Before you upload a client document
Six questions to ask about any AI tool before a client’s file goes into it, and a simple way to sort your own documents into green, amber and red.
Uploading a file to an AI tool feels as routine as attaching it to an email, but more is going on. The file travels to another company’s servers, stays there for some time, may be seen by staff or by automated systems, and is governed by terms many of us accepted without reading.
PlexorMedia’s partners include an information security and privacy auditor, so we look at AI tools the way an auditor looks at any supplier that will hold someone else’s information. Answering an auditor’s questions takes no technical knowledge, and most of the answers are on the provider’s own website, for anyone patient with the fine print.
Six questions for any AI tool
1. Where does the file go?
Start with the privacy policy and, if there is one, the provider’s security or trust page. You want to know which company receives the data, in which countries it is processed and stored, and which other companies (its subprocessors) handle it along the way. If a client contract or a law limits where the information may go, this tells you whether the tool fits.
2. Is it used to train the provider’s models?
The answer varies by plan and changes over time. On many consumer plans, what you type and upload can be used to train the provider’s models unless you switch that off. Business plans usually come with a commitment not to. Find the switch itself, often in the privacy settings, and check whether turning it off covers past conversations or only new ones. Read the terms on feedback too: rating an answer can fall under different rules, even with training switched off.
3. Who at the provider can see it?
Even when your data is not used for training, some staff may be able to open it, for instance to investigate possible misuse or to respond to legal process such as a court order. A well-run provider explains when this can happen and whether each access is logged. If all you find is a line about how seriously the company takes security, keep looking, or ask.
4. How long is it kept?
Deleting a conversation from your screen may not remove it from the provider’s systems right away, since many services keep copies for a set period. Look for an actual number of days, and for what happens to content flagged by safety systems, which can be kept longer.
5. Which plan are you on?
Free and individual plans are usually governed by consumer terms. Business plans, often sold as team or enterprise plans, tend to come with commercial terms and firmer commitments on training and retention. Some paid individual plans are still consumer plans, so a monthly fee doesn’t by itself make yours a business plan.
6. Is there a data processing agreement?
For professional work, this is the document that matters most. A data processing agreement (DPA) sets out what the provider may do with the personal data you give it. Typically it limits use to your instructions, requires confidentiality, commits the provider to report breaches and to delete the data when the service ends, and sets rules for its subprocessors. In the European Union, the GDPR requires one whenever a provider processes personal data on someone else’s behalf (Article 28). Mexico’s data protection law, among others, also covers this relationship, so check what applies to you.
Consumer plans rarely offer a DPA. Business plans often include it in their terms or provide it on request. If you can’t find it, ask the provider’s sales or privacy team.
Then sort your own documents
The other half of the decision is about the file. Before any AI tool sees a document, sort it into green, amber or red. The definitions below are our defaults; your professional rules and your agreements with clients always come first.
- Green: public information, or material with nothing about any client in it, such as a published regulation or your own blank template. Any reputable tool will do.
- Amber: client work that still makes sense once the identifying details are removed, such as a contract with the names and amounts replaced by placeholders like CLIENT A. An unusual set of facts can identify a client as surely as a name, especially in a small town. Use a business plan with training switched off and a data processing agreement in place.
- Red: identifiable and sensitive material, such as medical records, criminal matters, bank details, trade secrets, or anything a client has asked you to keep in-house. Our default is to keep it out of general-purpose AI tools. If there is a strong reason to use one, get the client’s written agreement first, and use only a tool that passed every question above.
When a document sits between two colors, treat it as the redder one. And if a single page in a file is red, the whole file is.
Keep a record
Auditors work from evidence, so write down the answers for each tool, along with the plan you are on and the date you checked. Look again every few months, or whenever the provider announces new terms. If a client ever asks how you use AI with their files, the answer will already be on paper.
If you would like a second pair of eyes on the tools your office already uses, that is part of our consulting work.
This page is educational and is not legal advice.