Someone pastes a client's tax return into their own free ChatGPT. The firm has no contract, no logs and no control over what happens next.
Real case: Microsoft found 80% of AI users at small and mid-size companies bring their own AI to work. IBM's 2025 breach study puts the extra cost of heavy shadow AI at about $670,000 per breach.
Give everyone a business plan, block consumer AI on company devices, and write a one-page policy.
02
Copilot finds files people shouldn't see
Copilot shows people anything they already have permission to open. In most offices that's far more than anyone realizes: old share links, sites open to everyone.
Real case: Microsoft's own guidance: Copilot only surfaces data a user can already view, so it's on you to make permissions right before turning it on.
Clean up SharePoint sharing first. Restricted Content Discovery, included with Copilot, hides sensitive sites from it.
03
Hidden instructions in emails and files
An AI that reads your email can be tricked by instructions hidden in a message or document. It follows them as if you wrote them. This is called prompt injection.
Real case: EchoLeak (June 2025): one crafted email could make Microsoft 365 Copilot leak company data with zero clicks. Microsoft fixed it on its side. A similar flaw hit ChatGPT's Gmail connector.
Give AI read-only access where you can, keep browser agents off banking and payroll sites, and require a person to approve anything AI sends or pays.
04
Plug-ins that do more than they say
Connectors and add-ons give AI standing access to your email, files and systems. A bad one acts with all of that access.
Real case: postmark-mcp (September 2025): a fake email plug-in for AI tools quietly copied every email it sent to an attacker.
Allow only connectors published by the vendor itself, approved by an admin, with the narrowest permissions.
05
Deepfake voices and fake bosses
AI makes it cheap to clone a voice or a face. The scam is the old one, a rushed wire transfer, made more convincing.
Real case: Arup lost about $25.6 million after a video call with deepfaked executives. The FBI recorded $3.05 billion in business email compromise losses in 2025.
Call back on a number you already have, require two approvers for payments, and agree a code word.
06
Self-hosted automation left unpatched
An automation server holds the keys to every system it connects. Run it yourself, and patching it is your job.
Real case: n8n has had several critical flaws since late 2025. One (CVE-2025-68613) is on CISA's list of vulnerabilities attackers are actively using, and tens of thousands of servers were exposed.
Use n8n Cloud, or keep a self-hosted server behind your company login and patch it every week.
07
Accounts without MFA
An AI account holds months of uploaded documents and, with connectors, reaches email and files. A stolen password opens all of it.
Real case: The FBI warned in May 2025 of AI-generated voice messages impersonating senior officials to steal logins.
Single sign-on and multi-factor on every AI tool; hardware keys for anyone who moves money.
How each tool handles your data
From each vendor's own trust and help pages, November 2026.
Question
Claude Team
Claude Enterprise
ChatGPT Business
Microsoft Copilot
Power Automate
n8n self-hosted
Trains on your data
No
No
No
No
No
No; your server
Vendor staff can read chats
Only for safety review, or if you send feedback
Only for safety review, or if you send feedback
Authorized staff and vetted contractors, for abuse and support
No routine human review
Microsoft's standard terms
Only your own admins
Your admins can read chats
No admin view
Yes, through the Compliance API
No routine view; owners can export a member's data
Yes, through Purview
Run history
Yes
Deleted chats are gone
Within 30 days
On your schedule (30 days minimum)
Within 30 days
On your Purview rules
Not applicable
When you delete them
Audit logs
Yes, Purview Audit
Admin center
If you set them up
HIPAA agreement
Yes; not web search
Microsoft's agreement
Where data lives
US by default
US; US-only processing option
No choice (Enterprise only)
Your Microsoft 365 region
Your tenant region
Wherever you host it
Swipe to compare →
Controls, layer by layer
Identity
Make sure the person signing in is who they say they are.
Single sign-on for every AI tool
Staff use their Microsoft or Google work login; turning one account off turns off everything.
Included in Claude Team, ChatGPT Business
Multi-factor authentication
A code or prompt on the phone as well as the password.
Included
Conditional Access
Only allow sign-in from company devices and expected places.
Business Premium, $22 a person
Hardware security keys
Phishing-proof sign-in for anyone who moves money or handles patient data.
About $25 to $60 per key, once
Pick a security level
Baseline
Any office of 5 to 20 people
About $20 to $25 a person: the AI seat, nothing more
Claude Team or ChatGPT Business for everyone
Multi-factor on email, AI tools and banking
Claude feedback and web search off where not needed
Browser agent off, or limited to approved sites
One-page policy and the traffic-light rule
Callback rule and a code word
Cloudflare's free filter to block consumer AI
Client files, financials, policies and contracts are fine in Team or Business plans; full SSNs, bank, account and card numbers, and health information stay out
Tax preparers and most insurance agencies: a written information security plan, at any size
Standard
20 to 50 people: CPA firms, agencies, manufacturers
About $52 to $57 a person a month
Everything in Baseline
Microsoft 365 Business Premium with Conditional Access
SharePoint cleanup before any Copilot license
Defender add-on to block unapproved AI
Sensitivity labels on client files
Power Platform data policy
n8n Cloud, or self-hosted behind your login and patched weekly
The written security plan, updated for AI tools and vendors
Strict
Healthcare, banks, legal, and firms that need SSNs in scope or audit logs
About $67 to $97 a person a month
Everything in Standard
Claude Enterprise with the HIPAA agreement, audit logs and retention
Microsoft Purview for data loss prevention and audit
Hardware security keys for money and patient data
Short retention, 30 to 90 days
AI agents and browser agents off by default
A vendor file: SOC 2 reports, agreements, insurer answers
Secure setup checklists
Tick items off as you go. Your progress stays in this browser only.
Claude Team
0 of 7 done
If someone pastes client data into a personal AI
01
Contain it today
Screenshot it for the record, have them delete the chat and turn off training in that account, and change any password that was pasted.
02
Work out what went
What data, how many people, which states they live in, whether it was encrypted, and which tool and terms.
03
Write it down
Iowa lets you skip consumer notice if there's no reasonable likelihood of financial harm, but only with that finding in writing, kept five years.
04
Notify if the law says so
Every state has its own breach law; these are the two we cover in depth. Iowa: the Attorney General within 5 business days of telling customers, if over 500 Iowans. Minnesota: credit bureaus within 48 hours if over 500 people. Tax preparers: your IRS Stakeholder Liaison right away, and the FTC within 30 days at 500. Insurance agencies: the commissioner within 3 business days in Iowa, 5 in Minnesota. Health data: HIPAA's 60 days.
05
Call your insurer early
Cyber policies usually require prompt notice, and many provide a breach coach and lawyers.
06
Fix the cause
Give people an approved tool, block consumer AI on company devices, and retrain on the traffic-light rule.
Security questions clients ask
Can our own admins see what employees type?
On Claude Enterprise, through the Compliance API; not on Claude Team. On ChatGPT Business, there's no routine view, but owners can export a member's data. On Copilot, through Purview. Say so in your policy.
Can it leak our data to other customers?
Not through training on business plans, and tenants are kept separate. The realistic leak paths are your own sharing settings, plug-ins and prompt injection.
What if the AI company gets hacked?
Your data agreement requires notice: Anthropic within 48 hours, OpenAI and Microsoft without undue delay. Short retention means less exists to steal.
Is it HIPAA compliant?
Only with a signed business associate agreement and covered features: Claude Enterprise (not Team), ChatGPT Enterprise (not Business), or Copilot with web search off.
Can our chats be subpoenaed?
Yes, like any business record, and courts can order vendors to keep logs. Set retention on purpose and include AI in litigation holds.
Is self-hosting safer?
Only if you patch and watch it like a vendor would. Self-hosted n8n had several critical flaws since late 2025. For most small businesses, cloud with single sign-on is safer.
What about DeepSeek?
Its privacy policy said data is stored in China. Iowa banned it on state government devices in February 2025. Block it on business devices.
Do we need to change our cyber insurance?
Probably not the policy, but expect AI questions on applications. Answer them accurately: answers can count as promises.
What's the cheapest meaningful step?
Buy a business AI plan so nobody uses personal accounts, turn on multi-factor, and adopt the callback rule. All three cost little or nothing.
From vendor trust centers and documentation, the GitHub Advisory Database, CISA, the FBI, IBM and Microsoft research, and Iowa Code 715C and Minn. Stat. 325E.61, checked November 9, 2026. Costs are list prices and estimates. This is guidance, not legal advice; your attorney confirms notice duties.
Rather talk it through?
Book a call. Caleb will point you to the right plan and the first project for your business.