D&S-08: The One-Page AI Safety Check

Part 8 of the Data & Security series, the closing one. In Part 7 we listed the questions for vendors. Here is the same discipline turned inward: ten checks, one page, one afternoon.

Everything in this series reduces to a short list. You do not need a security department to run it. You need an honest hour, access to your own account settings, and the willingness to write down what you find.

For each check: yes, no, or not sure. “Not sure” counts as no, and it also tells you exactly where to look first.

The ten checks

1. Company work happens only in company accounts. Our people use business AI accounts we own, not personal ones we cannot see or close.

2. We can point to the sentence. Somewhere in our vendor terms, in writing, it says our data is not used to train the models. Someone here has actually read it.

3. We chose our retention. We know how long our prompts and files are kept, and a person in this company picked that setting on purpose.

4. One named person owns the accounts. They add people, remove people the day they leave, and check the settings twice a year. If the owner is “IT, generally,” the answer is no.

5. The red list exists and fits on one page. What may never be pasted into AI is written in plain words, and the team has seen it: client identifiers, financial records, health and legal matter content.

6. The approved tools are the easiest tools. Using the safe option takes fewer clicks than using the risky one. If not, habits will beat policy every time.

7. For client and regulated data, the paperwork is on file. The signed data agreement and the vendor's current audit report sit in a folder we can produce on a bad day without searching anyone's inbox.

8. We know where the data lives. Which countries, which subprocessors, and we would hear about it if that changed.

9. Our breach clause has a number in it. Hours, not adjectives, for how fast the vendor must tell us when something goes wrong with our data.

10. Once a year, somebody re-reads all of it. Terms change quietly. This list, the settings and the vendor file get one scheduled review a year, with a name and a date attached.

Reading your score

Nine or ten: you are ahead of most of the market, including companies much larger than yours. Keep the yearly review and stop worrying.

Six to eight: the foundation holds. Fix the missing checks in order, top to bottom. Most companies close the gap in a week of small decisions, not a project.

Five or fewer: do not buy anything yet. Start at check 1 today: get the team onto business accounts you own. That single move changes the terms under every paste that happens tomorrow, and it costs less than the cleanup from one client asking the wrong question at the wrong time.

The quiet conclusion of this series

Data insecurity rarely looks like a hacker in a dark room. It looks like normal work, done fast, on accounts nobody chose, under terms nobody read. The fix is equally unglamorous: a handful of decisions, written down, owned by a name, reviewed once a year.

That is good news. Decisions are cheap. It is the undecided companies that pay.

If you run the check and want a second pair of eyes on the answers, that is the work I do: we look at how your operation actually runs, then make the technology fit it, one workflow at a time. Start with the free self-check linked below, or just bring your ten answers to a conversation. Either way, you will leave knowing where you stand, which is the entire point.