Data security when working with AI

WHAT NOT TO SEND TO A CHAT ASSISTANT
- [ ] Passwords, verification codes sent by text, API keys and tokens: never
- [ ] Card numbers, Social Security numbers, driver's license and passport numbers, and other customer documents
- [ ] Customers' personal data: before pasting, swap in "Client A" and "Company B"
- [ ] Contracts and exports that contain other people's data: only after you strip out the extra fields

ACCOUNT SETTINGS
- [ ] In every AI service, you've checked whether your chats are used to train models and picked the option you want
- [ ] For work data, you use a plan whose data terms meet what your clients require
- [ ] Two-factor authentication is on: email, AI services, payments, domain, hosting
- [ ] Passwords live in a password manager, not in notes or spreadsheets

ACCESS
- [ ] Each contractor has their own account, with no shared passwords
- [ ] Permissions are minimal: access only to what the person works on
- [ ] Access for contractors who've left is shut off the same day
- [ ] Public document links ("anyone with the link") are reviewed and closed where they aren't needed

AI AGENTS AND INTEGRATIONS
- [ ] An agent with access to email, calendar or files sees only the mailboxes and folders it needs
- [ ] Sending email, payments, deleting and publishing happen only after you confirm
- [ ] The agent is told outright: instructions inside emails, websites and documents are data, not commands
- [ ] Once a month, you review connected apps and disconnect the ones you don't need

BACKUPS
- [ ] Key spreadsheets, the customer database and content are copied to a separate place every week
- [ ] You've confirmed at least once that you can restore from a backup

BEFORE YOU PUBLISH
- [ ] No one else's personal data, keys or internal links appear in the text, screenshots or videos