A legitimate concern for any business adopting AI: what happens to my data when I send it to the cloud of OpenAI, Anthropic or Google? The answer depends on which tool you use, how you use it, and what settings you have.
The real risks
Training with your data: by default, some APIs used (and some still use) the data you send them to train future models. This can mean that your company’s information appears in other users’ responses.
Data leaks: like any cloud service, AI platforms can suffer leaks. Although large providers have solid security, zero risk does not exist.
Provider employee access: in some cases, the provider’s employees may access data to resolve technical issues. Policies vary by provider.
GDPR compliance: if your clients’ personal data is processed outside the EU, there are specific GDPR requirements to meet.
Basic security practices
Don’t send confidential information unnecessarily: the first principle. Minimise the data you send to the AI.
Anonymise where possible: names, numbers, identifiers. Replace them with placeholders before sending and substitute them back afterwards.
Use commercial APIs with SLAs: the commercial versions of Claude, GPT and Gemini have explicit agreements not to use your data for training. Free or consumer versions tend to offer fewer guarantees.
Consider self-hosting for critical data: for heavily regulated sectors (medicine, finance, defence), models on your own infrastructure (Ollama with LLaMA) eliminate the risk of data leaving your systems.
Audit the logs: monitor what is sent to the APIs and by whom. Without that visibility, you cannot detect misuse or errors.
Providers and their policies
Anthropic (Claude): does not use API data for training. The consumer version (Claude.ai) has a different policy.
OpenAI (ChatGPT/GPT-4): has not used API data for training since 2023. The consumer version may use data depending on settings.
Google (Gemini): policies vary depending on the product. Gemini Enterprise has stricter guarantees.
For businesses with highly sensitive data, at BAI Marketing we recommend a hybrid approach: commercial APIs with SLAs for general use, self-hosted models (LLaMA on your own server) for the most sensitive data.