We ran our own test on ourselves
Our AI Fit tool produces a sheet of questions to put to a software supplier, and a prompt for reading that supplier's published documents to see which of them are already answered. We have written that a test you only run on other people is a weapon. So we ran it on My Digital Sovereignty.
Of the seven questions the tool generated, the published documents answer five. Two they do not — and both are ones we would press a supplier about.
The two the documents do not answer
Taken first, because putting them last is how a page like this becomes marketing.
Not found
Which legal entity would we be contracting with, what country is it registered in, and what is its ultimate parent company and that parent's country of registration?
The first half is answered plainly. The ultimate parent is not addressed anywhere in the three documents — no statement that there is a parent, and no statement that there is none. Our own question exists because a local entity can be a subsidiary, and a reader cannot tell from these pages which we are.
"My Digital Sovereignty Ltd" (NZBN 9429053246547) — "we," "us," or "our" — is the company that operates the service and the party with whom you contract
Terms of Service, §1, 25 June 2026. Search terms for the missing half: ultimate parent, holding company, wholly owned, shareholder.
Partly found
Which other companies handle our information on your behalf, and will you tell us before you add or change one?
The companies are named, with their countries, which is more than most suppliers publish. What is absent is the second half of the question: there is no page presented as a sub-processor register, and no commitment to notify a customer before the list changes. A list that can change silently is a snapshot.
Village uses a small number of EU and NZ third-party services: Airwallex (New Zealand) for payments, DeepL (Germany) for translation, Bunny CDN (Slovenia) for media edge caching, and ProtonMail (Switzerland) for email.
Security page, 19 August 2026. Search terms for the missing half: sub-processor, notify before, thirty days' notice, object to a new processor.
The five they do answer
Found
Which governments' legal processes could reach our information?
All are outside US jurisdiction. No community data is processed on, stored on, or transits through US-owned infrastructure.
Security page. Note what this does and does not say: it is a statement about where the infrastructure sits and who owns it, which is the right shape of answer, and it does not enumerate every jurisdiction whose process could reach each named supplier.
Found
Is our information, or anything derived from it, used to train or improve any model, yours or a third party's?
We do not use your User Content to train artificial-intelligence or machine-learning models except where you have given separate, explicit, purpose-specific consent
Terms of Service. The Privacy Policy carries the worked example — a speech model that "runs entirely on our sovereign New Zealand infrastructure", with participation voluntary. The base model is disclosed as a self-hosted open-source download rather than an API call.
Found
If we ask you to delete a named person's information, how long does it take to reach backups and logs, and what is left?
Soft deletion: Recoverable for 30 days. Permanent deletion: After 30 days, data is irrecoverably deleted. Backup retention: Data removed from backups within 7 days. Closed accounts: Remaining account data is removed within 90 days of closure
Terms of Service, corroborated in the Privacy Policy's retention section. This is the shape our own question asks for: elapsed times, named, including backups — the part most suppliers leave out.
Found
If your systems are breached, within how many hours do you tell us?
We will notify affected users within 72 hours
We will notify relevant data protection authorities as required by law
Privacy Policy, §10.4. Worth saying plainly: New Zealand's Privacy Act sets no hour count for notifying affected people — it requires notification "as soon as practicable". 72 hours is a commitment made here, not a statutory floor being restated.
Found
Do you contact our members directly, show them advertising, or promote other communities to them?
Member information is visible only within your Village. Other Villages cannot see your member list.
Security page, alongside "No advertising networks or data brokers" and "No third-party analytics that track your behaviour". The Terms also define "the community" as "the members of a given Village, not the company".
What we already say we have not done
One line in the privacy policy's security section is worth surfacing rather than leaving for a reader to find: "Independent third-party penetration testing has not been carried out; it is the next step rather than a completed one." It was already published; the tool did not extract it, because none of the seven questions asks for it. That is a limit of the question set, not a credit to us.
What this exercise is worth, and what it is not
It is not a security assessment, and it does not establish that any of the above is true. Every quotation is a statement we have made about ourselves. What the exercise produces is a record: seven questions, five answered from published text you can open and search, two not, and the two named rather than buried.
The two gaps are ours to close, and this page will still be here if we do not.
An earlier version of this test was wrong
The first attempt put the tool's other prompt — the one for interrogating a chatbot — to a help assistant on our own site, and got five identical non-answers. That was a category error: the assistant is a retrieval system over written answers, with no model of itself, so "no match" said nothing about our candour and everything about aiming the wrong instrument. It was withdrawn before publication. Recording it here because a page about self-scrutiny that quietly discards its own failed first attempt is not doing the thing it claims.
← Back to the tool · Questions and answers about it · The Least Performant AI
The document reading, the extraction of the quotations and the first draft of this page were done by AI agents working under direction, using the same prompt the tool gives readers. The quotations were checked against the source documents; the judgements about what counts as a gap are ours.