What to Check Before Giving an AI Tool Your Business Data

The moment you paste source code, a contract, or a customer list into an AI tool, you’ve made a data-governance decision — usually without a governance process. Here’s what to check first.

1. Does it train on your data?

This is the single most important question. Check the privacy policy and the specific plan you’re on:

• Consumer free tiers often train on usage by default.
• Paid individual plans vary — some exclude training, some don’t.
• API and enterprise plans usually exclude training by default, but confirm in writing.

Look for explicit language: “does not train on customer data” is not the same as “may use data to improve services.”

2. Retention and deletion

How long is your data kept? Can you delete it, and is deletion actually honored? Some tools retain prompts and outputs indefinitely; others offer zero-retention options (often API/enterprise only). For sensitive work, zero-retention or self-hosting is the safer default.

3. Where does processing happen?

Check data residency — where the data is stored and processed, and whether that fits your compliance obligations (GDPR, HIPAA, SOC 2, and your own contracts).

4. Who can see it?

• Does the vendor allow human review of your data (many do, for safety)?
• Can you opt out?
• Who are the sub-processors?

5. Self-hosting as the escape hatch

For source code, financial data, or regulated customer data, self-hosting or local processing removes the vendor entirely. Open-source tools (Aider, n8n, Stable Diffusion, CrewAI) let you run models on your own infrastructure. The cost is setup and hardware — but for sensitive data, that’s often the right trade.

6. Access control and SSO

For teams, check for SSO/SAML, role-based access, and audit logs. If your org uses enterprise SSO, don’t let employees route sensitive work through consumer accounts that bypass it — that’s how “shadow AI” data leaks happen.

7. Commercial rights on your output

If you’ll use generated output commercially, confirm the terms cover it — and whether the model was trained on licensed or public data (this matters for IP indemnification). Some tools offer indemnification for enterprise customers; most consumer plans don’t.

A 5-minute checklist

1. Does this plan train on my data? (explicitly, in writing)
2. Can I delete my data, and is deletion honored?
3. Where is data processed and stored?
4. Is human review on, and can I opt out?
5. Is there a self-host or local option if needed?
6. Does it support SSO for my team?
7. Do the commercial-use terms cover my use case?

If you can’t answer all seven confidently, the tool isn’t ready for your sensitive data — use a safer option, or get the answers before you paste anything.