Keeping Your Data Private in AI Systems
Last updated:
The question to ask first
Not “is this provider secure?” but “what exactly are we sending, and does it need to be in there?”
Most of the privacy risk in AI systems is self-inflicted: sending an entire customer record when the task needed two fields. The cheapest privacy control available is sending less.
What is actually under your control
- What you send. Entirely yours to decide, and the biggest lever by far.
- Where it is processed. Most serious providers offer regional processing.
- Whether it is retained. Zero-retention arrangements are available and worth asking for explicitly.
- Whether it trains models. Enterprise API terms generally exclude this; consumer products often do not.
- Who inside your business can invoke it. Your own access control, which is frequently the weakest link.
Redaction and tokenisation
The pattern we use most: strip identifiers before the request, put them back afterwards. The model sees “CUSTOMER_1” and “their order”; your system knows who that is.
It works because most tasks do not need the identity. Classifying a complaint, summarising a call, extracting the amount — none of these require a real name, and removing it removes most of the sensitivity.
Ask of every field you are about to send: would the task fail without it? Most of the time the answer is no, and that field should not be leaving your building.
When to self-host
Self-hosting is the right answer when data genuinely cannot leave your infrastructure — certain health, legal, defence and financial contexts, or a contractual commitment you have already made to your own customers.
| Hosted API | Self-hosted | |
|---|---|---|
| Capability | Highest available | Good, narrower at the top end |
| Setup cost | Low | Substantial |
| Running cost | Per use | Fixed infrastructure, whether used or not |
| Data location | Provider's region | Yours |
| Ops burden | None | Real and continuing |
| Best for | Most business tasks | Genuine data-residency constraints |
The mistake is self-hosting for a feeling of control when a zero-retention hosted arrangement would satisfy the actual requirement at a fraction of the effort. Read your obligation carefully before committing to the infrastructure.
Logging, which is where data quietly accumulates
AI systems log prompts for debugging, and prompts contain the data you were careful about. It is a common way for sensitive information to end up in a log aggregator with wide access.
- Redact prompts before logging, not after
- Short retention on anything containing customer data
- Restrict access to prompt logs like any other sensitive store
- Log identifiers and outcomes rather than full text where you can
What to tell your customers
If you process customer data through a third-party model, say so in your privacy policy: which categories, which provider, which region, what retention. It is a short paragraph and it is far better than the alternative conversation.
We write that paragraph for clients as part of the build, because we know exactly what the system sends and it is easier for us to describe it accurately than for a lawyer to infer it.
Frequently asked questions
Does using a hosted model breach GDPR?
Can we use AI with health or financial data?
Will the provider see our data?
Is redaction reliable?
Wondering whether AI would actually help here?
Describe the task and we will tell you plainly whether it is a good fit, including when the honest answer is that ordinary software would serve you better.