Is AI Safe for Company Data? 7-Point SME Checklist

April 2023. Three Samsung engineers pasted proprietary semiconductor source code and internal meeting notes into ChatGPT to debug and summarise. Within 20 days Samsung banned generative AI company-wide. The data was already inside OpenAI’s training pipeline.

February 2024. A British Columbia tribunal ruled Air Canada liable for a chatbot hallucination that promised a bereavement discount the airline never offered. Air Canada argued the bot was a “separate legal entity.” The tribunal disagreed.

Same root cause: AI deployed without a checklist.

I run an eight-person AI agent stack from a Taipei studio. The question I hear most from other founders is some version of “is this safe?” It depends on seven things you can actually check. Here’s the checklist I run before any client data touches any model.

1. Classify what should never touch a general LLM

Sort your data into three tiers before evaluating any vendor.

Tier A: never send to a general LLM, at any service tier. PHI under HIPAA. Card data under PCI-DSS. Attorney-client privileged material. Trade secrets that would materially damage the business if leaked (process files, unreleased financials, M&A drafts). Anything an NDA specifically forbids disclosing to third parties.

Tier B: send only under a signed DPA with zero-retention. PII of EU residents (GDPR), California residents (CCPA), or any customer whose contract requires it. Salary data. Client lists. Vendor pricing. Draft contracts.

Tier C: safe under standard enterprise terms. Published marketing copy. Public financial reports. Generic product descriptions. Agendas with no names, numbers, or strategy.

Most SMEs skip this step and treat everything as Tier C. That’s the Samsung mistake. If your engineers can paste production code into a free chatbot without a policy stopping them, you already have the problem. You just haven’t been caught yet.

Write it down. One page. Everyone who touches AI signs it.

2. Know which service tier you’re actually on

SMEs go wrong here because the vendors deliberately blur the line.

Free (ChatGPT Free, Claude Free, Gemini Free). Inputs may train future models. Retention indefinite by default. No DPA. Personal use only.

Team / Plus (ChatGPT Team, Claude Pro, Gemini Advanced). OpenAI and Anthropic state Team/Pro data isn’t used for training by default. Retention typically 30 days. Usable for Tier B if your workflow discipline is real, but the DPA is a template you accept, not one you negotiate.

Enterprise (ChatGPT Enterprise, Claude for Enterprise, Gemini Enterprise). Zero retention on request, SOC 2 Type II audited, negotiable DPA, SSO, audit logs. Minimum for Tier B at scale. Around $60/user/month with a real contract.

On-prem or private cloud (Llama, Mistral, private-hosted Claude on AWS Bedrock, Azure OpenAI in your own tenant). Data never leaves your infrastructure. Required for Tier A. Real engineering commitment, not sign-up-and-go.

The mistake I see most: a founder pays for ChatGPT Plus, assumes they now have “enterprise-grade AI,” and lets the whole team paste client data. Plus is a consumer product with better limits. Read the terms of service, not the marketing page.

3. Draw a prompt boundary

Even on enterprise terms, you need a policy on what actually enters a prompt.

My studio rule: strip identifiers before sending. A client meeting transcript becomes “Client X, industry Y, budget range Z.” A financial statement becomes “segment A grew 12%, segment B declined 4%.” An email to a real person becomes a template with placeholders.

Same principle as logging. You never want raw credit card numbers in a log file, even on your own server. Prompts get cached, logged for debugging, exposed in outages, reviewed by your own audit trail. Shrink the blast radius before anything leaves your machine.

If your workflow can’t function without raw sensitive data in the prompt, you need on-prem. That’s a signal, not a workaround.

4. Build an audit trail you can actually produce

Six months from now, a client asks: “Did you send our contract draft to any third-party system?” Can you answer?

For most SMEs, no. AI usage happens inside a browser tab that leaves no trace. Fine until it isn’t.

Minimum audit trail: route every AI call touching Tier B or higher through a logged API. Consumer chat interfaces don’t count. Enterprise ChatGPT and Claude provide admin-level audit logs. If you build via API, log every request and response to your own storage with 90-day retention.

I keep a lightweight log of every agent call: timestamp, agent name, input hash, output hash, model, cost. Not the full prompt, that defeats the point. Enough to reconstruct the shape if someone asks. The Solo Stack Method treats every layer this way. Observability is the difference between a system and a hope.

5. Get a real DPA

Handle any EU customer data and GDPR requires a DPA between you (the controller) and any processor. Your AI vendor is a processor. No DPA, no lawful basis.

OpenAI, Anthropic, Google, and Microsoft all publish DPA templates for enterprise products. Team/Pro tiers embed the DPA in their terms of service. Free tiers have none, which means you can’t lawfully process EU personal data through them.

Four things to check:

• Data residency. EU data processed in the US needs extra safeguards (Standard Contractual Clauses at minimum).
• Sub-processors. OpenAI uses Microsoft Azure. Anthropic uses AWS and Google Cloud. Your DPA covers them too.
• Breach notification. GDPR requires you to notify authorities within 72 hours of becoming aware. If your vendor takes 30 days, you’re already non-compliant.
• Deletion rights. On termination, get destruction in writing, with a certificate-of-destruction option.

A vendor who can’t answer these in a week isn’t enterprise-ready, whatever the sales deck says.

6. Plan how you leave

Every AI vendor relationship ends. The question is whether you built yourself a lock-in trap.

• Prompts version-controlled in your own repo, or trapped in the vendor’s UI?
• Fine-tuned models and custom instructions exportable, or vendor-locked?
• Agent workflows in a portable format (JSON, YAML), or a vendor-specific visual builder?
• Migrate off vendor X tomorrow: how many hours of rework?

Every agent I run lives in a Git repo. Prompts are markdown files. Model choice is a config parameter. If Anthropic raises prices 3x tomorrow, I can swap providers in an afternoon. Small upfront discipline, large future pain avoided.

7. Vet third-party integrations

The most common leak in an SME AI stack isn’t the LLM vendor. It’s the automation layer between your systems and the LLM.

Build a Zapier flow that reads Gmail, extracts data via ChatGPT, writes to a Google Sheet, and Zapier sees every email in transit. Their servers process it, their logs contain it, their sub-processors have access. Same for Make.com, n8n cloud, any other iPaaS.

Fine for Tier C. Compliance disaster for Tier B without a DPA.

Check the automation vendor’s DPA the same way. Zapier has one. Make has one. Both let you configure retention. Neither is safe for Tier A without additional controls.

For Tier B, self-host (n8n on your own server) or pick a vendor with explicit healthcare or financial certifications.

Closing

The checklist exists to make risk legible so you can decide clearly.

Most SMEs I talk to land in the same middle ground: enterprise tier for the LLM, self-hosted automation for anything sensitive, a one-page data classification everyone signs, a lightweight audit log they can produce on request. That covers 90% of the risk at maybe 5% of the cost of a full compliance program.

Want a second pair of eyes on your setup? Book a 15-minute call: see framework & ROI calculator. I’ll walk your stack against these seven items and flag the gaps.

For a Chinese-language version adapted for Taiwan SMEs, read the 中文版. For the broader framework, start with the Solo Stack Method.

FAQ

Do I need a DPA if I only use free ChatGPT for internal brainstorming? If it touches personal data of an EU resident, yes, and free ChatGPT doesn’t provide one. For genuinely generic prompts (“write me a metaphor about compound interest”), no DPA needed. The line is the data, not the tool.

Is Claude safer than ChatGPT for company data? Neither is intrinsically safer. Both offer enterprise tiers with zero-retention and SOC 2 Type II. Both offer free tiers unsafe for Tier B. What matters is your tier and your DPA, not the brand.

What about running AI locally with Ollama or LM Studio? Local models solve vendor trust entirely: nothing leaves your machine. The tradeoff is capability. An 8B parameter local model is meaningfully weaker than GPT-4 or Claude Opus for most reasoning. Right for Tier A where that tradeoff pays off. Otherwise, enterprise cloud usually wins.

Can I get sued if my AI agent gives a customer wrong information? Yes, and Air Canada already lost that case. Deploy an AI on your site or in your service and you own what it says. That means output validation, disclaimers where appropriate, and human review for customer-facing communication with legal or financial stakes. Check whether your professional indemnity policy covers AI-generated advice.