Is it safe to use AI tools like Claude or ChatGPT with company data?
It can be, but it depends on the plan, not the brand. The business, enterprise and API tiers of the major AI providers do not train their models on your data by default, while free and personal plans may, depending on settings. The safe pattern is company-managed accounts on a business tier, with clear rules on what may be shared.
- Use company accounts on a business or enterprise plan, not personal logins.
- Know which tier each tool is on and what its data-retention terms are.
- Decide which categories of data never go into any AI tool.
- Give tools the narrowest access to files and systems that the task needs.
Should a company ban AI tools at work?
Usually not. Banning AI tends to create more risk than sanctioning it, because people keep using it anyway on personal accounts and consumer plans — outside the company’s view and on weaker data terms. A sanctioned tool on a business tier, with rules and training, is easier to secure than usage the company cannot see.
Does company data sent through an AI API train the model?
By default, no — the major providers state that data sent through their APIs and business tiers is not used to train their models. Consumer plans are different and often have a setting that controls it. Because terms differ by provider and plan and change over time, confirm the current policy for the exact tier you use.
What security questions should we ask before rolling AI out to a team?
Before rolling out AI, ask where the data goes, who can see it, and what the tool can do on its own. The answers that matter are the provider’s training and retention terms for your plan, whose accounts and API keys are used, what files and systems the tool can reach, and who reviews its output before it acts.
- Is this a business tier, and is training on our data off?
- Are the accounts and API keys owned by the company or by individuals?
- What can the agent read, and what can it change or send?
- Which actions need a human to approve them first?
- Who is accountable when it gets something wrong?
Does an AI workshop cover data privacy and security?
A good one should, early. Rhai teaches a module called Privacy for enterprises in every corporate and regulated room: what the encryption is, why API data does not train the model, how the plan tiers differ, and why banning AI creates more risk than sanctioning it. Rhai’s sessions also run on the client’s own tenant and API keys.
Privacy for enterprises →