How should a small business protect customer information when using AI?

The decision that governs everything is which categories of information may be sent to an outside service, and it should be made before any tool is chosen. Names and contact details, contract terms, financial details, anything a customer supplied in confidence, anything covered by an obligation you have signed: each of these is a category with an answer, and the answers are usually obvious once someone is asked to give them. What produces exposure is nobody being asked.

The mechanism people misunderstand is that access and disclosure are the same decision. A tool that can read a folder will put the contents of that folder into a request when it reads one. There is no configuration under which a file the system reads remains inside the business, and instructions about not using particular material do not change what was transmitted. This is why the control is which locations are connected rather than which files are relevant.

Given the categories, the practical controls are few. Keep restricted material in locations no tool reaches. Scope every connection to the narrowest thing that does the job — one folder, one label, one table. Use the business tier of any product rather than the personal one, since the contractual terms frequently differ. And know what your own obligations say, because a signed confidentiality clause with a customer is a constraint that exists whatever any vendor's terms permit.

Anonymising is worth using where it works and is not a general solution. Replacing names in a document is straightforward; removing everything that identifies a person from a detailed account of their circumstances is not, because the circumstances themselves identify. For a support conversation, an incident description or a small customer base, the identification survives the removal of the name, and treating anonymisation as sufficient is where this goes wrong.

Retention deserves an explicit question rather than an assumption. What the vendor keeps, for how long, whether it is used to improve their systems, and whether that differs by plan. These are answerable and the answers vary considerably, including between tiers of the same product. A business with obligations to its own customers needs the answer before rather than after, because the disclosure has already happened by the time anyone thinks to ask.

The final control is knowing what happened. If material did reach somewhere it should not, the questions are what, when and whose, and answering them requires some record of what was connected and when. This is a small amount of documentation that nobody wants to maintain and that determines whether an incident is a specific problem or an unbounded one.