Swipe to see each slide.
The short answer
It depends on the tool, plan and settings: an AI tool processing your file is separate from a provider training its model on your data, and free consumer tools carry more risk than business tools with a training opt-out. Do not guess: ask the vendor in writing whether training can be turned off and how long prompts are stored.
Three things to remember
- 01Processing a file is not the same as training on it, so ask the provider about training directly.
- 02Free consumer tools, shared accounts and unknown retention carry more risk than business tools with training opt-out.
- 03Redact names, prices, IDs and secrets before pasting, and use approved tools with a human review step.
Every slide, in words
- 01
Is your data being used to train their model?
Know the difference between using AI and feeding AI
You upload a file: the tool processes it.
The provider may store logs, depending on terms.
Training use is separate: ask directly.
Know where your data goes before you paste it in.
- 02
Not all AI tools treat data the same way
Risk changes by tool, plan, and settings
Lower risk
Enterprise controls
Training opt-out
Retention limits
Admin visibility
Higher risk
Free consumer tools
Unknown retention
Shared accounts
No written policy
Do not guess: check the policy and settings.
- 03
What counts as sensitive data?
If you would not post it publicly, do not paste it casually
Customer lists: Names, contact details, and other customer information.
Pricing quotes: Prices, discounts, margins, and custom proposals.
Contracts: Signed agreements, terms, and legal documents.
Employee records: Personal details, pay information, and performance records.
Source files: Proprietary code, models, data sets, and technical documentation.
Private strategy: Roadmaps, product plans, M&A ideas, and other non-public plans.
Start with four labels: public, internal, confidential, restricted.
- 04
Questions to ask before you buy
Do not just ask what AI can do: ask what it keeps
Is our data used for training?
Can training be turned off?
How long are prompts stored?
Who can review our outputs?
Can we delete or export records?
Good vendors answer clearly and in writing.
- 05
Use AI without leaking the business
Make safe use easy, not impossible
Redact first: Remove names, prices, IDs, and secrets.
Use approved tools: Pick systems with business controls.
Set a review step: Humans approve sensitive outputs.
A simple process beats telling everyone to “be careful.”
- 06
Small business takeaways
AI can help, but your data rules come first
Know vendor terms
Turn off training when possible
Separate sensitive data
Use business accounts
Keep an audit trail
Train the team on examples
Protect the data that makes your business valuable.
More in part 3
- 1AI security for small business
- 2Shadow AI: your team is already using it
- 3Where does your data actually go?
- 4Is your data being used to train their model?You are here
- 5Personal or business AI accounts: why it mattersWritten
- 6What is PII, and how do you keep it out of AI?
- 7What is data retention, and who decides it?
- 8How are scammers using AI, and how do you stop them?Written
- 9What is prompt injection?
- 10How to write an AI policy for a 20-person company
- 11Recording calls with AI: what do you have to tell people?Written
- 12Should you tell customers when AI is involved?Written
- 13Who owns what AI creates?
- 14AI and your insurance: who's liable when it's wrong?
Next step
Where does this fit your business?
Six quick questions about your business, then your AI plan: what to start with, what a person still checks, and the lessons that go with it. Or bring it straight to a free thirty-minute call.