Your business's data has a price

Your business’s data has a price now. AI labs are buying business data, and some sellers are clearing over $1M a month. That figure is Precision’s observation of the market.

Buyers want your working files: how you do the job, and what you have learned about clients. They want the drafts that make the next job faster. That is true for businesses of every size, from small teams to enterprise.

A careless upload to a tool that trains on customer content gives that value away.

How do you protect company data when using AI?

1. Find where data goes.
2. Read the training terms.
3. Keep clients apart.
4. Write an approved-tools list.
5. Log what AI touches.

Find where data goes

Walk one recent week of real work. List every chat tool, extension, meeting assistant, pilot and personal account that touched company or client information. Note the plan and who approved it.

Look past the tools everyone knows about. Trials opened with a work email count, and so do exports, shared links and copies in a personal drive. For each one, write down what went in: client names, project facts, drawings, policies and your own procedures all count.

The FTC’s guide to protecting personal information starts in the same place: know what you have and where it sits. In its words, “No inventory is complete until you check everywhere sensitive data might be stored.” The list is there so you can close the paths nobody chose.

Read the training terms

Read the contract for the plan on the invoice, not the marketing page. A page that calls a product enterprise grade is advertising. The clause that matters is in that plan’s terms. Write four answers in a vendor file:

1. Training. Does this plan use your prompts, files or outputs to train a model that other customers use?
2. Retention. What is stored after the answer comes back, and for how long? Zero data retention covers the model provider, so ask separately what the app keeps.
3. Who else. Can the vendor’s staff, a subprocessor or another customer see your content?
4. Edition. Consumer, team and enterprise editions of one product often differ, so read the edition you pay for.

Terms can change after you sign. The FTC has warned that it may be unfair or deceptive for a company to adopt more permissive data practices through a surreptitious, retroactive change to its terms of service or privacy policy. When a vendor announces a policy update, read it again and date the note in your vendor file.

If the contract is silent on training, keep client files out. The longer list is 12 security questions to ask an AI vendor.

Keep clients apart

An agent that searches every folder can pull a figure from the wrong client. A clause or a drawing can come from the wrong project too.

Check your engagement letter or contract before a client file goes into any tool. Where you owe a client confidentiality, that duty can limit how their information is used. That is a check, not a prediction of how a regulator or a court will treat a given upload.

Keep client files, names and project facts out of any tool whose terms allow training. Blank templates can be decided separately. Work for one client should not draw on another client’s documents.

Write an approved-tools list

Name the tools, the plan you pay for, and the data allowed in each. Anything else waits for a yes. A personal account, a browser extension and a vendor pilot stay off the list until an owner adds them.

Start from the AI use policy template and name an owner. Review the list when someone proposes a tool, and at least once a year. Keep the policy next to the vendor file: the policy sets what your people may do, and the contract is what the vendor agreed to do.

For a fuller structure, NIST’s AI Risk Management Framework, released January 26, 2023, is a voluntary framework for managing AI risks to people, organizations and society. The approved-tools list is a practical first piece of it.

Log what AI touches

For any AI-assisted work, you should be able to say which tool touched it, who approved it, and what went out. Keep that log where you can export it. A chat history in a personal account is that person’s record.

If you cannot produce the log for a client or project, that tool is outside your control. Tax practices already have a model: IRS Publication 4557 tells tax professionals to keep audit trails that record who performed an activity, when, and what changed.

What makes business data valuable?

A model gets better after it has seen real work. Your procedures, client history and drafts show how your business does the job.

• Procedures. The checklist you wrote after a messy job, how files are named, and the exception the team handles every month.
• Client history. What you promised, what went wrong, and what the client will not accept again.
• Work product. Drafts, markups and the corrections that show how your business thinks.

Once a copy is in a training set, you cannot take it back. If you did not license the copy, you are not paid for it, and you are not asked. A later model can answer in a way that resembles your method.

What does a private system change?

An Agent OS (AOS) keeps your procedures, templates and client information in one private store. Your data stays separate from other customers. Agents work from it. Model calls are recorded, and sends are held for approval by default. How we protect your data has the details.

An agent drafts from your procedures and the file for that one job. The AI data pipeline is how those sources get connected and checked. Each model call record shows which job made it, which model answered, and what it cost.

Where do you stand?

Take the AI readiness score for a quick snapshot. To have the system built and run, see managed AI. Free and Team are coming soon.

Tax practices: our column on client tax data and AI covers what to settle first.

Steven de la Fe, CPA, is a co-founder of Precision AI OS in Miami. Before Precision, we spent ten years building Taxfyle from the ground up, taking it from $0 to $25M in annual recurring revenue.