Building With AI
How to Connect AI to Your Business Data Without Leaking It
What actually happens to data you send an AI provider, which settings matter, and the architecture that keeps sensitive information out of a model entirely.
· 7 min read · Flowmatix
The short answer
Business data sent to a major AI provider through a paid API is generally not used for training and is retained only briefly for abuse monitoring, but consumer chat products often differ. The safest architecture keeps sensitive fields out of the request entirely by redacting before sending and re-inserting the values after the response returns.
The fear that stops most AI projects is reasonable: nobody wants to be the business that pasted customer records into something and found them quoted back to a stranger. The risk is real but specific, and the mitigations are well understood.
What actually happens to data you send
The critical distinction is between consumer chat products and paid API access. They frequently have different data policies from the same company, and confusing the two is where most avoidable exposure happens.
| Consumer chat product | Paid API / business tier | |
|---|---|---|
| Used to train models | Sometimes, unless disabled | Generally not, by default |
| Retention | Often indefinite | Typically short, for abuse monitoring |
| Staff access | Possible under review policies | Restricted, usually contractual |
| Data processing agreement | Rarely | Normally available |
The architecture that removes the question
The strongest control is not a policy — it is not sending the sensitive data at all. Most business tasks need the shape of a record, not the identity behind it.
- 1Before the request leaves your system, replace sensitive values with placeholders. Names become CUSTOMER_1, account numbers become ACCOUNT_1, and a mapping is held in your own memory.
- 2Send the redacted text to the model. It can classify, summarise, extract structure and draft a reply perfectly well without knowing who anyone is.
- 3When the response returns, substitute the real values back in before it reaches a person.
The provider never receives the identifying data. This handles the majority of realistic use cases — classification, extraction, summarisation, drafting — and it converts a policy question into an engineering one, which is far easier to reason about.
The controls worth insisting on
- Use business or enterprise API tiers, never a consumer account, for anything touching customer data.
- Redact before sending wherever the task does not genuinely need the identity.
- Enforce access control at retrieval — a user must not receive an answer assembled from documents they are not permitted to read.
- Log every request and response for a fixed window, so you can answer questions about what was sent.
- Set a data retention period deliberately rather than inheriting a default.
- Keep a human approval step on anything that leaves the building — emails to customers, filings, payments.
The Canadian angle
Canadian businesses handling personal information have obligations under PIPEDA, including accountability for information transferred to a third party for processing and transparency about it. Provincial legislation adds requirements in some sectors, and Quebec's regime is notably stricter. Nothing here makes AI unusable — it makes the redaction architecture above considerably easier to justify, because information you never sent is information you do not have to account for.
This is a summary, not legal advice. If you handle health information, financial records, or data about children, get advice specific to your situation before building.
The threat people forget
External leakage gets the attention, but the more common incident is internal: a retrieval system indexed a folder nobody realised contained salary data, and now anyone who asks the right question gets an answer. Access control at retrieval time is not optional, and it must mirror your existing permissions rather than reinventing them.
Frequently asked questions
Is it safe to use AI with customer data?
It can be, with the right tier and architecture. Use business or enterprise API access rather than consumer products, redact identifying fields before sending where the task does not need them, enforce access control at retrieval, and keep a human approving anything that reaches a customer.
Do AI companies train on data sent through their API?
Major providers generally do not train on paid API traffic by default, while consumer chat products often behave differently. Policies change and vary by vendor and region, so confirm the current terms for the specific product and tier, and get the commitment contractually.
How do I stop sensitive data reaching an AI model at all?
Redact before sending. Replace names, account numbers and identifiers with placeholders, send the redacted text, then substitute the real values back into the response inside your own system. Classification, extraction, summarisation and drafting all work fine on redacted input.