AI and Data Privacy: What to Ask Before Sending Business Data to a Model
The key privacy and security questions for AI features, from data retention to access control, explained without jargon.
AI features often need access to sensitive information: customer messages, documents, or internal records. Before connecting any of that to a model, it is worth asking some straightforward questions. This is general guidance, not legal advice.
Where is the data processed?
Know which provider processes your data and in which region. Some industries and contracts require data to stay within particular jurisdictions.
Is the data stored, and for how long?
Check whether the provider retains requests and responses, for how long, and why. Business and enterprise plans often offer stricter retention terms than consumer products.
Is the data used for training?
Confirm in writing whether your inputs may be used to train or improve models. For business use, you usually want this switched off.
Who can access what?
AI features should respect the permissions people already have. An internal assistant should not reveal documents a user could not otherwise open. Permission-aware retrieval is essential.
What is logged in your own systems?
Logs are valuable for quality and debugging, but they also hold sensitive data. Decide what to log, who can see it, and how long to keep it.
Do you need to send it at all?
- Remove or mask personal details that are not needed for the task.
- Send only the relevant passages, not whole documents.
- Consider on-premises or private hosting for highly sensitive workloads.
The safest data is the data you never send.
Tell your users
Be clear in your product and privacy policy about how AI features use data. Transparency is both a legal expectation in many places and a foundation of user trust.
MOKRIN designs AI features with data minimisation, permission-aware access, and clear retention settings from the start, and documents how data flows so you can answer customers' questions with confidence.
