Three questions for any AI service
- Is what I write used to train the model? Free tiers often do; paid business tiers usually do not.
- Where is it stored, and for how long? EU storage and short retention are preferable for a European business.
- Who at the provider can read it, and is there a data processing agreement?
What not to paste
National ID numbers, health information, salaries and other sensitive data about employees and customers. Agreements under negotiation. Anything covered by confidentiality. Not because the service will necessarily misuse it, but because you cannot take it back.
Brand data is different
Who you are, how you speak, what you sell: this is information you already share with the world. Giving it to an AI tool is low risk and high value. The line runs at personal data and secrets, not at “company information” as such.
If you make things for clients
Agencies and freelancers who use AI on behalf of clients should say so in the agreement, keep each client's material separate, and use services where access can be revoked. Mixed accounts where every client's data sits in the same chat are the most common mistake.
Five rules that hold
- Use paid or business tiers for work
- No sensitive personal data in prompts
- One client, one workspace
- Check the data processing agreement and storage location once a year
- Know which tools are connected to what, and disconnect what is not used
In Marshi
Marshi keeps every workspace separate, uses AI providers that do not train on your content, and lets you see and revoke every connection. The details are in the privacy policy and on the security page.
