Nothing here is gated. The print action produces a paginated PDF through your browser — one sheet per page, with the illustrative marking retained.
Same sections, definitions and wording as the report Moustr generates. Figures model an organisation of 1,400 people and reconcile with the Sprawl Simulator on this site. Tool and person names are fictional, no customer data appears here, and no organisation described in it is real.
Contractual and Legal Exposure Report
A short briefing for whoever owns contracts, DPAs and legal risk — what needs a signature, what needs a decision, and how exposed the estate is right now.
01 · EXPOSURE SUMMARY
Significant gaps — 34/100
Compliance Score = 50% coverage (governed & owned) + 30% DPA-completeness of governed tools + 20% a critical-findings penalty (−20 pts per critical finding). 22 tools are currently governed, 59% of them with a data-processing agreement on file.
| VENDOR RISK EXPOSURE | MINIMAL / NO | LIMITED / EU | HIGH+ / NON-EU | UNKNOWN |
|---|---|---|---|---|
| Risk assessment level | 88 | 38 | 9 | — |
| Data residency | — | 31 | 58 | 46 |
| Trains on your input | 49 | — | 27 | 59 |
“Unknown” is never counted as safe — it means no vendor finding yet, not confirmed-safe. Risk levels are an automatic screening signal, not a legal determination.
CONTRACTUAL AND LEGAL EXPOSURE REPORT · 30 SEP 2026 · CONTINUED
02 · CONTRACT TIMELINE
6 tools with a recorded contract date
Every tool with a contract expiry date recorded, soonest first.
| TOOL | EXPIRY DATE | STATUS | OWNER |
|---|---|---|---|
| FieldReport.ai | 18 Sep 2026 | 12d overdue | Marta Jansen |
| BudgetBot | 21 Oct 2026 | in 21d | Sofie Lindqvist |
| SketchBot AI | 14 Dec 2026 | in 75d | Anna de Boer |
| Quillo Writer | 28 Feb 2027 | in 151d | Anna de Boer |
| RouteWise | 30 Apr 2027 | in 212d | Jonas Berg |
| InvoiceIQ | 30 Jun 2027 | in 273d | Sofie Lindqvist |
03 · FINDINGS AND ACTIONS
4 things for you to decide
Only contract-expiry and missing-agreement findings — ownership-assignment gaps and overall coverage are tracked separately, in the Governance Report.
| REF | FINDING | ACTION | OWNER | DUE |
|---|---|---|---|---|
| §1 | criticalFieldReport.ai’s contract expired 12 days ago | Renew or formally retire the FieldReport.ai contract — currently trading without agreement cover. | Marta Jansen | 12d overdue |
| §3 | criticalHRScreen AI is classified high risk with no agreement on file | Obtain and record a data-processing agreement for HRScreen AI before continued use is signed off. | Pieter de Wit | This quarter |
| §4 | warnBudgetBot’s contract expires in 21 days | Confirm the BudgetBot renewal before the window closes. | Sofie Lindqvist | 21 days |
| §7 | warnLegalDraft AI is classified high risk with no agreement on file | Obtain and record a data-processing agreement for LegalDraft AI before continued use is signed off. | Unassigned | This quarter |
This report reflects Moustr’s governance records as of the date above. It is a decision-support tool, not a compliance certification, and does not constitute legal advice.
The Governance Report
For management and the audit committee — what is running, what has been reviewed, what needs a decision, and the evidence behind it.
Open the sample → SAMPLE 2 OF 3The Estate Report
The working report for IT and security — the state of the estate, the triage queue, where confirmation is stuck and coverage achieved.
Open the sample →