What to Check Before Trusting an AI Tool With Your Private Data
Every AI tool asks for the same thing: your text. Sometimes your code, your emails, your customer list, or write access to your server. The pitch is always convenience, and the cost is rarely spelled out on the landing page.
Most advice on trusting an AI tool with sensitive material stops at “read the privacy policy”, which is useless because nobody does and because the answers you need are usually not in there. Here are five things worth checking instead, roughly in order of how often they cause problems.
Find out whether your input trains the model
This is the first question and the easiest to answer, because providers are now fairly explicit about it. What varies is the default.
The pattern across the industry is that consumer and free tiers are more likely to use your conversations for training, while business, team and API tiers usually do not. That difference matters more than it sounds. Pasting a client’s contract into a free chat interface is a different act from sending it through a paid API, even when the same model sits behind both.
Look for a setting rather than a promise. A provider that lets you turn training off in your account settings has built the plumbing for it. One that only assures you in prose that your data is “safe and secure” has told you nothing testable.
Also check retention separately from training. A tool may not train on your input and still keep it on their servers for months for abuse monitoring. Those are two different questions and they have two different answers.
Check what the tool actually is
A large share of products marketed as AI tools are thin layers over someone else’s API. That is not inherently bad, but it changes who sees your data.
When you paste text into a standalone AI writing app, it usually travels to that company’s server first, and then out to whichever model provider they use. Two companies now have your text instead of one, and the smaller of the two is the one you know least about. The model provider probably publishes a security page and undergoes audits. The four-person startup wrapping it may be logging every prompt to a database to debug their product, and never mention it anywhere.
The tell is usually in the pricing. If a tool charges a flat monthly fee but offers unlimited generation with frontier-quality output, someone is absorbing an API bill on your behalf, and it is worth understanding how that business works before feeding it anything sensitive. This is worth working out early, ideally while you are still deciding which tool to pick rather than after you have moved your work into it.
You can often find the answer in their documentation or their terms, under subprocessors. A company that lists its subprocessors is telling you exactly who else touches your data. A company with no such list either has not thought about it or would rather you did not ask.
Read the permissions, not the marketing
This is where the real damage happens, and it has nothing to do with what the model does with your text.
An AI browser extension that “reads the page to help you write” can read every page you visit, including your bank and your webmail. An AI plugin for your CMS with content generation features needs write access to your site, which means it can also modify or delete what is already there. A connector that summarises your inbox has your entire inbox.
The question to ask is not “do I trust this company with my prompts” but “what could this thing do if it were compromised tomorrow”. Those are very different risk profiles. The prompt question is about a company’s intentions. The permission question is about anyone who manages to get in, including people the company never invited.
Third-party plugins with write access are one of the most common ways websites get compromised, and the plugin does not have to be malicious for that to happen. Abandoned code with a known vulnerability does the job just as well as bad intent, and it is far more common. If you run WordPress, the project’s own hardening guide covers the basics worth having in place before you add anything with write access.
Before installing anything with broad permissions, check three things: when it was last updated, whether the developer maintains other software actively, and whether you can revoke its access easily without breaking your setup. A tool you can switch off in one click is a tool you can survive.
Ask what happens when the company disappears
Most AI startups will not exist in five years. They will shut down, get acquired, or pivot into something unrecognisable, and your data goes with them in all three cases.
In an acquisition, user data is part of what is being bought. The privacy policy you agreed to can be replaced by the acquirer’s, usually with an email notification you will not read. In a shutdown, the best case is that they delete everything and tell you in advance. The realistic case is a database sitting in a cloud account nobody is paying attention to any more.
The practical protection is knowing how to get your data out and how to make them delete it, before you need either. If a tool has no export function and no account deletion, you are not a customer with an exit. You are a deposit.
Sort your data before you paste it
The most useful habit here is not technical. It is deciding in advance what categories of information you will never put into a tool you do not control, and then not thinking about it case by case when you are in a hurry.
A workable split for most people:
- Never: credentials, API keys, customer personal data, medical or financial records belonging to someone else, and anything under a confidentiality agreement
- Only in tools you have actually vetted: proprietary source code, unpublished business plans, internal documents, anything about an identifiable individual
- Freely: content you are about to publish anyway, public documentation, generic questions with the specifics stripped out
That last category covers more than people expect. Most requests can be rewritten without the sensitive parts. You rarely need to paste the real customer name to get help writing the email.
Where to start before trusting an AI tool
Open the settings page of the AI tool you use most often and look for two things: whether your input is used for training, and whether there is a way to delete your history. That takes about two minutes and will tell you more about how seriously the company takes this than any amount of marketing copy.
Then look at your installed browser extensions and plugins, and remove the ones you stopped using. Unused software with standing permissions is the cheapest risk you will ever eliminate.