Is it safe to put company data into AI? What a company brain stores and who can see it
Using AI with company data is safe when you pick business-tier tools, keep permissions intact and decide in writing what never goes in. Here's how we set that up when we build a company brain.
Using AI with company data is safe when three things are true: the tool runs on a business plan that doesn't train on your inputs, it only shows each person what they could already open, and your team has a written list of what never goes in. The usual failure is the gap between those rules and what people paste into personal accounts.
Privacy is one of the first objections operators raise about a company brain, and it's a fair one. You're asking a system to read your meetings, your customer threads and your decisions. The answers people find online mostly come from security vendors and law firms. Here is how it looks from the side that builds these systems.
What a company brain stores
A company brain stores a searchable record of the work: meeting transcripts and notes, customer conversations from email and support tools, Slack threads, documents, and the decisions made along the way with the reasoning written down. Agents on top read that record to draft follow-ups, write meeting briefs and build the weekly scoreboard.
The list of sources is set at the start of every build. A typical one covers the calendar, Slack, the inbox for sales and support, the CRM and the shared drive. Anything off the list stays out, and the brain can't wander into a tool nobody connected. In our builds, the client grants access tool by tool, and we only see what they give us access to.
Equally important is what a brain shouldn't hold. Credentials, raw card numbers, payroll detail at the individual level and medical records have no business in a searchable memory. We leave those sources unconnected or filter them at the feed, since a system can only expose what it has ingested.
Where your data lives
In the builds we do, everything lives in plain files on machines the client controls. There's no vendor database in the middle holding a copy of your company. If you end the relationship, the files stay where they are, and you own all of it.
The part that does leave your machines is the text sent to a model when someone asks a question or an agent drafts something. That request goes to a model provider such as OpenAI or Anthropic over their business API, and what happens next is governed by their terms. That's the piece worth reading closely, and it's where the training question lives.
Will your data train the models?
On business plans, the major vendors say no by default, in writing, and you should read the page yourself before you sign anything. Here's what each one says today:
| Vendor | What their own policy page says about business data | Source |
|---|---|---|
| OpenAI | ChatGPT Business, Enterprise and the API Platform: "We do not train our models on your data by default." API inputs and outputs may be retained up to 30 days to run the service and identify abuse, with exceptions for some endpoints, and zero data retention is available on eligible endpoints for qualifying use cases. | OpenAI enterprise privacy |
| Anthropic | Commercial products, including Claude for Work and the Anthropic API: inputs and outputs aren't used for training by default. | Anthropic Privacy Center |
| Microsoft | Copilot: prompts, responses and data accessed through Microsoft Graph "aren't used to train foundation LLMs." | Microsoft Learn: Copilot privacy |
| Gemini in Workspace doesn't use your prompts or Workspace content to train generative AI models without your permission. | Google Workspace Gemini privacy hub |
The risk sits on the consumer side. OpenAI's help center says that on Free, Plus and Pro it may use your content to train its models unless you turn off "Improve the model for everyone," and that a thumbs-up or thumbs-down can send the whole conversation into training even after you opt out (OpenAI help center). Anthropic's consumer page says chats on its individual Claude plans are used for training if the user allows it or the chat is flagged for safety review (Anthropic Privacy Center).
So the practical risk in most companies is an employee pasting a customer contract into a personal ChatGPT account on a Sunday night. A business plan with admin controls closes that gap, and the vendors also let admins turn off the feedback button: Anthropic's page describes a Rate chats setting owners can disable, and OpenAI's help center describes a matching workspace setting.
Permission-aware retrieval: who can see what
A safe company brain answers each person with only what they could already open in the original tool. If the board deck sits in a folder three people can see, a question from anyone else shouldn't surface it. Builders call this permission-aware retrieval.
The big vendors work the same way. Microsoft's Copilot documentation says it "only surfaces organizational data to which individual users have at least view permissions." Google's privacy hub says Gemini won't access Workspace content you don't have permission to access. OpenAI's enterprise privacy page says apps in ChatGPT respect your organization's existing permissions and each user authenticates with a connected app before using it.
Microsoft's own page tells admins to use the permission models in SharePoint and similar tools so the right people have the right access. In practice, a search layer surfaces whatever sharing mistakes already exist. A file shared with "anyone at the company" three years ago becomes findable the day a search layer arrives. Before we connect a source, we look at how it's shared, and we'd tell you to do the same with any tool.
In our builds, permissions get decided at the feed and again at the answer. Private Slack channels, HR folders and finance drives either stay unconnected or get tagged so only the right people can ask about them. When someone asks from Slack, the answer comes back with its source, so anyone can check where a claim came from and who could already see it.
Write an AI acceptable use policy before you buy anything
An AI acceptable use policy is a one-page document that names the approved AI tools, the data that can go into them and the data that never can. It's the cheapest control you have, and it covers the risk no vendor setting can: what people choose to paste.
Keep it short enough that people read it. Ours covers:
- Approved tools. Name them, on business plans, with company logins. Personal and free accounts are off limits for company data.
- Never in any AI tool. Passwords, API keys and bank logins; full card and account numbers; government ID numbers; anything a contract or NDA says can't go to a third party.
- Only in approved tools, with care. Customer names and conversations, financials, pricing and strategy. These are fine on a business plan with permissions intact, and they're the material a brain exists to read.
- Regulated data. Health, legal and student records need a plan built for them. OpenAI lists ChatGPT for Healthcare as built to support HIPAA compliance, for example. Check before connecting.
- Human sign-off. A person approves anything that moves money, goes to a regulator or makes a commitment to a customer.
- Who to ask. One named owner for questions and new tool requests.
On financial data specifically: reading the books, summarizing a month and flagging an invoice that's late are reasonable jobs for an agent with read access. Paying, filing and advising stay with a human, because a model can misread a figure and sound sure of it. We say the same about agents generally: they're weak at judgment calls and anything without a source.
What to ask any vendor or builder
Before you connect a tool to company data, get written answers to five questions:
- Which plan are we on, and does its policy page say our data isn't used for training by default?
- How long are prompts and outputs kept, and can we shorten that?
- Does it inherit permissions from the source tools, or does it have its own access model?
- Where does the data sit when nobody is asking a question, and who holds the keys?
- If we leave, what do we keep, and in what format?
For a company brain we build, the answers are a business API with no training by default, permissions inherited from each source, plain files on your machines, and you keep everything because you already own it. The cost guide covers what a build costs if you're weighing this against an off-the-shelf seat.
What this looks like in practice
Rye Valley is the holding company that runs our own install. Its brain covers meetings, customer conversations and decisions, and the company removed $425,000 in annual expenses within the first month after install, with shipping velocity up 10x. Its decision log is public at michaelhouck.co/decisions, and the private material behind it stays on machines the company controls.
The privacy work also makes the brain more useful. When the feed list is deliberate and permissions are clean, people trust the answers enough to stop asking each other the same question every week, which is where the hours come back. The tribal knowledge piece shows what that's worth when someone leaves.
If you want to see which workflows would be worth connecting first, and what they'd save, the free Leverage Audit estimates your top 3 in about 2 minutes, with the hours and dollars shown. Our builds start at $15,000 with a fixed quote and a written definition of done before anything is signed, and the scope document names every source the brain will read, so the privacy question gets answered on paper before any data moves.
Questions people ask
Is my data safe with AI?
It depends mostly on the plan and the setup. Business and API tiers from OpenAI, Anthropic, Microsoft and Google say in their own policy pages that they don't train on your business data by default, while consumer plans can. Add permission-aware retrieval and a short list of data that never goes in, and the remaining risk looks like any other cloud software you already trust with email and files.
Can AI be trusted with financial data?
AI can safely read and summarize financial data on a business-tier plan with access limited to the people who already see the books. Keep a human on anything that moves money, files with a regulator or gives tax advice, because a model can misread a number with full confidence. Bank credentials, full card numbers and account logins should never be pasted into a chat.
What should you not put into AI?
Passwords, API keys and bank logins; full card or account numbers; health records and government ID numbers unless you're on a plan built for them; anything under an NDA or contract that forbids third-party processing; and anything at all on a personal or free account. Everything else should go through a company-approved tool with permissions intact.
Will our data be used to train AI models?
On business plans, by default, no, per OpenAI's enterprise privacy page, Anthropic's commercial terms page, Microsoft's Copilot privacy documentation and Google's Workspace Gemini privacy hub. Watch two exceptions: consumer accounts, where training can be on by default, and feedback buttons, which on some consumer plans send the whole conversation for training.
Does a company brain respect who can see what?
It should, and you should ask any builder to show you how. In the builds we do, the brain reads each source with the access the client grants, and answers are filtered by what the person asking could already open in the original tool. A brain that ignores permissions turns every private channel into a public one.