Someone pastes a client's tax return into their own free ChatGPT. The firm has no contract, no logs and no control over what happens next.
Real case: Microsoft found 80% of AI users at small and mid-size companies bring their own AI to work. IBM's 2025 breach study puts the extra cost of heavy shadow AI at about $670,000 per breach.
Give everyone a business plan, block consumer AI on company devices, and write a one-page policy.
02
Copilot finds files people shouldn't see
Copilot shows people anything they already have permission to open. In most offices that's far more than anyone realizes: old share links, sites open to everyone.
Real case: Microsoft's own guidance: Copilot only surfaces data a user can already view, so it's on you to make permissions right before turning it on.
Clean up SharePoint sharing first. Restricted Content Discovery, included with Copilot, hides sensitive sites from it.
03
Hidden instructions in emails and files
An AI that reads your email can be tricked by instructions hidden in a message or document. It follows them as if you wrote them. This is called prompt injection.
Real case: EchoLeak (June 2025): one crafted email could make Microsoft 365 Copilot leak company data with zero clicks. Microsoft fixed it on its side. A similar flaw hit ChatGPT's Gmail connector.
Give AI read-only access where you can, keep browser agents off banking and payroll sites, and require a person to approve anything AI sends or pays.
04
Plug-ins that do more than they say
Connectors and add-ons give AI standing access to your email, files and systems. A bad one acts with all of that access.
Real case: postmark-mcp (September 2025): a fake email plug-in for AI tools quietly copied every email it sent to an attacker.
Allow only connectors published by the vendor itself, approved by an admin, with the narrowest permissions.
05
Deepfake voices and fake bosses
AI makes it cheap to clone a voice or a face. The scam is the old one, a rushed wire transfer, made more convincing.
Real case: Arup lost about $25.6 million after a video call with deepfaked executives. The FBI recorded $3.05 billion in business email compromise losses in 2025.
Call back on a number you already have, require two approvers for payments, and agree a code word.
06
Self-hosted automation left unpatched
An automation server holds the keys to every system it connects. Run it yourself, and patching it is your job.
Real case: n8n has had several critical flaws since late 2025. One (CVE-2025-68613) is on CISA's list of vulnerabilities attackers are actively using, and tens of thousands of servers were exposed.
Use n8n Cloud, or keep a self-hosted server behind your company login and patch it every week.
07
Accounts without multi-factor sign-in
An AI account holds months of uploaded documents and, with connectors, reaches email and files. A stolen password opens all of it.
Real case: The FBI warned in May 2025 of AI-generated voice messages impersonating senior officials to steal logins.
Single sign-on and multi-factor on every AI tool; hardware keys for anyone who moves money.
How each tool handles your data
From each vendor's own trust and help pages, November 2026.
Question
Claude Team
Claude Enterprise
ChatGPT Business
Microsoft Copilot
Power Automate
n8n self-hosted
Trains on your data
No
No
No
No
No
No; your server
Vendor staff can read chats
Only for safety review, or if you send feedback
Only for safety review, or if you send feedback
Authorized staff and vetted contractors, for abuse and support
No routine human review
Microsoft's standard terms
Only your own admins
Your admins can read chats
No admin view
Yes, through the Compliance API
No routine view; owners can export a member's data
Yes, through Purview
Run history
Yes
Deleted chats are gone
Within 30 days
On your schedule (30 days minimum)
Within 30 days
On your Purview rules
Not applicable
When you delete them
Audit logs
Yes, Purview Audit
Admin center
If you set them up
HIPAA agreement
Yes; not web search
Microsoft's agreement
Where data lives
US by default
US; US-only processing option
No choice (Enterprise only)
Your Microsoft 365 region
Your tenant region
Wherever you host it
Swipe to compare →
Controls, layer by layer
Identity
Make sure the person signing in is who they say they are.
Single sign-on for every AI tool
Staff use their Microsoft or Google work login; turning that account off blocks sign-in to every tool.
Included in Claude Team, ChatGPT Business
Multi-factor authentication
A code or prompt on the phone as well as the password.
Included
Conditional Access
Only allow sign-in from company devices and expected places.
Business Premium, $22 a person
Hardware security keys
Phishing-proof sign-in for anyone who moves money or handles patient data.
About $25 to $60 per key, once
Access
Each person and each tool sees only what it needs.
SharePoint permission cleanup
Remove “everyone” sharing and old “anyone with the link” shares before Copilot.
Staff time
Restricted Content Discovery
Hide HR, finance and legal sites from Copilot without changing permissions.
Included with Copilot
Connector and plug-in allowlist
Admins approve which connectors exist; no community plug-ins.
Included
Claude in Chrome allowlist
Limit the browser agent to approved sites, or turn it off.
Included in Claude Team
Data
Decide what may go where, then enforce it.
Traffic-light rule
Green: public. Yellow: client files, financials, policies and contracts, on approved business AI only. Red: passwords, full SSNs, bank, account and card numbers, and health information: Enterprise or the system of record only.
$0
Block consumer AI
Block unapproved AI apps on company devices. Blocking personal accounts on the same app as your business plan needs an Enterprise plan and a filtering proxy.
Cloudflare: free up to 50 people; Defender add-on about $10 a person
Sensitivity labels
Mark 'Confidential – Client' files so AI respects their protection.
Microsoft 365 Business Premium
Power Platform data policy
Business connectors can't send data to personal email or storage.
Included
Monitoring
Know who did what, so a question can be answered later.
Audit logs
Who used what, when. Claude Enterprise and Microsoft Purview have them; Claude Team and ChatGPT Business don't.
Enterprise plans or Purview
Compliance export
Pull conversations into eDiscovery or a legal hold.
Claude Enterprise, ChatGPT Enterprise
Retention rules
Delete chats on a schedule you choose, so less exists to leak or be subpoenaed.
Enterprise plans; Purview for Copilot
Automation
Flows and agents run with real access; treat them like staff.
Service accounts
Flows run as a dedicated account, not a person who might leave.
One license
Secrets in a vault
Keys live in Azure Key Vault, 1Password or similar, never in a flow or in code.
$0 to a few dollars
n8n behind your login, patched weekly
The editor never faces the internet; only the webhooks you need do.
Cloudflare Access, free up to 50
Spending caps
Monthly limits on every AI and API account.
$0
People
Most attacks still start with a person; a few habits stop them.
One-page AI policy
Approved tools, the traffic-light rule, no personal accounts, a person reviews anything that leaves.
$0
30-minute training
At onboarding and once a year, including a live prompt-injection and voice-clone demo.
Staff time
Callback and two approvers
Confirm any payment change on a number you already have, and hold new bank details 24 hours.
$0
Code word
The FBI's advice for urgent requests from “the boss” or family.
$0
Pick a security level
Baseline
Any office up to 20 people
About $20 to $25 a person: the AI seat, nothing more
Claude Team or ChatGPT Business for everyone
Multi-factor on email, AI tools and banking
Claude feedback and web search off where not needed
Browser agent off, or limited to approved sites
One-page policy and the traffic-light rule
Callback rule and a code word
Block AI apps you haven't approved, like DeepSeek; the AI policy covers personal accounts on the app you use
Client files, financials, policies and contracts are fine in Team or Business plans; full SSNs, bank, account and card numbers, and health information stay out
Tax preparers: a written information security plan, at any size. Insurance agencies: required above the small-agency exemption, and worth having below it
Standard
20 to 50 people: CPA firms, agencies, manufacturers
About $52 to $57 a person a month
Everything in Baseline
Microsoft 365 Business Premium with Conditional Access
SharePoint cleanup before any Copilot license
Defender add-on to block unapproved AI
Sensitivity labels on client files
Power Platform data policy
n8n Cloud, or self-hosted behind your login and patched weekly
The written security plan, updated for AI tools and vendors
Strict
Healthcare, banks, legal, and firms that must put full SSNs or account numbers into AI, or need audit logs
About $67 to $97 a person a month
Everything in Standard
Claude Enterprise with the HIPAA agreement, audit logs and retention
Microsoft Purview for data loss prevention and audit
Hardware security keys for money and patient data
Short retention, 30 to 90 days
AI agents and browser agents off by default
A vendor file: SOC 2 reports, agreements, insurer answers
Secure setup checklists
Tick items off as you go. Your progress stays in this browser only.
Claude Team
0 of 7 done
ChatGPT Business
0 of 8 done
Microsoft Copilot
0 of 8 done
Power Automate
0 of 7 done
n8n self-hosted
0 of 9 done
If someone pastes client data into a personal AI
01
Contain it today
Screenshot it for the record, have them delete the chat and turn off training in that account, and change any password that was pasted.
02
Work out what went
What data, how many people, which states they live in, whether it was encrypted, and which tool and terms.
03
Write it down
Iowa lets you skip consumer notice if there's no reasonable likelihood of financial harm, but only with that finding in writing, kept five years.
04
Notify if the law says so
Every state has its own breach law; these are the two we cover in depth.
Iowa: the Attorney General within 5 business days of telling customers, if over 500 Iowans
Minnesota: credit bureaus within 48 hours, if over 500 people
Tax preparers: your IRS Stakeholder Liaison right away; the FTC within 30 days at 500
Insurance agencies: the commissioner within 3 business days in Iowa, 5 in Minnesota
Health data: HIPAA's 60 days
05
Call your insurer early
Cyber policies usually require prompt notice, and many provide a breach coach and lawyers.
06
Fix the cause
Give people an approved tool, block consumer AI on company devices, and retrain on the traffic-light rule.
Security questions clients ask
Can our own admins see what employees type?
On Claude Enterprise, through the Compliance API; not on Claude Team. On ChatGPT Business, there's no routine view, but owners can export a member's data. On Copilot, through Purview. Say so in your policy.
Can it leak our data to other customers?
Not through training on business plans, and tenants are kept separate. The realistic leak paths are your own sharing settings, plug-ins and prompt injection.
What if the AI company gets hacked?
Your data agreement requires notice: Anthropic within 48 hours, OpenAI and Microsoft without undue delay. Short retention means less exists to steal.
Is it HIPAA compliant?
Only with a signed business associate agreement and covered features: Claude Enterprise (not Team), ChatGPT Enterprise (not Business), or Copilot with web search off.
Can our chats be subpoenaed?
Yes, like any business record, and courts can order vendors to keep logs. Set retention on purpose and include AI in litigation holds.
Is self-hosting safer?
Only if you patch and watch it like a vendor would. Self-hosted n8n has had several critical flaws since late 2025. For most small businesses, cloud with single sign-on is safer.
What about DeepSeek?
Its privacy policy said data is stored in China. Iowa banned it on state government devices in February 2025. Block it on business devices.
Do we need to change our cyber insurance?
Probably not the policy, but expect AI questions on applications. Answer them accurately: answers can count as promises.
What's the cheapest meaningful step?
Buy a business AI plan so nobody uses personal accounts, turn on multi-factor, and adopt the callback rule. All three cost little or nothing.
Are there state AI laws we need to follow?
Usually not for an ordinary business using these tools. Minnesota and Iowa, the states we cover in depth, have no general AI law for that; Iowa's 2026 chatbot law, which starts July 1, 2027, targets companion-style chatbots and excludes business customer-service and internal tools. A few states, like Colorado and California, go further, and we check yours. What always applies are the rules you already know: privacy, healthcare, insurance, banking, open records and professional ethics. Announce an AI notetaker on calls, since some states require everyone's consent to record. Your attorney confirms the specifics.
From vendor trust centers and documentation, the GitHub Advisory Database, CISA, the FBI, IBM and Microsoft research, and Iowa Code 715C and Minn. Stat. 325E.61, checked November 9, 2026. Costs are list prices and estimates. This is guidance, not legal advice; your attorney confirms notice duties.
Rather talk it through?
Book a call. Caleb will point you to the right plan and the first project for your business.