Why data isolation matters when your AI vendor serves other businesses

Most AI vendors run one system for many customers, which may include businesses you compete with. Data isolation is what keeps your business’s data, and your clients’ data, out of another customer’s results. The strongest isolation is enforced by the database and by encryption, not only by the vendor’s application code.

The shared-system reality

Software vendors usually serve many customers from shared infrastructure, because it keeps costs down. That is ordinary for many tools.

For AI that reads your client files, learns your procedures, and drafts client work, the stakes are higher. A mix-up could put one business’s client information in front of another business, or into an AI answer where it does not belong.

Three levels of isolation

• Application level. The vendor’s code adds “only this customer” to every query. It works until one missed filter or one bug exposes another customer’s data.
• Database level. The database itself refuses to return rows that do not belong to the signed-in business, which is called row-level security. It must be enforced on every table, with no bypass for everyday service accounts.
• Encryption level. Each business’s data is encrypted with keys unique to it. The keys must be managed properly and bound to that business, or the encryption protects less than it appears to.

In PostgreSQL, row security policies restrict, on a per-user basis, which rows can be returned by normal queries. The same documentation says the table owner is typically not subject to those policies, and that superusers and roles with the BYPASSRLS attribute always bypass row security. Ask whether the accounts that run the service can bypass the control.

NIST’s key-management guidance says the proper management of cryptographic keys is essential to the effective use of cryptography for security. We think those keys should be specific to each business. The NIST publication does not itself require a separate key per customer.

We think the stronger designs use all three levels. The application asks for your business’s data, the database refuses to return anyone else’s, and another business’s data would be encrypted with a key that is not yours.

Why AI raises the bar

• AI combines information. Agents pull from many documents at once. Microsoft’s Copilot architecture says the prompt can include text from input files or other content Copilot discovers. A retrieval layer that is not limited to one business can surface the wrong business’s content in an answer.
• The Agent OS (AOS) is competitive knowledge. Your procedures, templates, and past decisions are how your business does the work. They should never inform another business’s agents, even indirectly.
• Models should not learn across customers. Microsoft’s enterprise data protection page says prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation models. Isolation in storage is a separate question from that no-training term. See zero data retention, explained.

What to ask your vendor

Put these six questions in writing and ask for written answers. A vendor that has built isolation into the database can usually answer each one in a sentence. For tax return data, see the 7216 consent form for AI tools.

1. Where is it enforced? Is isolation enforced by the database on every table, or only in application code?
2. Can it be bypassed? Can the accounts your services use switch that isolation off, the way a PostgreSQL superuser or BYPASSRLS role can?
3. Whose keys? Is our data encrypted with keys specific to our business, and are encrypted files bound to our business?
4. What about the OS? Is our business’s knowledge isolated the same way as our documents?
5. Is it used for training? Is any of our data used to train models or improve results for other customers?
6. How is it tested? How do you test that isolation holds, and how often?

For covered financial institutions, the FTC Safeguards Rule requires a written information security program whose objectives include the security and confidentiality of customer information. The rule says you shall oversee service providers that are permitted access to that information, including requiring safeguards by contract. The scope includes tax preparation firms.

How Precision AI OS isolates your business

Every table carries a business identifier, and row-level security is enforced on every table, so the database itself refuses to return another business’s data. The accounts our services use cannot switch it off.

Only two narrowly scoped database functions can resolve a user’s business, and tests check that no others exist. Documents are encrypted with a key for your business alone and bound to your business, and your Agent OS is private to you. See our security page.