AI tool privacy: what to check before uploading sensitive work
Convenience can hide a data decision. Before putting business or personal information into an AI service, understand what you are sending and what the provider says happens afterward.
Classify the information
Separate public information, ordinary internal material, confidential business data and highly sensitive information. The more sensitive the material, the stronger your controls should be.
Read the data-use language
Look for explanations of whether submitted content may be used to improve services, how long information is retained, and what controls are available.
Check account permissions
For connected apps, inspect which files, mailboxes, calendars or drives the service can access. A useful feature does not require every permission available.
Minimize the input
If the task can be completed with a redacted excerpt, do not upload the entire document. Data minimization reduces exposure without necessarily reducing usefulness.
Consider deletion and export
Know whether you can delete conversations, revoke connected access, export your work, and close the account cleanly.
The rule
Treat an AI service like any other external software vendor: understand the data flow before you hand it sensitive information.