Client Documents in AI Tools: A Checklist for Agencies
You can put client documents into an AI tool, but only after you know where the text goes, how long it is kept, whether it trains a model, who else processes it, and what your contract with the client allows. Those five answers differ a lot between a personal chat account and a business product built on a commercial API. The checklist below works for any vendor, and the last section shows how…
When uploading client documents to an AI tool, it is crucial to understand the process and implications. The journey begins when a browser sends the file to the tool's servers, which may store the original file, extracted text, or only the AI-generated output. The tool then sends the text to a model provider, often a separate entity from the tool provider, where it may be retained for monitoring or debugging purposes. The result comes back and is saved within the tool, the project, or not at all.
It is essential to know the storage and retention policies of each hop in this process. A reputable vendor should provide detailed information about where the data is stored, for how long, and in which country. Questions about storage should be answered in writing on the vendor's public page.
Another critical aspect is whether the AI vendor uses the client's content to train models. For confidential work, a clear "no" by default is desired. Different product tiers may have varying policies, such as OpenAI's business products and API not training on inputs or outputs by default, while personal ChatGPT accounts have an "Improve the model for everyone" setting that is on by default.
The model provider and any sub-processors handling the data should also be identified. A list of these parties should be provided, along with what each receives. Access to client content should be restricted to specific individuals within the vendor, and isolation measures should be in place to prevent data from one customer from being accessed by another.
Deletion policies should be clearly outlined, including how to delete projects and accounts, and what happens to the data. Users should be able to export their content in a usable format. Contracts should include a data processing agreement (DPA) if personal data is involved, and the vendor should have a process for obtaining authorization to use sub-processors.
Lastly, independent audits or certifications, such as GDPR compliance, can provide assurance. While an audit report from a third party indicates some level of control, it does not guarantee safety. Careful consideration should be given to the vendor's written answers, and specific policies should be weighed against those offered by competitors.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
