Dembri DPO Agent Draft outputs. A named human approves.
Dembri DPO Agent · self hosted

Every finding shows its evidence and its article of law.

Two AI agents, a DPO agent and an ASO agent, assess evidence that read only connectors collect from your systems. Every finding links to a stored artefact and to an article in the law library. A named person reviews each finding and approves the report.

Read only connectorsRedacted before storagePreview before any model callHuman approval with report hash
Sign in How it works
01 · The agents

Four lanes. One reviewer.

Connectors collect. Agents propose. You decide. You see each step as a recorded event with its count and time, not as a stream of model thoughts.

Lane 1 · deterministic

Collectors

Read only connectors gather evidence from the sources you connect. They redact personal data before anything is stored.

  • Website, Git, OpenAPI
  • Read only MCP servers
  • Uploaded documents
Lane 2 · AI

Data map agent

Turns the evidence into processing activities and a list of AI systems in use. This map feeds the ROPA and the AI register.

  • Processing activities
  • Data flows and vendors
  • AI systems found
Lane 3 · AI

DPO agent

Assesses the evidence against the regimes you select. It proposes findings with severity, a tag (breach, gap or risk), risk exposure and citations.

  • DIFC DP Law 2020
  • UAE PDPL, GDPR, India DPDP, ADGM DPR
  • Evidence linked to each finding
Lane 4 · AI

ASO agent

Assesses autonomous and AI systems: under DIFC Regulation 10 for DIFC entities, and as an inventory with oversight and transparency findings for everyone else.

  • DIFC Regulation 10
  • AI systems register or inventory
  • Human oversight gaps
The final step · no AI

A named reviewer

Accepts, revises or marks each finding mitigated, with an owner and a due date. Then approves one fixed report version. The tool records the name, the time and the report hash. A later change creates a new version.

02 · How it works

From sources to an approved DPIA

Nothing reaches a model before you see the redacted preview. Nothing is final before a person approves it.

  1. ConnectAdd read only sources. Each one shows the exact permission it requests.
  2. PreviewCollect evidence without any model call. See the redacted digest a model would receive.
  3. RunStart the agents. Watch stages, counters and the event log update live.
  4. ReviewOpen each finding with its evidence and the article text. Record your decision.
  5. ApproveApprove one version. Export the DPIA, the ROPA and the AI register.
03 · Data handling

What it reads, what leaves, what it keeps

The data handling page is generated from this server's settings in force. It is not marketing text. Read it in full.

Reads

  • Website: public pages only. No login, no form submission.
  • Git: a read only shallow clone from an allowed host. Excerpts only, never whole files.
  • OpenAPI: a static read of one specification file. No request goes to the API.
  • MCP: only servers and read only tools the administrator declared.
  • Documents: files you upload, parsed in an isolated process.

Leaves and stays

  • Redaction before storage: emails, phone numbers, IDs, IBANs, cards, keys, passwords and private keys are replaced by markers.
  • Sent to model processors: a redacted digest of each evidence item and your redacted context text.
  • Not sent by design: original artefacts, uploaded files, whole repositories.
  • Provenance: a keyed digest of each original artefact, so you can prove its source without the tool holding the data.
  • Retention: evidence text is blanked after a set period. You can delete an engagement and all its files at once.
04 · Output

Draft until a person approves it

A DPIA in the structure of the DIFC Commissioner's worksheet and ISO/IEC 29134. A ROPA and an AI systems register from the same data map. The tool never labels an organisation “compliant”. It shows scope, findings, evidence and review status.

Every finding carries

  • Severity, a tag (breach, gap or risk) and a likelihood × impact score
  • At least one stored, redacted artefact with its keyed digest. Open questions have none and are marked as questions.
  • Citations from the bundled law library. Text that is not verified is flagged.
  • The reviewer's decision, owner and due date

Exports

  • DPIA as Word, PDF, HTML, Markdown and JSON
  • ROPA as a spreadsheet (DIFC Article 15 when DIFC is selected; the record-keeping duty of the UAE PDPL otherwise)
  • AI systems register as a spreadsheet (a DIFC Regulation 10 register when DIFC is selected; an inventory otherwise)
  • The audit log of every action, per engagement

Works for DIFC entities and for mainland and free zone companies under the UAE PDPL (DMCC, JAFZA, DED licensed and others), and for anyone who serves EU data subjects. Select the regimes per engagement.

DIFC DP Law 2020DIFC Regulation 10UAE PDPL (Federal Decree Law 45 of 2021)GDPRIndia DPDP Act 2023 and Rules 2025ADGM DPR 2021 (partial)
Access

Run it on your own server

Each organisation runs its own instance. The administrator signs in with the admin password set at deployment. To get an instance or access, contact Dembri.

Sign inRequest access