Your AI agents are handling client data. Prove it's staying where it should.
Watchfold audits what your agents actually do. Every action recorded to a tamper-evident ledger, every data flow mapped to a jurisdiction, delivered as a report your compliance officer can file. Fixed fee. Five days. UK infrastructure only.
The findings no questionnaire would catch
Every agent below behaved. Nothing leaked, nothing crashed. Each finding was only visible from inside the traffic.
Every task carried all five customers' personal identifiers through the agent's context — data it never needed to do the job.
Why it matters: under UK GDPR's minimisation principle, processing data you don't need is a finding in its own right. Redacted at ingest: NI: QQ*****C
A support agent scoped to read orders reached for an internal /admin/refunds endpoint on 3% of tickets — and the endpoint answered.
Why it matters: the agent operated outside its authorised boundary and nothing stopped it — exactly what a regulator asks you to rule out after the fact.
Full prompts — customer names and addresses included — were shipped to a third-party tracing tool with no retention limit set.
Why it matters: personal data was leaving your control and being retained indefinitely by a processor no one had signed off. Low severity, but a live obligation.
Your agent doesn't have to misbehave for you to have a problem.
In March 2026, the ICO, FCA, CMA and Ofcom jointly confirmed: responsibility for what an AI agent does sits entirely with the firm deploying it.
"The AI did it" is not a defence.
The question a regulator will ask is whether you can demonstrate your agents operated within authorised boundaries, after the fact, with evidence.
How the audit works
Four steps across a five-day window. Nothing installed, nothing rewritten, nothing left behind.
-
Connect
Day 0 · ten minutesYour developer changes one line: an environment variable. Ten minutes, reversible instantly, read-only throughout. If Watchfold ever goes down, your agents keep running.
- AGENT_BASE_URL=https://api.provider.com/v1+ AGENT_BASE_URL=https://ingest.watchfold.co.uk/v1 -
Observe
Days 1 to 5 · read-onlyFor up to five days, every model call, tool call and data flow is recorded to a hash-chained, tamper-evident ledger. Sensitive data is redacted at the point of capture. Watchfold never stores your raw client data.
-
Map
Day 5 · every destination resolvedEvery destination your agents send data to is resolved to a jurisdiction. Client data leaving the UK without a transfer mechanism is flagged as a finding, with the evidence attached.
-
Report
Day 5 · one-hour readoutYou receive a ranked findings report with plain-English business impact, a data residency map, remediation guidance, and (if your estate is clean) a positive attestation you can show your insurer or regulator. Delivered in a one-hour readout call.
Ranked findings Data residency map Remediation guidance Positive attestation, if clean
Why you can trust the report
An audit is only worth what its evidence can withstand. Watchfold is built so that even we can't massage the results.
Tamper-evident by design
Every record is hash-chained to the one before it and anchored with signed commitments. Alter, delete or reorder anything, including our own findings, and the chain breaks, visibly.
No overclaiming
Watchfold reports "observed" and "blocked" as different things, and never counts a URL an agent merely read as a data transfer. Findings state exactly what was seen, and the report says plainly what was out of scope.
A clean report is a real result
If your agents are well-contained, you get a positive attestation: evidence of good practice you can file, not a sales pitch for more work.
Two audit engagements per month
Watchfold audits are delivered personally, on UK infrastructure, with a readout call for every client. To keep that standard, we take on two engagements per month. Fixed-fee, scoped on a 45-minute call. You'll know the exact cost before anything is signed.
Agent Audit
A five-day observation window across your agent estate, full findings report with severity rankings and data residency map, readout call, and one re-test of your highest-severity finding included. Fixed fee, quoted at scoping.
Continuous Monitoring
For audited clients: live policy checks, breach alerts the moment they happen, and a quarterly attestation letter for your compliance file. Monthly retainer.
UK infrastructure, single-tenant, your data deleted after the engagement with a deletion certificate.
What firms ask us
{{ f.a }}
Two engagements per month. Reserve yours.
Register your interest and we'll come back within two working days to arrange a scoping call.
We reply within two working days.
A 45-minute scoping call with you and one technical contact.
A fixed quote in writing. Nothing is signed on the call.
Prefer email? hello@watchfold.co.uk
Interest registered.
Thank you. We'll be in touch within two working days to arrange your scoping call.
reference WF-REG-2607 · logged · nothing signed