Adopting AI securely
in your business.

Where the risk usually comes from

The risk most people picture is the AI provider using their documents to train its models. Whether that can happen depends on the plan the account is on, and it is a setting we check with you at the start, so you know exactly where your business stands.

The more common problem is simpler. Someone on your team pastes a customer list or a contract into a personal ChatGPT or Claude account to save time. That account belongs to them, not to the business. You cannot see what was shared, you cannot delete it, and the information is now covered by that account’s settings rather than yours. A tool that blocks pasting on company systems does not catch this, because the work never went through those systems.

This is why we start with the account rather than with a blocking tool. When the work runs in an account your business owns, with settings you chose, the information stays where you can see it and remove it.

Before we build anything, we check three things

Who owns the account. The Claude or OpenAI account the work runs in is opened in your company’s name and paid for by you. Everything built in it, and the record of what it did, sits under your control. If we stop working together, you remove our access and keep everything.

What the AI is allowed to do. We start with read access only: the AI can look at the documents, emails or records a task needs, and it cannot change, send or delete anything. If a task later needs to write something, for example create a draft or update a record, we agree that exact action with you first, and any action that cannot be undone keeps a step where a person approves it.

Which information the AI needs to see. For many tasks the AI does not need the full record. To check an invoice against agreed rates, it needs the invoice lines and the rate sheet, not the rest of the supplier file. We go through each task with you and decide which fields it reads, so the information it does not need stays in your systems and never reaches the AI.

These three rules apply on every engagement, and they are written out in full on our security page.

A worked example

Say your supplier invoices arrive by email, and someone checks each one against the agreed prices before it is paid. Today that person opens the email, finds the rate in a spreadsheet, compares the two and decides. Because the emails contain supplier and customer details, the first reaction is often to keep AI away from them altogether.

Set up properly, the task works like this. The AI runs in your company’s account. It reads the invoice and the rate sheet, compares them line by line and writes a short note: the invoice matches, or it does not, with the difference shown. Invoices that match are listed for the usual payment run. Invoices that do not match are listed for the person who checked them before, with the comparison already done, and that person decides. The AI does not send anything and does not change your records.

Your existing process keeps running alongside until you have seen enough checks to be satisfied they are right. The setup work is the account, the read access limited to those two documents, and the decision left with a person.

How we start

The first step is a free AI pre-audit: forty-five minutes on a call where we look at how you and your team use AI today, which tasks you would like to hand over, and what needs to be in place before any of them can run safely. You leave with a clear next step, whether or not you go further with us.

If you decide to go further, we set up the structure before any automation: the account, the access rules for each task, and your business knowledge written down so you are not explaining the same context again every time. How we work.