Data-Leakage Testing for Internal Research Copilots

• Chief Information Security Officer
• Head of Compliance and Control Room
• Head of Data and AI Platform
• Research Platform Owner

Internal copilots now sit on top of research notes, licensed broker research, client portfolios, deal documents and meeting transcripts. If the retrieval layer ignores who is allowed to see what, a public-side analyst can surface private-side information, an RM can see another team's clients, or a poisoned PDF in the research inbox can steer the copilot's answers.

We run a security assessment of your copilot focused on data leakage. We map data sources, roles and entitlements, including information barrier rules from your control room, and create test accounts for each role. We seed synthetic canary documents into restricted collections, so leakage can be proven without touching real sensitive information. We then try to retrieve restricted content through direct questions, indirect and multi-step prompts, summarisation requests, tool calls and prompt injection planted in ingested documents. We also review caches, conversation memory, logs and outbound calls to model providers. Every confirmed leak comes with reproduction steps, a root cause and a fix, and the tests become a regression suite.

• Maps data sources, roles, entitlements and information barrier rules into a test matrix
• Seeds synthetic canary documents in restricted collections to prove leakage safely
• Attempts cross-role retrieval through direct, indirect, multi-step and summarisation prompts
• Tests prompt injection planted in emails, PDFs and web content the copilot ingests
• Reviews caches, memory, logs and outbound calls to model providers and telemetry
• Reports confirmed leakage paths with reproduction steps, root cause and regression tests

1. 01Map accessData sources, roles, entitlements and information barrier rules are documented with the platform team and control room.
2. 02Seed canariesSynthetic canary documents are placed in restricted collections, and test accounts are created per role.
3. 03Run leakage and injection testsEach role attempts to reach restricted content, and planted injections are triggered.
4. 04Inspect data flowsCaches, memory, logs and outbound model calls are reviewed for sensitive content.
5. 05Confirm findingsSuspected leaks are verified and confirmed with the control room before reporting.
6. 06Fix and re-testFixes such as metadata filters and access propagation are re-tested and added to a regression suite.

1. Access mapping and setup
   • Data source and entitlement inventory
   • Information barrier rules from the control room
   • Per-role test accounts
   • Synthetic canary documents
2. Execution
   • Prompt campaign runner with direct, indirect and multi-step probes
   • Injection payloads planted in test documents
   • Tool-call and summarisation probes
3. Data-flow review
   • Log, cache and conversation memory inspection
   • Outbound model provider call capture
   • SIEM correlation
4. Reporting
   • Control room confirmation of findings
   • Findings with reproduction steps and root cause
   • Regression suite for CI

The control room or compliance team defines what counts as restricted for each test and confirms every leakage finding before it is reported. Platform owners approve and schedule fixes.

• Copilot staging environment
• Identity provider such as Microsoft Entra ID or Okta
• Vector database and document stores
• SIEM for log review
• CI/CD pipeline for regression tests

• Synthetic canaries only; no real unpublished price sensitive information is used
• Testing in staging or agreed windows under a written scope
• Seeded data removed at the end of the engagement
• Findings encrypted and shared only with named owners
• No data leaves your environment during testing

• Helps evidence the information barrier controls expected under SEBI's insider trading regulations, which govern the handling of unpublished price sensitive information.
• Findings map to the OWASP Top 10 for LLM Applications and support the controls expected under SEBI's cyber resilience framework.

• Capital Markets & Wealth Management

  Guardrail Testing for Investment Advisory Chatbots

  Test wealth and broking chatbots for unregistered advice, missing risk disclosures, made-up fund data, prompt injection and client data leakage, scored against your SEBI registration scope.

• Capital Markets & Wealth Management

  Research Report Summarisation and Data Extraction

  Extract ratings, targets, estimates and guidance from broker research and company filings, with cited summaries and revision alerts for your analysts' internal use.

• SaaS & AI Product Companies

  RAG Data-Leakage and Access-Control Testing

  Test whether your RAG pipeline leaks documents across users, roles or tenants through retrieval, caching, citations or logs, using seeded canary documents and role-based test personas.

• Legal

  Confidentiality and Privilege Leakage Testing for Legal AI

  Test your legal copilot, contract tool or client chatbot for cross-matter leakage, privilege exposure, prompt injection hidden in documents and weak access controls, with evidence and fixes.