Is it safe to use AI with your company's data?

The question behind the question

When a business owner asks whether AI is safe, they are almost never asking a technical question. They are asking some version of: could something I put into this end up somewhere embarrassing? A competitor seeing their pricing. A client finding out their contract went into a chatbot. A regulator asking where the personal data went.

Those are reasonable fears. They are also mostly answerable, and the answers are more boring than the fear suggests.

I handle personal information from Fortune 500 companies most days as part of my actual job, under contracts that specify exactly how it may be processed. That work is why I take this question seriously rather than waving it off, and also why I think the honest answer is less alarming than the average LinkedIn post about it.

The distinction that decides the answer

There are two versions of almost every AI product, and they have genuinely different terms.

Consumer plans are the free and personal paid tiers you sign up for with an email address. Historically, several major providers have used conversations from these tiers to improve their models unless the user opts out, and some have shifted their defaults over time. If your team is using personal accounts for work, this is the gap.

Business, team, and enterprise plans are bought by a company, administered centrally, and carry commercial terms. On these tiers, the major providers state that customer content is not used to train their models by default. They also typically add administrative controls, audit logging, retention settings, and a contract you can actually hold them to.

This is the single highest-value action most small businesses can take on AI privacy, and it is not technical: stop people using personal accounts for company work, and buy the business tier. It usually costs a little more per seat than the personal plan people are already expensing.

Because these policies do change, do not take my word for the current terms. Open your provider's privacy or trust page, find the sentence about training on customer content, and confirm which tier it applies to. If you cannot find that sentence in plain language, treat that as information too.

What "trains on your data" actually means

Three different things get collapsed into this phrase, and keeping them apart makes the whole topic easier to reason about.

• Model training. Your content is used to update the model's weights, which is what people picture when they imagine their contract "being inside" the AI. This is the one business tiers generally exclude.
• Retrieval. The system reads a document to answer your question right now, then the answer is produced and the document is not absorbed into anything. This is how most useful business AI actually works, and it is not training.
• Retention. Your conversations are stored for some period so you can see your history, and so the provider can investigate abuse. Storage is not training. Business plans usually let you set or shorten this.

A system can retrieve from your files constantly and retain nothing meaningful, while never training on anything. That is the normal shape of a well-configured business setup.

There is a flip side worth saying out loud, because vendors rarely do. "We do not train on your data" also means the model will not get smarter about your business on its own. Uploading a document once does not teach it who your clients are. If you want a system that knows your company, somebody has to deliberately build and maintain that, and that work is the actual project.

What I would actually worry about

Training is the famous risk. In practice it is rarely the one that bites. These are the ones I plan around.

Giving it too much access

The most common real failure is mundane: someone connects an AI tool to an entire shared drive because that was the easiest option, and now anything the tool can reach is reachable by anyone who can ask it a question. If your file permissions were already untidy, AI does not create that problem, it surfaces it, instantly and at scale.

The fix is least privilege. Give a system the specific folders it needs for the job it does, not the whole drive. This is unglamorous and it is most of the actual security work.

People using whatever they like

If the company has not provided a sanctioned tool, people use their own. That is not a discipline failure, it is what happens when someone has a deadline. Every one of those accounts is outside your contracts, your retention settings, and your visibility.

Providing a good business-tier option is a security measure, not just a productivity one.

Instructions hidden in content

When an AI can both read outside content and take actions, text inside that content can try to influence it. A malicious instruction buried in a web page or an attached document can attempt to redirect what the system does next. This is a genuine, active area of risk, and the providers themselves say it is not fully solved.

The practical mitigation is the same as the general rule: limit what the system can reach, limit what it can do without approval, and be careful about letting something that reads untrusted content also hold the keys to send things.

Confident, wrong, and unchecked

Not a privacy risk, but it belongs on the list because it is the one most likely to cost you money. A system that produces a plausible, incorrect number and a person who does not check it is a worse combination than either alone. Keep a human approving anything that reaches a client or moves money.

The questions to ask any AI vendor

If you are evaluating a tool or a consultant, these are the ones that produce useful answers. Vague responses to these are themselves the answer.

• Is our content used to train your models, on the specific plan we would buy? Where is that in writing?
• How long do you retain our conversations and files, and can we change that?
• Where is the data stored, and which sub-processors touch it?
• Which of our systems would this connect to, and what exactly can it see in each one?
• Does it inherit our existing permissions, or does it get its own blanket access?
• What does it do on its own without a human approving it?
• What is logged, and can we review it?
• If we leave, what happens to our data, and what do we keep?

That last one matters more than people expect. If leaving a vendor means losing the thing you built, you did not buy a system, you rented a dependency.

What good looks like

When I set a company up, the privacy design is boring on purpose:

• Business tier accounts in the company's name, administered by the company, never personal logins.
• Scoped access. The system reaches the folders and tools its job requires. Not the whole drive, not the finance system, not email unless email is the point.
• Permissions inherited from the business, so what the AI can see depends on who is asking. Someone cannot ask their way into data their role does not cover.
• A human approval step in front of anything that reaches a client, changes a price, or sends a message.
• Ownership stays with the client. Accounts in their name, their data, their setup. If they stopped working with me tomorrow, nothing stops working.

None of that is exotic. It is the same set of controls you would want around a new employee who is fast, tireless, occasionally overconfident, and has no instinct for what is sensitive.

When the answer is genuinely no

Some things should not go into a general AI tool, and a consultant who never says so is selling rather than advising.

• Data you are contractually barred from processing outside a specific environment. Some client agreements say exactly this, and the contract wins.
• Regulated categories where your obligations are specific, such as health records or payment card data, unless the tool is explicitly covered and the paperwork exists.
• Anything you could not explain to the person it belongs to. If describing it to your client would embarrass you, that instinct is correct.

In most small businesses, the useful work is nowhere near these lines. Proposals, pricing, scheduling, reporting and internal documentation are not sensitive in this way, and that is where the hours actually go.

The one-paragraph version

Buy the business tier and stop people using personal accounts for work. Connect systems to the specific data they need rather than everything. Keep a human in front of anything that leaves the building. Write down what you would not put in, and why. Then get on with it, because the risk of a competitor using this well while you deliberate is also a real risk, and it is the one nobody writes a policy about.