AI security · RAG and AI search

RAG security and data-leak testing.

Your AI assistant can search every document it is connected to. We check whether it shows staff, customers or partners the salary sheet, the contract or the client file they should never see, and whether one planted document can make it lie.

Get a fixed-price quote
Access rules tested for every rolePoisoned-document testsDPDP and GDPR mapping
leak test · sample● demo
  1. FOUND Intern saw board minutes via “summarise Q3 plans”
  2. BLOCKED Salary sheet blocked for the sales role
  3. FLAGGED Deleted file still in the search index
  4. FIXED Results now filtered by user permissions
  5. PASSED Client A cannot see client B
In plain words

RAG (retrieval-augmented generation) is how most company AI assistants answer questions: they search your documents, then write a reply from what they find. Data-leak testing checks whether that search respects who is asking. We sign in as different roles, customers and tenants and try to pull out files they should not see, test whether a planted document can change answers, and check that deleted or private data is really gone from the index.

Duration
1–3 weeks
Coverage
OWASP LLM02 · LLM08
Tested as
Every role and tenant you name
Pricing
Fixed fee
Where AI search leaks

Nine leaks we look for.

Most leaks are not clever hacks. They are permission gaps that existed for years and only become visible when an AI can search everything in seconds.

  • Missing permission filters

    The index holds every document, and nothing checks the asker’s role before results reach the AI.

  • Cross-tenant leaks

    In a SaaS product, one customer’s question pulls in another customer’s files.

  • Over-shared sources

    A folder shared with “everyone” years ago is now searchable by an AI that never forgets.

  • Stale and deleted data

    Files removed from the drive still live on in the vector index or cache.

  • Poisoned documents

    A planted file with hidden instructions or false facts changes answers for everyone.

  • Personal data in answers

    Names, phone numbers, Aadhaar or PAN numbers repeated in replies, citations or logs.

  • Exposed vector stores

    An index reachable from the internet, where stored vectors can be used to rebuild parts of the original text.

  • Prompt and citation leaks

    The AI quotes internal file names, paths or its hidden instructions in its sources.

  • Logs and analytics

    Questions and answers, full of personal data, kept indefinitely in a third-party tool.

Leak walk-through

How an intern reads the board minutes.

  1. Your teamA new intern asks a harmless question

    “Summarise our plans for next quarter.”

  2. Your AIThe assistant searches everything

    The index was built from the whole shared drive, including a folder of board papers shared too widely years ago.

  3. Your dataBoard minutes appear in the answer

    Restructuring plans and salary bands come back in a neat summary, with citations.

  4. AttackerThe summary is forwarded

    Nobody hacked anything. The AI simply made old over-sharing easy to find.

  5. The fixThe fix

    Filter results by the asker’s real permissions at query time, clean up over-shared sources, and keep sensitive folders out of the index. We retest as every role.

We prove leaks without reading your secrets

Wherever possible we plant our own marked test documents, called canaries, in each source and check which roles can retrieve them. That proves a leak exists without our testers opening your real salary sheet.

Where we must test with real content, we agree in writing what we may view and how evidence is redacted.

Coverage

The OWASP risks for AI search.

0102030405060708091010/10TESTED

Where AI search most often fails

  1. LLM01
    Prompt injection

    Hidden instructions inside documents the AI retrieves.

  2. LLM02
    Sensitive information disclosure

    Personal and confidential data in answers, citations and logs.

  3. LLM03
    Supply chain

    Embedding models, vector databases and connectors in the pipeline.

  4. LLM04
    Data and model poisoning

    Planted or edited documents that change what the AI says.

  5. LLM05
    Improper output handling

    Answers rendered as links, scripts or markdown that leak data.

  6. LLM06
    Excessive agency

    Connectors with write access the assistant does not need.

  7. LLM07
    System prompt leakage

    Hidden instructions and file paths exposed in replies.

  8. LLM08
    Vector and embedding weaknesses

    Permission filters, tenant isolation, index exposure and inversion.

  9. LLM09
    Misinformation

    Answers built from outdated or wrong documents.

  10. LLM10
    Unbounded consumption

    Expensive queries that drain your AI and search budget.

How it works

Ask as everyone, see what comes back.

  1. Week 1

    Scope and roles

    Agree data sources, user roles and tenants, and get a test account for each.

  2. Week 1

    Map the data

    Trace each source from drive or database, to index, to answer.

  3. Weeks 1–2

    Leak testing

    Ask as every role, try cross-tenant access, plant canary documents, inspect the index.

  4. Weeks 2–3

    Report

    Leaks with examples, root causes and the access fixes.

  5. After your fixes

    Retest

    Every leak test repeated, as every role.

What you get

Every leak, shown and fixed.

HANULSECAI data-leak report CLIENTSample · internal HR assistant SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical2High3Medium4Low2 COVERAGE · OWASP LLM02 · LLM08 RETEST PASSED Sample layout, not client data
  • 01
    Leak report with examples

    Each leak shown with the question asked, who asked it and what came back.

  • 02
    Source clean-up list

    Over-shared folders and files to fix at the source.

  • 03
    Access design fixes

    How to filter by permission at query time, per tenant and per role.

  • 04
    DPDP and GDPR mapping

    Which leaks involve personal data, and what the law expects you to do.

  • 05
    Free retest

    Every leak test repeated after your fixes.

Who it is for

Before, or just after, you switch on AI search.

  • Companies rolling out Microsoft 365 Copilot, Gemini for Google Workspace or Glean across shared drives
  • SaaS products with an AI assistant that searches each customer’s data
  • HR, legal and finance teams with AI search over sensitive files
  • Support teams whose bots answer from a knowledge base
  • Teams building RAG on Pinecone, Weaviate, pgvector, Elasticsearch or OpenSearch

Cheaper before than after

Run a permission clean-up on your sources before an AI indexes them. It costs far less than handling a leak.

We offer a pre-rollout check of about a week: which folders are over-shared, which should stay out of the index and which roles to test first.

Standards

Mapped to the rules on personal data.

OWASP Top 10 for LLM Apps2025 edition
DPDP Act 2023With the DPDP Rules 2025
GDPREU data protection
ISO/IEC 27001Information security
ISO/IEC 42001AI management systems
SOC 2Trust Services Criteria

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is RAG security testing?
It is a test of AI assistants that answer from your documents. We check whether the search behind the AI respects permissions, whether different customers or tenants are kept apart, whether planted documents can change answers and whether private data leaks into replies or logs.
Q02Is this the same as a DLP tool?
No. Data loss prevention tools watch data leaving through email, uploads or USB drives. We test whether your AI itself hands data to the wrong person inside your own systems. The two work well together.
Q03Do you need to read our documents?
No. We need test accounts for each role. Wherever possible we plant our own marked canary documents and check who can retrieve them, so we prove leaks without opening your real files.
Q04We use Microsoft 365 Copilot. Can you test it?
Yes. Copilot works within your existing Microsoft 365 permissions, so content that is over-shared in SharePoint, OneDrive or Teams becomes easy to surface. We test as your real roles and show what each one can pull out.
Q05How does the DPDP Act affect AI search?
If your documents hold personal data of people in India, showing them to the wrong person can be a personal data breach. The DPDP Rules require reasonable security safeguards and breach intimation to the Data Protection Board and to the people affected, with a detailed report to the Board within 72 hours. Penalties for failing to protect personal data go up to ₹250 crore.
Q06How long does it take?
One to three weeks, depending on the number of data sources, roles and tenants.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings