Secure AI
We help small businesses adopt ChatGPT, Claude, Copilot and Gemini on company-owned accounts, with clear rules about what information goes where — and honest explanations of what each provider does with it.
Our starting principle
“Not used to train the model” does not mean “never leaves your company.”
When your team uses cloud AI, information is sent to the provider to be processed. Business plans change what the provider may do with it. They don’t keep it in your building.
Why this matters
AI adoption in small businesses usually starts from the bottom up — which is great for productivity and hard on oversight. These are the gaps we see most.
What actually happens
A simple walk-through for owners and staff. Details vary by provider and plan, so we check each provider’s current business terms when we deploy.
01
Text, files or connected data leave your device over an encrypted connection.
02
The model runs on the provider's servers — not in your office. This is true on every cloud plan.
03
Chat history, files, logs and memory can be stored for a period set by the plan, your settings and the provider's policy.
04
Business plans typically exclude your data from model training by default. That limits one use — it doesn't mean the data never left.
Words that get mixed up
Vendors describe their protections accurately, but the words are easy to over-read. Here’s the plain-language version we use with clients.
AI data classification
Each level has examples from your business and a clear destination. Where information doesn’t fit neatly, the rule is simple: treat it as the higher level and ask.
Information you'd be comfortable seeing on your website.
For example
Approved cloud AI
Company-approved tools such as ChatGPT or Claude, using business accounts.
Everyday working knowledge that isn't meant for the public.
For example
Business AI workspace, under policy
Your company's business or enterprise AI environment, with the settings and rules your policy sets.
Information that would cause real harm if it were exposed.
For example
Private AI — or no AI at all
Some of it may be processed by a private, on-premises system you control. Some of it — credentials and secrets in particular — shouldn't go into any AI system.
Hybrid AI architecture
Employees reach AI through tools and accounts we manage for you. Company sign-in, policy and access controls decide which destination is approved for which kind of work.
Everyday tasks can use the most capable cloud models. Restricted material stays on a private system — or out of AI entirely.
Employee
Signs in with a company account
Cydekick-managed AI environment
Approved tools, company workspaces, reviewed settings
Identity, policy and access controls
Cloud — sent to the provider for processing
ChatGPT
Business or Enterprise workspace
Claude
Team or Enterprise workspace
Microsoft or Google AI
Copilot or Gemini inside your tenant
On-premises
Private local model
Runs on hardware you control
Not every red item belongs in AI. Credentials, secrets and some highly sensitive records stay out of every AI system — private ones included.
Routing is decided by your policy, the tools you approve, how accounts are configured and how staff are trained. We don’t claim software can automatically sort every document into the right category — where automated checks are added, we describe exactly what they catch and what they miss.
What we do
Take the pieces you need — or let us run the whole thing as managed AI.
Before anything goes live
AI providers update their plans, features and terms often. Every deployment includes a review of the provider’s current official business privacy, security and retention documentation, and we re-check periodically.
Questions
Provider terms change. Answers describing a vendor’s policy are reviewed periodically and should be confirmed against the provider’s current official documentation before you rely on them.
Yes. When someone types or uploads information into ChatGPT, it is sent over the internet to OpenAI's systems to be processed. That's true on every plan. Business plans change what OpenAI may do with that data — for example training defaults, retention and admin controls — but they don't keep the information inside your office.
"Not used for training" is not the same as "never leaves your company." This is the most important distinction we help clients understand.
Yes. Claude runs on Anthropic's infrastructure (and, depending on how it's accessed, a cloud partner's). Anything an employee sends to Claude is transmitted to that provider for processing, and may be stored for a period defined by the plan and your settings. If information must not leave your control, it should be kept out of cloud AI or handled with a private, local system.
It depends on which kind of account is being used. OpenAI's published terms for its business offerings (such as ChatGPT Business, ChatGPT Enterprise and the API) say business data is not used to train its models by default. Personal and free accounts work differently and have their own settings, which individuals control.
That's a big reason we move teams onto company-owned business accounts. Before deployment we review OpenAI's current official business privacy and data-retention documentation with you, because these terms can change.
Anthropic's published terms for its commercial offerings (such as Claude Team, Claude Enterprise and the API) say customer content is not used to train its models by default. Consumer plans have separate terms and settings that individual users control, and those have changed over time.
As with any provider, we review Anthropic's current official commercial privacy and retention documentation during setup and flag changes that affect you.
Yes, and it's one of the most common ways AI creates risk in small businesses. Someone pastes a client list into a free chatbot to tidy it up, or connects a personal AI account to their work email. No bad intent is needed.
The practical fixes are a clear policy, company-owned accounts with the right settings, training that uses real examples from your business, blocking or discouraging unapproved AI tools where appropriate, and reviewing which connectors and apps have access to company data.
You can reduce the risk significantly, but no tool catches everything. We combine several layers: a data classification your staff can actually remember (our green, yellow and red model), approved tools for each level, restricted connectors, browser and endpoint controls where your licensing supports them, and — for the most sensitive work — a private AI system that doesn't send data to a cloud provider at all.
We'll be clear about what each control does and doesn't do. We won't tell you a system can automatically detect every piece of confidential information, because that isn't realistic.
It happens, so we plan for it. We keep a list of the provider terms your policy relies on — training, retention, data location, admin controls — and review them periodically and when providers announce changes. If a change affects you, we explain it in plain language and recommend what to adjust: settings, policy, which data is allowed, or whether to move a workload to a different provider or to private AI.
You do. We set up business workspaces — for example ChatGPT Business or Enterprise, or Claude Team or Enterprise — under your company's ownership and billing. Cydekick is added as an administrator so we can manage users, settings and connectors on your behalf. Conversations and projects created by your staff belong to your workspace, not to us.
Our AI readiness assessment looks at which tools your team uses, what information is involved, how accounts are set up and where the gaps are — then recommends a practical, secure path forward.