How do I use AI in my business without putting client data at risk?
For a security firm, leaking client data through an AI tool is a business-ending mistake. Rules come before tools.
- Can our team use ChatGPT with client data?
- Which AI tools are safe?
- What do our client contracts allow?
Write a short AI policy, approve specific business-grade tools with clear terms on training and retention, classify what data may go into them and keep client findings, credentials and personal information out unless a tool is approved for it. Check your client contracts, many restrict sharing data with third parties. Log use, train staff and review the policy as tools change.
Data rules
| Data type | Allowed in approved AI tools? |
|---|---|
| Public information, your own marketing content | Yes |
| Internal notes without client identifiers | Yes, in approved tools |
| Client names and contacts | Only in tools approved for client data |
| Vulnerability findings, reports, logs | Only if contracts and tool terms allow |
| Credentials, keys, secrets | Never |
Check contracts and law
Client agreements often limit subprocessors and require notice. In Canada, privacy law applies to personal information you handle, and the Privacy Commissioner has published principles for generative AI. In the US, the FTC expects businesses to protect what they collect. Confirm with your lawyer.
How we look at it at ShoutEx
We design automations that keep sensitive data out of AI tools unless it's approved, and we document data flows so you can answer clients' questions about your own AI use. Our guide on AI data and security covers vendor questions.
- Staff using personal AI accounts for client work.
- No written AI policy.
- Findings pasted into chat tools.
- Contracts that forbid what you're doing.
- An approved list of AI tools.
- Clear data classification.
- Contracts checked for subprocessors.
- Staff training and logging.
What buyers and practitioners say
Here is what regulators and practitioners say.
The principles call for appropriate purposes, openness, limiting personal information and accountability when using generative AI.
Read the principles →NIST's framework gives a structure to identify and manage AI risks, including data exposure.
Read the framework →Security teams discuss writing AI acceptable-use policies and controlling data sent to AI tools.
Browse the threads →Community summaries describe recurring themes in public threads, not individual posts. Vendor pages describe vendor claims, so test them on your own calls.
Read next
Go deeper in the ShoutEx guides, or check the sources behind this answer.
We'll design automations that keep sensitive data where it belongs.
Book a call →Follow-up questions
Do clients ask about our AI use?
Increasingly, in questionnaires. A clear policy makes the answer easy.
Can we run AI models privately?
Yes, with self-hosted or private deployments. They cost more and need maintenance.
Should we tell clients we use AI?
Be open about it where it touches their data or deliverables.