[{"data":1,"prerenderedAt":159},["ShallowReactive",2],{"publication:en:P198":3},{"meta":4,"copy":17,"relatedArticles":119,"terms":151,"term":152,"resourceParent":153,"glossaryParent":156},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P198","\u002Fblog\u002Fcorporate-ai-security-data-leak-prevention","article","corporate ai security dlp llm leaks","Corporate AI security: controlling data shared with AI tools","Corporate AI data security: training, retention and access","Check how ChatGPT, Claude and Microsoft Copilot handle business data, and define what staff can share with each tool.",[13,14],"\u002Fservices\u002Fintegrations-api-security","\u002Fblog\u002Fai-cyber-threats-access-hygiene-employee-awareness","2026-11-07","2026-11-06",{"intro":18,"sections":19,"sources":71,"faq":90,"checklistTitle":100,"checklist":101,"links":107,"cta":114},"Before approving an AI tool, check three things: whether the provider uses requests for model training, how long it stores chats and files, and who can access them. Record those answers for the exact product and plan your team uses.",[20,25,30,35,61],{"title":21,"paragraphs":22},"Training, chat history and data retention",[23,24],"OpenAI does not train on ChatGPT Business, Enterprise or API data by default. Chat history and file retention follow separate rules. For the OpenAI API, Zero Data Retention (ZDR) requires approval and applies subject to feature and endpoint limits. Standard API abuse-monitoring logs may retain content for up to 30 days, with exceptions.","Anthropic publishes separate retention rules for its commercial chat products and API. For Microsoft 365 Copilot, Microsoft says it does not train foundation models on prompts or responses. Interaction data can still be stored under the organization’s Microsoft 365 policies. Verify the terms and settings for your account.",{"title":26,"paragraphs":27},"Data Exposure Vectors in Everyday LLM Usage",[28,29],"Three vectors dominate risk: pasting confidential records into prompts, uploading files with embedded metadata, and indirect prompt injection. Developers occasionally upload stack traces containing active database credentials, while sales reps upload lead spreadsheets with phone numbers and identity records.","Indirect prompt injection occurs when an agent evaluates external emails or web pages. Embedded adversarial instructions cause the model to read internal documentation and transmit extracts to an external attacker system.",{"title":31,"paragraphs":32},"Where to apply data sharing rules",[33,34],"Give employees approved work accounts and document the data they may use. Check what controls your plan actually supports, including access management and connected apps.","Data loss prevention (DLP) can flag recognizable patterns such as API keys and payment card numbers where the product or gateway supports inspection. Test file uploads and connected apps separately. Pattern matching can miss sensitive information.",{"title":36,"paragraphs":37,"table":38},"What to verify before sharing company data",[],{"caption":39,"headers":40,"rows":44},"Training and retention by product",[41,42,43],"Product","Model training","History and retention",[45,49,53,57],[46,47,48],"ChatGPT Business \u002F Enterprise","Business data excluded by default","Check workspace history and available retention settings",[50,51,52],"OpenAI API","API data excluded by default","Check monitoring logs, endpoint storage and ZDR eligibility",[54,55,56],"Claude commercial products","Check commercial terms and settings","Check the chat product and API separately",[58,59,60],"Microsoft 365 Copilot","Prompts and responses excluded from foundation-model training","Check interaction history and Microsoft 365 retention policies",{"title":62,"paragraphs":63,"steps":65},"Implementation Procedure for Secure AI Adoption",[64],"Practical setup sequence for corporate environments and employee devices.",[66,67,68,69,70],"List the AI tools and accounts each team uses.","Verify training, retention, file handling and connector terms for each approved product and plan.","Define which classes of data staff can share. Keep credentials and access tokens out of prompts and attachments.","Test the available sharing controls with synthetic data.","Assign an owner to review settings, contracts and connected apps when they change.",[72,75,78,81,84,87],{"label":73,"url":74},"NIST AI Risk Management Framework (AI RMF 1.0)","https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework",{"label":76,"url":77},"OWASP Top 10 for Large Language Model Applications","https:\u002F\u002Fowasp.org\u002Fwww-project-top-10-for-large-language-model-applications\u002F",{"label":79,"url":80},"OpenAI Business Privacy and Enterprise Data Controls","https:\u002F\u002Fopenai.com\u002Fenterprise-privacy\u002F",{"label":82,"url":83},"OpenAI API: data retention controls","https:\u002F\u002Fdevelopers.openai.com\u002Fapi\u002Fdocs\u002Fguides\u002Fyour-data#data-retention-controls-for-abuse-monitoring",{"label":85,"url":86},"Anthropic: commercial data retention","https:\u002F\u002Fprivacy.anthropic.com\u002Fen\u002Farticles\u002F7996866-how-long-do-you-store-my-organization-s-data",{"label":88,"url":89},"Microsoft 365 Copilot: data, privacy and security","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fcopilot\u002Fplan\u002Fmicrosoft-365-copilot-privacy",[91,94,97],{"question":92,"answer":93},"Does turning off model training delete my ChatGPT history?","Training controls and chat deletion are separate settings. Check the history and retention rules for your account, including exceptions and what happens to uploaded files.",{"question":95,"answer":96},"Do pre-commit hooks stop secrets from reaching a coding assistant?","A pre-commit hook runs when you commit. The assistant may already have read the file. Keep secrets outside the assistant’s accessible context and test the tool’s exclusion and sharing settings.",{"question":98,"answer":99},"What if someone already uploaded a customer list?","Record what was shared and where, restrict access to the conversation and follow the provider’s deletion process. Revoke any exposed credentials. Have the person responsible for privacy assess notification duties.","AI Acceptable Use Policy Checklist",[102,103,104,105,106],"Work accounts and approved use cases are documented.","Training and retention settings have been checked separately.","File uploads and connectors have defined permissions.","Gateway logs record only what the team needs.","Staff know who to contact after an accidental disclosure.",[108,111],{"path":109,"label":110},"\u002Fblog\u002Femployee-ai-data-policy","Employee AI data policy for a small business",{"path":112,"label":113},"\u002Fblog\u002Fai-agent-permissions","AI agent permissions for business: control tools, data and actions",{"title":115,"description":116,"button":117,"type":118},"Review how your team shares data with AI tools","We can review account settings, connected apps and where requests and logs are stored.","Request a technical review","check",[120,129,137,143],{"id":121,"path":122,"title":123,"description":124,"category":125,"artwork":126,"order":127,"publishedOn":128},"privacy-regulation","\u002Fblog\u002Fcyber-regulation-privacy-compliance-website-checklist","Website Privacy Checklist for a Technical Review","A technical website privacy review maps collected data, recipients, access rights, retention and deletion. First have an adviser determine the requirements that apply to your organization, then compare settings and test results with those requirements. The resulting evidence supports a wider assessment; it is not a legal compliance certificate.","governance","plan-plus",100,"2026-05-05",{"id":130,"path":131,"title":132,"description":133,"category":125,"artwork":134,"order":135,"publishedOn":136},"P091","\u002Fblog\u002Fsmall-business-asset-inventory","Digital asset inventory for small business: owners and dependencies","Map domains, websites, email, hosting, integrations and recovery owners. Build a useful inventory without storing passwords or losing business dependencies.","servers",92,"2026-09-04",{"id":138,"path":109,"title":110,"description":139,"category":125,"artwork":140,"order":141,"publishedOn":142},"P088","Build an employee AI data policy around approved tasks, accounts, information and connectors. Use synthetic examples and clear exception and reporting routes.","access",84,"2026-08-21",{"id":144,"path":145,"title":146,"description":147,"category":125,"artwork":148,"order":149,"publishedOn":150},"P089","\u002Fblog\u002Fprompt-injection-business","Prompt injection risks for business: separate content from authority","Understand prompt injection in business AI workflows. Map untrusted content, connected data and action controls without relying on prompts alone.","security",76,"2026-08-07",[],null,{"path":154,"label":155},"\u002Fresources","Website security resources and templates",{"path":157,"label":158},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134059583]