AI Tool Decisions · Guide
Check an AI Tool’s Data Controls Before Uploading Work Files
Run a short data-path review before a useful demo turns confidential work into an unapproved experiment.
Before uploading work files, classify the data and verify the exact account’s current terms for retention, training use, access, deletion, region, and connectors. If a required fact is unclear, use sanitized material or stop until the accountable owner confirms the path.
Classify the file
Look for personal data, customer material, contracts, financial details, credentials, source code, unpublished strategy, and third-party licensed content. A familiar file name does not make the contents low risk. Mark prohibited material and identify who can authorize the rest.
Verify the exact service and plan
Read current official documentation for the account type being used. Check retention, model-training use, human access, admin controls, region, deletion, exports, and subprocessors where relevant. Do not copy an enterprise promise onto a consumer account or assume an API and chat interface share the same controls.
Map connectors and derived copies
Uploads may be indexed, cached, logged, shared through links, copied into outputs, or passed to connected tools. Draw the path from local file to final result. Disable unnecessary connectors and use the least-privilege folder or account. Keep secrets out of prompts even when the rest of the document is approved.
Minimize before upload
Use a synthetic or redacted sample when it can answer the question. Remove hidden sheets, comments, revision history, metadata, and irrelevant pages. Confirm that redaction is real rather than a visual overlay. Give the tool only the excerpt needed for the task and set an expiry for test data where the service supports it.
Record the permitted use
Write the approved data class, account, purpose, owner, review date, and stop condition. If the documentation does not answer a required question, mark it unresolved and do not improvise consent. A narrow “public documents only” pilot can still produce useful evidence while procurement, privacy, or security owners review a broader path.
Check access and sharing behavior
Confirm who can view prompts, uploaded files, generated projects, shared links, and administrator logs. Test with a non-owner account rather than assuming a private label is sufficient. Review whether links expire, whether projects inherit workspace permissions, and whether a user can accidentally publish a conversation. If the tool offers connectors, authorize only the smallest folder or repository needed and remove access after the test.
Plan deletion and offboarding
Ask how a user deletes a file, project, account, and derived index, and what retention remains in backups or abuse-monitoring systems according to current documentation. Record who performs deletion when an employee leaves or a pilot ends. Export the approved result before deletion only when policy requires it. A delete button that removes an item from the interface may not describe every retained copy, so preserve the official explanation and escalate gaps.
Use a pre-upload decision card
Put five fields beside the tool: data class, permitted account, allowed purpose, prohibited material, and owner. Add links to the current control documentation and the last review date. The card should let a colleague decide in under a minute whether to proceed, sanitize, or stop. It is not a substitute for provider review; it is the operational summary of that review. Update it when the plan or feature changes.
Example: review a client presentation
A presentation contains public market facts, draft strategy, client names, speaker notes, and hidden comments. The public facts alone could be used in an approved research prompt, but the full file is not permitted. The editor creates a new document containing only the public excerpts and a synthetic company label, then verifies that comments and metadata are absent. The decision card records the approved enterprise account and purpose. The generated outline is reviewed manually and returned to the controlled project folder; the sanitized upload is deleted according to the documented process. If the service cannot explain retention for that account, the team stops before upload.
Repeat the check when the feature changes
A data decision belongs to the exact feature and account reviewed. Reopen it when a provider adds persistent memory, file indexing, shared projects, browser access, third-party actions, or a different model route. Also reopen it when the team introduces a more sensitive file class. Compare the new data path with the approved card and update only after the accountable owner accepts the change. A familiar product name is not evidence that a new capability has the same retention, access, or deletion behavior.
Give colleagues a safe alternative
A prohibition works better when it includes a useful path. Offer a synthetic template, an approved public dataset, a redaction procedure, or a reviewed account for the permitted task. Explain where confidential files should remain and who can answer an unresolved question. Do not encourage people to paste “just a small excerpt” into an unapproved service. The alternative should reduce the pressure to bypass the rule while the team completes a broader review.
Sources and update note
Follow the linked official source before a product, price, plan, or policy decision.