot in their browser doesn't pass this point. For that you still need an agreement and a place to report it. But it does cover the part where your own products and your own data sit, and that is the part the questions are about.

What we are building

Noxtrack is that one point, with the processing inside Europe. You change one setting in your projects, and after that you see what passes through, what it costs and which models have been added. What you see fills your AI register at the same time.

It isn't finished, but you can already get in. We set up the first companies by hand. Book an intro call if you want to be one of them.