Data privacy
AI data privacy for business: what leaves your company
AI data privacy for business comes down to one question: when someone at your company uses an AI tool, what leaves the company, where does it go, and who can see it? Most tools can answer this, but you usually have to ask.
What can leave your company
It is more than the question somebody types:
- Questions: which often include names, figures and client details.
- Files: the documents attached, or the text taken from them.
- Chat history: stored so people can come back to it.
- Web searches: sent to a search service if the tool looks things up.
- Connected accounts: email or other tools the AI has been given access to.
Eight questions to ask any AI vendor
- What exactly leaves our network when someone asks a question?
- Which other companies receive it, such as model providers?
- Where are our chats and files stored, and in which country?
- Is our data used to train any model? Where is that written down?
- How long is it kept, and can we delete it?
- Who at the vendor can read it, and when?
- Who inside our company can see what? Can administrators control this?
- Can we see what the AI did, step by step?
Ask for the answers in writing. A vendor's terms count for more than its marketing, and that includes ours.
Risks that are easy to miss
- Unapproved tools: Zoho warns that staff using unauthorized AI models invite privacy problems. Giving people an approved tool is often more effective than a ban.
- Prompt injection: text hidden in a document or web page can try to steer the AI into doing something you did not ask for.
- Too much access: an AI connected to everything can surface documents to people who should not see them, so set AI team permissions.
- Actions, not just answers: an AI that can send or delete things needs limits on what it can do without approval.
Which laws may apply
Using AI does not change your duties under data protection law, and the rules depend on where you and your customers are. Common ones include India's Digital Personal Data Protection Act, GDPR in Europe, and HIPAA for US health data. GDPR fines can reach up to €20 million or 4% of global annual revenue.
This page is not legal advice. Ask a qualified adviser what applies to your business.
How SyncMind answers
| On-premise edition | API edition | |
|---|---|---|
| What leaves your network | Nothing | Your questions and the document text needed to answer them, to the model provider; web searches |
| Chats and files in your own database | Yes | No |
| Works with no internet | Yes | No |
| Administrator account and invite codes | Yes | Yes |
| Agent Log of every step | Yes | Yes |
If your data has to stay in your building, choose our on-premise AI assistant. For the API edition, email us for where chats and files are kept, and the terms of the model provider on your plan.
To weigh up the wider options, read about private AI for business or what self-hosted AI for teams really takes. Plans are on the pricing page.
Questions
Is it safe to put company data into an AI tool?
It depends on the tool, its terms and the data. Find out what the tool sends, where it stores it, who can see it and whether it is used for training before staff rely on it.
What is the most private way to use AI at work?
Running the models on computers you own, so nothing leaves your network. It takes hardware and upkeep, so it is not the right choice for everyone.
Does SyncMind's on-premise edition send data anywhere?
No. The models and the database run on your own computers, and it works without internet.
Does SyncMind's API edition send data anywhere?
Yes. Your questions and the document text needed to answer them go to the model provider, and web searches go to the web. Chats and files are not kept in your own database.
Last updated