Almost no small company has ever formally decided which information is allowed to leave and which is not. Artificial intelligence did not create that problem, but it made it visible every single day.
Someone pastes an entire contract into an artificial intelligence tool to get a summary back. Someone else uploads the client list to have it build a segmentation. A third person feeds it the proposal the client has not signed yet, to tighten up the wording.
None of the three did anything strange. All three got their work done faster. And none of them stopped to ask whether that information was allowed to leave the company, because nobody had ever told them.
That is the point. The tool is not the problem.
The decision nobody made
In a large company there is a department that decides which information is confidential, who gets to see it and where it is allowed to travel. In a company of three people, or ten, that department does not exist, and until recently there was not much reason to think about it: information moved by email, by message, and inside the head of whoever handled it.
What changed is that there is now a new route it takes out of the building, every day, many times a day, with nobody having authorized it.
Any rule about artificial intelligence laid on top of that will fail if the underlying decision was never made. This is not about banning tools. It is about deciding, once, what information can leave the company and under what conditions.
What counts as confidential when you are small
The first thing that comes to mind is personal data, and yes, it counts. But in a small business there are several other things worth as much or more:
Your client list. Who you sell to, how much you sell them, and how often. It is one of the most valuable things you have and one of the things that circulates with the least thought.
Your pricing structure. Margins, costs, discounts, rate sheets. Especially whatever is not published.
Contracts and proposals. The signed ones, and above all the ones that are not. A proposal that has not closed yet carries your entire commercial strategy.
Information a client shared with you. This one is not yours. They handed it over so you could do a job, and in many cases there is a signed obligation to look after it.
Your own team's data. Employment contracts, payroll, performance reviews, medical leave, personal documents. This is the one that gets forgotten most, and one of the few where there are concrete legal obligations sitting on top.
The rule that pays off most
It is a single question, asked before you paste anything: what part of this task needs the data at all.
Most of the time the answer is that it does not.
Drafting a confidentiality clause does not require the client's name or the contract amount. You draft it with placeholders and drop the details in afterward.
Tightening the wording of a proposal does not require your true prices. You can work with altered figures and set them right at the end.
Analyzing a contract does require the contract, because the analysis depends on the text. But it does not necessarily require the parties to be named.
Building a client segmentation requires the buying patterns, not the names or the contact details.
That question, asked in three seconds, settles most cases without costing you any of the speed you gained.
Check the settings on the tool you already use
Almost nobody has opened the settings of the tool they use every day. It is worth doing once, and it takes a few minutes.
There are three things to look for. Whether your conversations are used to improve the service, meaning whether what you type feeds the training. Whether there is a switch to turn that off, which in most cases there is and is usually one toggle. And whether the free plan and the paid plan come with different terms, because they often do and the difference tends to sit on exactly this point.
It also helps to know how long the history is kept and whether it can be deleted. Not because something is going to go wrong, but because if a client ever asks you what you did with their information, the answer should be something better than I don't know.
What working in a shared space adds
Here is a piece nobody talks about much, and it applies to anyone working from a coworking space, a café, or anywhere else with other people around.
Your screen is visible from behind. A contract left open, a spreadsheet full of names, a conversation with the tool where you just pasted a client's information. Nobody needs bad intentions to end up reading it.
Calls taken in the open area are the other half. Names, amounts, terms and client problems get said at normal volume, five feet from someone else.
Printed documents stay in the printer. Someone hits print, gets pulled into something, and the paper sits there for twenty minutes.
And the most common one of all: leaving your session open on a shared computer. At that point it is no longer one document, it is the whole history of everything you have pasted into the tool over months.
None of this is caused by artificial intelligence. But when the tool keeps a record of everything you have written into it, an open session exposes far more than a stray file.
The fixes are simple and none of them cost money. Log out, angle the screen, step outside to take calls where they cannot be heard, and pick up what you printed on the spot.
If your clients do have compliance
This is the point that can get expensive.
Plenty of contracts between companies carry confidentiality clauses that draw no distinction about the route the information travels. They do not say don't email it, or don't upload it to such and such a site: they say don't share it with third parties without authorization.
Putting a client's document into an artificial intelligence tool can fall inside that definition, depending on how the clause is worded and what terms come with the tool.
This is not cause for alarm and not a reason to stop using anything. It is a reason to read that clause beforehand instead of afterward, above all if you work with large companies, with corporate groups, or with clients in regulated industries. And if the contract is not clear, ask. A two-line email to the client settles the doubt, and it looks good besides.
The minimum worth having in writing
You do not need a twenty-page policy. One page is enough, and it takes half an hour.
Three categories:
What can go out as is. Public information, marketing content, text you have already published, general market data.
What goes out with the identifiers stripped. Contracts without the parties, proposals with altered figures, lists without names, cases described in general terms.
What does not go out. Personal data of clients and staff, information handed to you in confidence, passwords and access credentials, and whatever a specific contract prohibits.
Write five examples from your own operation in each category, not abstract definitions. And share the page with whoever works with you.
That settles almost every decision you make day to day, and the ones left over are the cases that deserve a question anyway.
At Kiin Hub we have the Mesa Kiin: putting your case in front of people who know different things. Tax and accounting, labor, value proposition, process and technology. If you are making decisions like these with nobody to talk them through with, write to us.
Share this article