LinkT&B Editorial Department
Before sending information to cloud AI, check training use, retention, access controls and external integrations. VPN intrusion statistics describe weaknesses in access infrastructure; they do not, by themselves, establish that cloud AI is unsafe.
Contents
Contract and configuration checks
| Item | What to check | How to assess it |
|---|---|---|
| Data use | Use of prompts, files and responses for training | Terms for the selected plan |
| Retention | History, logs and backups | Deletion scope and exceptions |
| Access | Administrators, subcontractors and retrieval | Audit logs and account removal |
| Integrations | Tools, search and fallback providers | Approval of additional destinations |
Encryption does not mean that nobody can process the content
Transport encryption reduces interception risk. It does not by itself prevent the service from accessing content to perform the requested work. Identify the protections for transfer, storage and processing, and read the terms for the actual product and contract.
Check storage locations and retention
Attachments, conversation history, retrieval indexes, logs and backups may have different lifetimes. Check storage regions, deletion procedures and contract-end handling. Removing a conversation from a screen does not establish immediate deletion from every storage layer.
Retention should have a defined purpose and authorised readers. Audit and incident-investigation requirements also need consideration.
Understand administrator and supplier access
Determine when company administrators, providers and subprocessors can access data. Define approval for diagnostic material shared with support, log privileged actions and revoke unnecessary access.
Meeting transcription creates additional records and sharing routes. Decide where recordings and transcripts will be stored, including meetings with external participants.
A VPN does not govern every input to AI
A VPN protects a network path. It does not automatically prevent a user from uploading sensitive documents to a legitimate external service. Nor does using a VPN automatically let that service read the entire internal network. Check routes, authentication, endpoint state and application permissions separately.
For integrations, distinguish read access from writing or sending. Retrieved material must remain untrusted data rather than authority to execute instructions.
Define permitted information and permitted uses
Classify public, internal, personal and contractually confidential information and map it to approved services. Provide an authorised alternative when an input is prohibited. Local processing is one option, but still requires internal access controls and maintenance.
LinkT&B supports AI usage rules, information management and system design. NIST’s Generative AI Profile provides a reference for evaluating risks.
Discuss your project
We help select an AI architecture, evaluation process and operating model for your workflows and information requirements.