Company Data and Cloud AI Services: What You Can and Cannot Share

Implementing AI tools can significantly speed up your company's work, but data security remains a key concern. How do you decide what information you can trust to cloud AI services and what must never be shared? This is not just a technical security issue; it's also a strategic approach to risk.

Why Protecting Data in Cloud AI Services Matters

When your team starts using AI services, a natural question arises: is it safe to upload internal documents, emails, or financial reports? The answer is complex because it depends on many factors—from the service's terms of use to your internal risk tolerance. The main point is understanding that any information you send to a third‑party service could potentially be used by them (for example, to train their models) or become a leak target. For most founders, the biggest fear isn't the model training itself but the data leaking to competitors or being published. This is also discussed in the article on Business Risks of AI.

Definition: A cloud AI service is a tool that runs on the provider's remote servers (e.g., ChatGPT from OpenAI, Claude from Anthropic) and requires uploading data for processing and generating responses.

Which Company Data Should Never Be Shared with Cloud AI Services?

Absolutely avoid sending to cloud AI services any data that could cause significant harm to your company if leaked or misused. This includes both internal secrets and personal data of your customers or employees.

• Trade secret: formulas, unique technologies, strategic development plans, customer and supplier lists, exclusive contract terms, non‑public financial metrics. Anything that gives you a competitive edge.
• Personal data: names, addresses, phone numbers, email addresses, passport details, tax IDs, medical information of customers or employees. This is not only a reputational risk but also carries potential legal consequences, fines, and lawsuits.
• Information protected by an NDA (Non‑Disclosure Agreement): any data received from partners or clients under a confidentiality agreement. Leaking it is a direct breach of contractual obligations.
• Intellectual property data: unpublished patents, proprietary developments, unregistered trademarks, if you do not want them to enter the public domain.
• Access credentials and login details: passwords, API keys, authorization tokens for any internal systems.

Before deciding to share specific data with AI services, take a step back and analyze your company's current situation. Our methodology assumes the founder first gets a full picture of what's happening. For example, you can create a free organizational chart of your company. It shows departments, tasks, and routines that can gradually be delegated to AI agents.

How to Classify Data and Minimize Risks?

It is essential to establish a clear policy for using AI services and train the team on how to follow it. This lets you reduce risks without slowing down the adoption of new technologies.

✅ Step 1: Data classification.

Create an internal document that classifies all company data by confidentiality level: public, internal, confidential, strictly confidential. For each category define whether it can be shared with cloud AI services and under what conditions.

✅ Step 2: Use test and anonymized data.

For initial experiments and automations always use test data or real data from which all sensitive information has been removed. This could be, for example, a transcript of sales calls with names, addresses, and phone numbers stripped out.

Definition: Anonymized data is information from which all identifiers have been removed, making it impossible to directly or indirectly identify the person or company to which the data belongs.

✅ Step 3: Review the service's Terms of Service.

Carefully read the user agreements of AI services. Pay attention to clauses about using your