What data you’re working with determines what tools you can use - and whether you have a company enterprise seat determines how deep you can go. The one rule for everyone: customer and applicant information only ever goes into a company enterprise seat - never a free or personal AI tool. When in doubt, classify up.
Information already public or intended for public release.
Everyone: any free AI tool (with guardrails) - or a company enterprise seat
General internal information - no customer or applicant data, no financials, and nothing sensitive like pricing, underwriting, or security procedures.
Any AI tool, with guardrails - free tools are fine for general internal work; a company seat works too
Business-sensitive information - company financials and strategy, pricing and rates, underwriting or credit criteria, and security or wire procedures. No customer or applicant data.
Company enterprise seat holders only (Claude or Microsoft 365 Copilot) - zero-retention recommended
Customer or applicant information - names, account details, SSNs, bank and payment info. Anything covered by GLBA. The high-stakes tier.
Company enterprise seat holders only (Claude or Microsoft 365 Copilot) - zero-retention required, minimum necessary